Peertube does not understand the proper public IP address #7

New Issue

2021-06-24T16:04:00Z

decentral1se commented

2021-06-24 16:04:00 +00:00

I am not sure this is an issue? It seems like it might be?

I am not sure this is an issue? It seems like it might be? ![image](/attachments/eaa55165-c156-43d3-a44e-77f66fd64d59)

image.png

43 KiB

mirsal commented

2021-07-15 15:12:22 +00:00

That is odd, trust_proxy already contains the whole 10.0.0.0/8 block, see: https://git.autonomic.zone/coop-cloud/peertube/src/branch/main/compose.yml#L47

it looks like the PEERTUBE_TRUST_PROXY environment variable is not read or not taken into account

That is odd, `trust_proxy` already contains the whole `10.0.0.0/8` block, see: https://git.autonomic.zone/coop-cloud/peertube/src/branch/main/compose.yml#L47 it looks like the `PEERTUBE_TRUST_PROXY` environment variable is not read or not taken into account

decentral1se commented

2021-07-15 19:07:23 +00:00

Thanks for looking at this. I see that it is still around in the codebase (via https://github.com/Chocobozzz/PeerTube/search?q=PEERTUBE_TRUST_PROXY) but I do remember having some issues with this. Is the [...] passed actually as a list to the config file? Maybe we should just hard code this in the file and not pass it via the env var?

Thanks for looking at this. I see that it is still around in the codebase (via https://github.com/Chocobozzz/PeerTube/search?q=PEERTUBE_TRUST_PROXY) but I do remember having some issues with this. Is the `[...]` passed actually as a list to the config file? Maybe we should just hard code this in the file and not pass it via the env var?

mirsal commented

2021-07-15 23:51:40 +00:00

Is the [...] passed actually as a list to the config file?

afaiu, it is passed as a string to the config file and it is then parsed as a json list further down. I'll try and debug it asap.

Maybe we should just hard code this in the file and not pass it via the env var?

yeah, that would work, although I believe we should allow it to be overriden for anyone hosting behind a reverse proxy on the outside of the swarm.

> Is the [...] passed actually as a list to the config file? afaiu, it is passed as a string to the config file and it is then parsed as a json list further down. I'll try and debug it asap. > Maybe we should just hard code this in the file and not pass it via the env var? yeah, that would work, although I believe we should allow it to be overriden for anyone hosting behind a reverse proxy on the outside of the swarm.

🚀 1

mirsal commented

2021-07-16 20:28:51 +00:00

Ok, so I just tested this and it works fine on a fresh VM, X-Forwarded-For is interpreted correctly, which means PEERTUBE_TRUST_PROXY is read properly.

It must be that you're coming through docker-proxy, which operates as a TCP reverse proxy and thus, cannot tell anything downstream about the client IP address.

In any case, peertube will only be able to get the client IP address if the client connects to traefik "directly" (without going through docker-proxy) which means in our case, using IPv4 and with traefik configured with TCP ports published in host-mode (called host mode networking in our traefik config).

I hope that doesn't make this even more confusing haha.

Ok, so I just tested this and it works fine on a fresh VM, `X-Forwarded-For` is interpreted correctly, which means `PEERTUBE_TRUST_PROXY` is read properly. It must be that you're coming through docker-proxy, which operates as a TCP reverse proxy and thus, cannot tell anything downstream about the client IP address. In any case, peertube will only be able to get the client IP address if the client connects to traefik "directly" (without going through docker-proxy) which means in our case, using IPv4 and with traefik configured with TCP ports published in host-mode (called host mode networking in our traefik config). I hope that doesn't make this even more confusing haha.

decentral1se commented

2021-07-17 08:59:47 +00:00

Right yep, that makes sense! Thanks for testing it out. I was not using host mode networking in my setup. Should that be the recommended setup? As I see it from the warning given by Peertube, the consequences could be a pretty broken Peertube?