nginx_proxy: Adding support for TCP Proxy Protocol

[miguelrjim]

This allows Nginx to support the TCP proxy protocol, this is useful if you still want to TLS terminate on the home-assistant host but you have another entrypoint for all your TLS connections (i.e. traefik is your entrypoint and you redirect from it to home-assistant based on the HTTPS domain being requested, this makes sure that any kind of network request to home-assistant remains encrypted).

What this allows is that home-assistant will know the true ip of the user making requests (making this change because I saw in the logs that there was a failed log-in but the ip pointed to my traefik instance).

Tested this by installing these changes as a local add-on on home-assistant.

[miguelrjim]

Hi @agners, just wondering what would be the next step to get the PR merged?

[agners]

I am not very familiar with the various proxy options/configurations, but wouldn't the first option documented in https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/ to get the originating IP address more generic? (E.g. not using the RealIP module? 🤔 ).

[agners]

Maybe this should support a list? 🤔

[miguelrjim]

What field were you thinking?

[agners]

You can ask the user for a list, the Samba add-on has an example for it's allowed host list, syntax would be:

  allow_hosts:
    - str

I am not sure how to make this optional though. 😅

[miguelrjim]

There's definitely some improvements that can be done into how this addon is setup; will definitely take a look later to see about these other kind of changes as well.

[home-assistant]

Please take a look at the requested changes, and use the Ready for review button when you are done, thanks 👍

Learn more about our pull request process.

[miguelrjim]

I am not very familiar with the various proxy options/configurations, but wouldn't the first option documented in https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/ to get the originating IP address more generic? (E.g. not using the RealIP module? 🤔 ).

Hmm it could be? Tbh i've been using $proxy_protocol_addr as that was being used in a couple of other examples with proxy protocol.

[agners]

Hmm it could be? Tbh i've been using $proxy_protocol_addr as that was being used in a couple of other examples with proxy protocol.

There is also this note:

The Real‑IP modules for HTTP and Stream TCP are not included in NGINX Open Source by default; see Installing NGINX Open Source for details. No extra steps are required for NGINX Plus.

🤔

I am really not an expert in NGINX/Proxy setups. But I think if things can work without the RealIP module, it seems the better approach to me.