feat: Add configurable real IP forwarding for bare-metal clusters
Implement a new nginx.forwardRealIP configuration flag to enable/disable real client IP extraction from X-Forwarded-For headers on bare-metal clusters. Changes: - Added nginx.forwardRealIP.enabled flag (default: false) to values.yaml - Added nginx.forwardRealIP.trustedProxies list for flexible proxy IP ranges - Updated Nginx configmap to conditionally apply real IP extraction settings - Updated FastCGI parameters to use real IP when enabled, direct connection IP otherwise - Updated WordPress wp-config.php to conditionally extract real IPs from headers Configuration: - When enabled: Extracts real client IP from X-Forwarded-For header - When disabled: Uses direct connection IP (default Nginx behavior) - Supports custom proxy IP ranges for CloudFlare, AWS ALB, etc. This allows Helmchart to work seamlessly on both: 1. Bare-metal clusters with iptables load balancing 2. Cloud-managed clusters with proper IP forwarding Version bumped to 6.9.0-a (WordPress version with implementation suffix) Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
This commit is contained in:
32
values.yaml
32
values.yaml
@@ -45,26 +45,20 @@ wordpress:
|
||||
# google.com, pub-0000000000000000, DIRECT, f08c47fec0942fa0
|
||||
|
||||
nginx:
|
||||
extraConfig: |
|
||||
# リアルIPの取得設定
|
||||
real_ip_header X-Forwarded-For;
|
||||
real_ip_recursive on;
|
||||
|
||||
# Kubernetesクラスタ内のIPレンジを信頼
|
||||
set_real_ip_from 10.0.0.0/8;
|
||||
set_real_ip_from 172.16.0.0/12;
|
||||
set_real_ip_from 192.168.0.0/16;
|
||||
|
||||
# CloudflareやAWS ALB等を使っている場合は追加
|
||||
# set_real_ip_from 173.245.48.0/20;
|
||||
# set_real_ip_from 103.21.244.0/22;
|
||||
# ... (Cloudflareの他のIPレンジ)
|
||||
# ベアメタルクラスター等でリアルIPを取得する設定
|
||||
# ローカルIP(ベアメタル等)から訪問者のリアルIPを取得する場合に有効にします
|
||||
forwardRealIP:
|
||||
enabled: false
|
||||
# 信頼できるプロキシのIPレンジを追加してください
|
||||
trustedProxies:
|
||||
- 10.0.0.0/8
|
||||
- 172.16.0.0/12
|
||||
- 192.168.0.0/16
|
||||
# CloudflareやAWS ALB等を使っている場合は以下のIPレンジも追加してください
|
||||
# - 173.245.48.0/20
|
||||
# - 103.21.244.0/22
|
||||
|
||||
# FastCGIパラメータにリアルIPを渡す
|
||||
fastcgiParams:
|
||||
REMOTE_ADDR: $remote_addr
|
||||
HTTP_X_REAL_IP: $realip_remote_addr
|
||||
HTTP_X_FORWARDED_FOR: $proxy_add_x_forwarded_for
|
||||
extraConfig: |
|
||||
|
||||
# Service設定
|
||||
service:
|
||||
|
||||
Reference in New Issue
Block a user