feat: trusted ips (#128)

when traefik is behind a reverse proxy, we need to tell it which
networks to trust with x-real-ip headers

<!--
Thank you for doing recipe maintenance work!
Please mark all checklist items which are relevant for your changes.
Please remove the checklist items which are not relevant for your changes.
Feel free to remove this comment.
-->

* [x] I have deployed and tested my changes
* [x] I have [updated relevant versions in `abra.sh`](https://docs.coopcloud.tech/maintainers/upgrade/#updating-versions-in-the-abrash)
* [x] I have made my environment variable changes [backwards compatible](https://docs.coopcloud.tech/maintainers/upgrade/#backwards-compatible-environment-variable-changes)
* [ ] I have added a [release note entry](https://docs.coopcloud.tech/maintainers/upgrade/#creating-new-release-notes)

Reviewed-on: #128
Reviewed-by: p4u1 <133+p4u1@noreply.git.coopcloud.tech>
Co-authored-by: f <f@sutty.nl>

.env.sample

@@ -235,3 +235,11 @@ WRITE_TIMEOUT=0s
 
 ## Access logs
 #COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"
+
+## Behind a reverse proxy
+#
+# YAML array of subnets from which Traefik's trusts the x-real-ip
+# header when behind a reverse proxy.
+#
+# https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-forwardedHeaders-trustedIPs
+#TRUSTED_IPS="['10.13.12.1']" # 10.13.12.1 is an example

abra.sh

@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v33
+export TRAEFIK_YML_VERSION=v34
 export FILE_PROVIDER_YML_VERSION=v12
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1

traefik.yml.tmpl

@@ -48,6 +48,10 @@ entrypoints:
           to: web-secure
   web-secure:
     address: ":443"
+{{ if ne (env "TRUSTED_IPS") "" }}
+    forwardedHeaders:
+      trustedIPs: {{ env "TRUSTED_IPS" }}
+{{ end }}
     transport:
       respondingTimeouts:
         readTimeout: {{ env "READ_TIMEOUT" }}