nomad

created pr with 8.1 on 2026-06-25 · by 84351313

cmds

checkout latest patchset:

ssh pr.in0rdr.ch print 8 | git am -3

checkout any patchset in a patch request:

ssh pr.in0rdr.ch print 8.[rev] | git am -3

add changes to patch request:

git format-patch main --stdout | ssh pr.in0rdr.ch pr add 8

Patchset `8.1` on 2026-06-25 · commit b5bc39c

feat(git): anubis sidecar

Andreas Gruhler 2026-03-27

feat: RemoteIPProxyProtocol

Andreas Gruhler 2026-03-30

fix: add podman net to trusted proxies

Andreas Gruhler 2026-03-31

fix: ServerName in vHost

Andreas Gruhler 2026-04-01

→ feat: change RemoteIPInternalProxy

Andreas Gruhler 2026-04-01

feat: change RemoteIPInternalProxy

Andreas Gruhler 2026-04-01

feat: change RemoteIPInternalProxy

Andreas Gruhler 2026-04-01

Semantic diff summary

0 added, 0 modified, 0 signature changed, 0 removed across 0 analyzed files (1 file skipped: unsupported file type)

+8 -9 hcl/default/git/templates/stagit.conf.tmpl #

......@@ -1,7 +1,7 @@
ErrorLog /dev/stderr
TransferLog /dev/stdout

LogFormat "%{X-Forwarded-For}i %h %l %u %t \"%r\" %>s %b" common
LogFormat "%{X-Real-Ip}i %h %l %u %t \"%r\" %>s %b" common

# HTTPS listener that forwards to Anubis
<IfModule mod_proxy.c>

......@@ -10,17 +10,10 @@ LogFormat "%{X-Forwarded-For}i %h %l %u %t \"%r\" %>s %b" common
    SSLCertificateFile "/etc/letsencrypt/live/code.in0rdr.ch/fullchain.pem"
    SSLCertificateKeyFile "/etc/letsencrypt/live/code.in0rdr.ch/privkey.pem"

    # Haproxy sends real ip (send-proxy)
    # HAProxy sends real ip (send-proxy)
    # https://www.haproxy.com/documentation/haproxy-configuration-manual/latest/#send-proxy
    # https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html#remoteipproxyprotocol
    RemoteIPProxyProtocol On
    # Haproxy network
    RemoteIPInternalProxy 10.0.0.0/24
    RemoteIPInternalProxy 10.0.0.1
    # Podman default bridge network
    # https://docs.podman.io/en/stable/markdown/podman-network.1.html
    RemoteIPInternalProxy 10.88.0.0/16
    RemoteIPInternalProxy 10.88.0.1

    # These headers need to be set or else Anubis will
    # throw an "admin misconfiguration" error.

......@@ -40,6 +33,12 @@ LogFormat "%{X-Forwarded-For}i %h %l %u %t \"%r\" %>s %b" common
<VirtualHost *:80>
  DocumentRoot /var/www/localhost/htdocs

  # HAProxy and Podman default bridge network
  # https://docs.podman.io/en/stable/markdown/podman-network.1.html
  RemoteIPHeader        X-Real-Ip
  RemoteIPInternalProxy 10.0.0.0/8
  RemoteIPTrustedProxy  127.0.0.1/32

  <Directory /var/www/localhost/htdocs>
      Order allow,deny
      Allow from all

...	...		@@ -1,7 +1,7 @@
1	1		ErrorLog /dev/stderr
2	2		TransferLog /dev/stdout
3	3
4		-	LogFormat "%{X-Forwarded-For}i %h %l %u %t \"%r\" %>s %b" common
	4	+	LogFormat "%{X-Real-Ip}i %h %l %u %t \"%r\" %>s %b" common
5	5
6	6		# HTTPS listener that forwards to Anubis
7	7		<IfModule mod_proxy.c>

...	...		@@ -10,17 +10,10 @@ LogFormat "%{X-Forwarded-For}i %h %l %u %t \"%r\" %>s %b" common
10	10		SSLCertificateFile "/etc/letsencrypt/live/code.in0rdr.ch/fullchain.pem"
11	11		SSLCertificateKeyFile "/etc/letsencrypt/live/code.in0rdr.ch/privkey.pem"
12	12
13		-	# Haproxy sends real ip (send-proxy)
	13	+	# HAProxy sends real ip (send-proxy)
14	14		# https://www.haproxy.com/documentation/haproxy-configuration-manual/latest/#send-proxy
15	15		# https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html#remoteipproxyprotocol
16	16		RemoteIPProxyProtocol On
17		-	# Haproxy network
18		-	RemoteIPInternalProxy 10.0.0.0/24
19		-	RemoteIPInternalProxy 10.0.0.1
20		-	# Podman default bridge network
21		-	# https://docs.podman.io/en/stable/markdown/podman-network.1.html
22		-	RemoteIPInternalProxy 10.88.0.0/16
23		-	RemoteIPInternalProxy 10.88.0.1
24	17
25	18		# These headers need to be set or else Anubis will
26	19		# throw an "admin misconfiguration" error.

...	...		@@ -40,6 +33,12 @@ LogFormat "%{X-Forwarded-For}i %h %l %u %t \"%r\" %>s %b" common
40	33		<VirtualHost *:80>
41	34		DocumentRoot /var/www/localhost/htdocs
42	35
	36	+	# HAProxy and Podman default bridge network
	37	+	# https://docs.podman.io/en/stable/markdown/podman-network.1.html
	38	+	RemoteIPHeader X-Real-Ip
	39	+	RemoteIPInternalProxy 10.0.0.0/8
	40	+	RemoteIPTrustedProxy 127.0.0.1/32
	41	+
43	42		<Directory /var/www/localhost/htdocs>
44	43		Order allow,deny
45	44		Allow from all

nomad

Patchset 8.1 on 2026-06-25 · commit b5bc39c

Patchset `8.1` on 2026-06-25 · commit b5bc39c