Add configurable real IP header variables for Apache and NGINX

docs/content/docs/8.reference/1.environment-variable-specification.md

@@ -16,6 +16,7 @@ Setting environment variables all depends on what method you're using to run you
 **Variable Name**|**Description**|**Used in variation**
 :-----:|:-----:|:-----:
 `APACHE_DOCUMENT_ROOT`<br />*Default: "/var/www/html/public"*|Sets the directory from which Apache will serve files. (<a target="_blank" href="https://httpd.apache.org/docs/2.4/mod/core.html#documentroot">Official docs</a>)|fpm-apache
+`APACHE_REMOTE_IP_HEADER`<br />*Default: "CF-Connecting-IP"*|Sets the HTTP request header used by `mod_remoteip` to identify the real client IP address. Change to `X-Forwarded-For` for non-Cloudflare reverse proxies. (<a target="_blank" href="https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html#remoteipheader">Official docs</a>)|fpm-apache
 `APACHE_HTTP_PORT`<br />*Default: "8080"*|Set the port for HTTP. (<a target="_blank" href="https://httpd.apache.org/docs/2.4/mod/core.html#port">Official docs</a>)|fpm-apache
 `APACHE_HTTPS_PORT`<br />*Default: "8443"*|Set the port for HTTPS. (<a target="_blank" href="https://httpd.apache.org/docs/2.4/mod/core.html#port">Official docs</a>)|fpm-apache
 `APACHE_MAX_CONNECTIONS_PER_CHILD`<br />*Default: "0"*|Sets the limit on the number of connections that an individual child server process will handle.(<a target="_blank" href="https://httpd.apache.org/docs/2.4/mod/mpm_common.html#maxconnectionsperchild">Official docs</a>)|fpm-apache
@@ -71,6 +72,7 @@ Setting environment variables all depends on what method you're using to run you
 `NGINX_FASTCGI_BUFFERS`<br />*Default: "8 8k"*|Sets the number and size of the buffers used for reading a response from a FastCGI server. (<a target="_blank" href="https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html#fastcgi_buffers">Official Docs</a>)|fpm-nginx
 `NGINX_FASTCGI_BUFFER_SIZE`<br />*Default: "8k"*|Sets the size of the buffer used for reading a response from a FastCGI server. (<a target="_blank" href="https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html#fastcgi_buffer_size">Official Docs</a>)|fpm-nginx
 `NGINX_LISTEN_IP_PROTOCOL`<br />*Default: "all"*|Set the IP protocol for NGINX to listen on. Valid values are "all", "ipv4", and "ipv6". (<a target="_blank" href="https://nginx.org/en/docs/http/ngx_http_core_module.html#listen">Official Docs</a>)|fpm-nginx
+`NGINX_REAL_IP_HEADER`<br />*Default: "CF-Connecting-IP"*|Sets the HTTP request header used by `ngx_http_realip_module` to identify the real client IP address. Change to `X-Forwarded-For` for non-Cloudflare reverse proxies. (<a target="_blank" href="https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header">Official Docs</a>)|fpm-nginx
 `NGINX_SERVER_TOKENS`<br />*Default: "off"*|Display NGINX version in responses. (<a target="_blank" href="https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens">Official Docs</a>)|fpm-nginx
 `NGINX_WEBROOT`<br />*Default: "`/var/www/html/public"*|Sets the root directory for requests. (<a target="_blank" href="https://nginx.org/en/docs/http/ngx_http_core_module.html#root">Official Docs</a>)|fpm-nginx
 `NGINX_CLIENT_MAX_BODY_SIZE`<br />*Default: "100M"*|Sets the max body size for requests. (<a target="_blank" href="https://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size">Official Docs</a>)|fpm-nginx

src/s6/etc/entrypoint.d/10-init-webserver-config.sh

@@ -137,6 +137,7 @@ if [ "$DISABLE_DEFAULT_CONFIG" = false ]; then
         enable_apache_conf remoteip security serversideup
         enable_apache_site "$SSL_MODE"
     elif [ "$SERVER_TYPE" = "NGINX" ]; then
+        process_template /etc/nginx/server-opts.d/remoteip.conf.template /etc/nginx/server-opts.d/remoteip.conf
         process_template /etc/nginx/nginx.conf.template /etc/nginx/nginx.conf
         process_template /etc/nginx/site-opts.d/http.conf.template /etc/nginx/site-opts.d/http.conf
         process_template /etc/nginx/site-opts.d/https.conf.template /etc/nginx/site-opts.d/https.conf

src/variations/fpm-apache/Dockerfile

@@ -47,6 +47,7 @@ ENV APACHE_DOCUMENT_ROOT=/var/www/html/public \
     APACHE_THREADS_PER_CHILD="25" \
     APACHE_MAX_REQUEST_WORKERS="150" \
     APACHE_MAX_CONNECTIONS_PER_CHILD="0" \
+    APACHE_REMOTE_IP_HEADER="CF-Connecting-IP" \
     APACHE_RUN_USER="www-data" \
     APACHE_RUN_GROUP="www-data" \
     APP_BASE_DIR=/var/www/html \

src/variations/fpm-apache/etc/apache2/conf-available/remoteip.conf

@@ -1,4 +1,4 @@
-RemoteIPHeader CF-Connecting-IP
+RemoteIPHeader ${APACHE_REMOTE_IP_HEADER}
 RemoteIPTrustedProxy 173.245.48.0/20
 RemoteIPTrustedProxy 103.21.244.0/22
 RemoteIPTrustedProxy 103.22.200.0/22

src/variations/fpm-apache/etc/apache2/sites-available/ssl-full.conf

@@ -3,8 +3,8 @@
     ServerName localhost
     ServerAdmin webmaster@localhost
 
-    # Set CloudFlare Real IP
-    RemoteIPHeader CF-Connecting-IP
+    # Set Real IP header
+    RemoteIPHeader ${APACHE_REMOTE_IP_HEADER}
 
     # Turn on rewrite engine
     RewriteEngine On

src/variations/fpm-apache/etc/apache2/vhost-templates/http.conf

@@ -2,8 +2,8 @@
 ServerName localhost
 ServerAdmin webmaster@localhost
 
-# Set CloudFlare Real IP
-RemoteIPHeader CF-Connecting-IP
+# Set Real IP header
+RemoteIPHeader ${APACHE_REMOTE_IP_HEADER}
 
 # Configure main document root
 DocumentRoot ${APACHE_DOCUMENT_ROOT}

src/variations/fpm-apache/etc/apache2/vhost-templates/https.conf

@@ -7,8 +7,8 @@ Protocols h2 http/1.1
 
 SSLProtocol -all +TLSv1.2 +TLSv1.3
 
-# Set CloudFlare Real IP
-RemoteIPHeader CF-Connecting-IP
+# Set Real IP header
+RemoteIPHeader ${APACHE_REMOTE_IP_HEADER}
 
 # Configure main document root
 DocumentRoot ${APACHE_DOCUMENT_ROOT}

src/variations/fpm-nginx/Dockerfile

@@ -127,6 +127,7 @@ ENV APP_BASE_DIR=/var/www/html \
     NGINX_HTTP_PORT="8080" \
     NGINX_HTTPS_PORT="8443" \
     NGINX_LISTEN_IP_PROTOCOL="all" \
+    NGINX_REAL_IP_HEADER="CF-Connecting-IP" \
     NGINX_SERVER_TOKENS=off \
     NGINX_WEBROOT=/var/www/html/public \
     NGINX_CLIENT_MAX_BODY_SIZE="100M" \

src/variations/fpm-nginx/etc/nginx/server-opts.d/remoteip.conf → src/variations/fpm-nginx/etc/nginx/server-opts.d/remoteip.conf.template

@@ -32,5 +32,5 @@ set_real_ip_from 2a06:98c0::/29;
 set_real_ip_from 2c0f:f248::/32;
 
 # Set RealIP header
-real_ip_header CF-Connecting-IP;
+real_ip_header ${NGINX_REAL_IP_HEADER};
 real_ip_recursive on;