[Vuejs]-Nginx behind haproxy to static html ssl getting real IP address

by

-1👍

On the nginx side you can control which IP addresses or ranges are permitted with a deny all and an allow range to your server block like so:

allow  192.168.1.0/24;
deny   all;

Note: The nginx docs are always an excellent place to start, here’s the docs for restricting access by IP addresses and ranges.

First, I would challenge you to reconsider why you need a load balancer with haproxy for something as simple as a html/css/js static site. More infrastructure introduces more complications.

Second, the upstream in nginx is only needed if you want to point requests to a local wsgi server for example, in your case this is static content so you shouldn’t need to point to an upstream – not unless you have some sort of wsgi service you want to forward requests to.

Finally, as for haproxy only forwarding requests as 127.0.0.1, first make sure the IP is in the header (i.e. X-Real-IP) then you can try to add something like this to your haproxy config (source), if you indeed want to keep haproxy:

frontend all_https
  option forwardfor header X-Real-IP
  http-request set-header X-Real-IP %[src]

The haproxy documentation is also a good resource for preserving source IP addresses.

👤yekta

Leave a comment