mrkey148
mrkey148
PostsComments
IImmich
Created by mrkey148 on 2/16/2025 in #help-desk-support
Understanding required headers to show real client ip in immich logs
For anyone who finds this post in the future I did find a Traefik plugin that can manually construct the X-Forwarded-For header. It can set the value of one header as the value of another, but at the time of writing that only works for their concatenation function. So you have to first set the empty XFF header, then concat in the client ip with whitespace as the separator, then remove the whitespace, then concat in the proxy host ip. Extremely hacky but it does work with a config like the following 
my-htransformation:
  plugin:
    htransformation:
      Rules:
        - Rule:
          Name: 'Set Client X-Forwarded-For'
          Header: 'X-Forwarded-For'
          Value: ""
          Type: 'Set'
        - Rule:
          Name: "Join XFF client"
          Header: "X-Forwarded-For"
          HeaderPrefix: "^"
          Sep: " "
          Values:
            - "^X-Real-Ip"
          Type: "Join"
        - Rule:
          Name: "Remove empty space"
          Header: "X-Forwarded-For"
          Value: " (.*)"
          ValueReplace: "$1"
          Type: "RewriteValueRule"
        - Rule:
          Name: 'Join X-Forwarded-For'
          Header: 'X-Forwarded-For'
          Sep: ', '
          Values:
            - '<your_proxy_ip>'
          Type: 'Join'
my-htransformation:
  plugin:
    htransformation:
      Rules:
        - Rule:
          Name: 'Set Client X-Forwarded-For'
          Header: 'X-Forwarded-For'
          Value: ""
          Type: 'Set'
        - Rule:
          Name: "Join XFF client"
          Header: "X-Forwarded-For"
          HeaderPrefix: "^"
          Sep: " "
          Values:
            - "^X-Real-Ip"
          Type: "Join"
        - Rule:
          Name: "Remove empty space"
          Header: "X-Forwarded-For"
          Value: " (.*)"
          ValueReplace: "$1"
          Type: "RewriteValueRule"
        - Rule:
          Name: 'Join X-Forwarded-For'
          Header: 'X-Forwarded-For'
          Sep: ', '
          Values:
            - '<your_proxy_ip>'
          Type: 'Join'
After getting this working my immich server was still not showing the correct ip, until I found a thread talking about the IMMICH_TRUSTED_PROXIES environment variable, added that, and now my setup is working 🙃 . So I have no idea if any of this header rewrite stuff was necessary or not but I figured I'd share for entertainment purposes if nothing else.
10 replies
IImmich
Created by mrkey148 on 2/16/2025 in #help-desk-support
Understanding required headers to show real client ip in immich logs
Got it. Best I've been able to tell they don't set XFF where traefik is the only proxy. They will only preserve it if set by a trusted proxy ahead of traefik. I'll see if there's a way to manually set it.
10 replies