openvibers/openvibe.events Commits

nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose the address the service bans and rate-limits by

OP OpenVibers committed 23 Sept 2026 · b47b99d97a · 1 file, +10 −6





Changes
ddiff --git a/deploy/nginx/events.openvibe.network.conf b/deploy/nginx/events.openvibe.network.conf
iindex ec9037b..d621f2d 100644
---- a/deploy/nginx/events.openvibe.network.conf
++++ b/deploy/nginx/events.openvibe.network.conf
@@@ -60,7 +60,8 @@ server {
          proxy_set_header Connection "";
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
--        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
++        proxy_set_header X-Forwarded-For $remote_addr;
++        proxy_set_header CF-Connecting-IP $remote_addr;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header Last-Event-ID $http_last_event_id;
          proxy_buffering off;
@@@ -74,9 +75,9 @@ server {
  
      # X-Forwarded-For on every proxied location: the service treats a request without it from
      # 127.0.0.1 as a local caller (GET /metrics answers only those).
--    location = /api/health   { proxy_pass http://127.0.0.1:4300; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
--    location = /api/ready    { proxy_pass http://127.0.0.1:4300; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
--    location = /release.json { proxy_pass http://127.0.0.1:4300; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
++    location = /api/health   { proxy_pass http://127.0.0.1:4300; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header CF-Connecting-IP $remote_addr; }
++    location = /api/ready    { proxy_pass http://127.0.0.1:4300; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header CF-Connecting-IP $remote_addr; }
++    location = /release.json { proxy_pass http://127.0.0.1:4300; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header CF-Connecting-IP $remote_addr; }
  
      # Metrics are for host-local scrapers only (http://127.0.0.1:4300/metrics).
      location = /metrics { return 404; }
@@@ -90,7 +91,8 @@ server {
          proxy_set_header Connection "";
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
--        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
++        proxy_set_header X-Forwarded-For $remote_addr;
++        proxy_set_header CF-Connecting-IP $remote_addr;
          proxy_set_header X-Forwarded-Proto $scheme;
      }
  
@@@ -108,7 +110,9 @@ server {
      location = / {
          proxy_pass http://127.0.0.1:4300;
          proxy_set_header Host $host;
--        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
++        proxy_set_header X-Real-IP $remote_addr;
++        proxy_set_header X-Forwarded-For $remote_addr;
++        proxy_set_header CF-Connecting-IP $remote_addr;
      }
  
      location / {