From ca4f4113d970c1917c3e34bbf2c9e216d96ab041 Mon Sep 17 00:00:00 2001
From: f <f@sutty.nl>
Date: Tue, 1 Sep 2026 13:10:59 +0000
Subject: [PATCH] feat: trusted ips (#128)

when traefik is behind a reverse proxy, we need to tell it which
networks to trust with x-real-ip headers

<!--
Thank you for doing recipe maintenance work!
Please mark all checklist items which are relevant for your changes.
Please remove the checklist items which are not relevant for your changes.
Feel free to remove this comment.
-->

* [x] I have deployed and tested my changes
* [x] I have [updated relevant versions in `abra.sh`](https://docs.coopcloud.tech/maintainers/upgrade/#updating-versions-in-the-abrash)
* [x] I have made my environment variable changes [backwards compatible](https://docs.coopcloud.tech/maintainers/upgrade/#backwards-compatible-environment-variable-changes)
* [ ] I have added a [release note entry](https://docs.coopcloud.tech/maintainers/upgrade/#creating-new-release-notes)

Reviewed-on: https://git.coopcloud.tech/coop-cloud/traefik/pulls/128
Reviewed-by: p4u1 <133+p4u1@noreply.git.coopcloud.tech>
Co-authored-by: f <f@sutty.nl>
---
 .env.sample      | 8 ++++++++
 abra.sh          | 2 +-
 traefik.yml.tmpl | 4 ++++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.env.sample b/.env.sample
index 81015a7..d1bec56 100644
--- a/.env.sample
+++ b/.env.sample
@@ -235,3 +235,11 @@ WRITE_TIMEOUT=0s
 
 ## Access logs
 #COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"
+
+## Behind a reverse proxy
+#
+# YAML array of subnets from which Traefik's trusts the x-real-ip
+# header when behind a reverse proxy.
+#
+# https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-forwardedHeaders-trustedIPs
+#TRUSTED_IPS="['10.13.12.1']" # 10.13.12.1 is an example
diff --git a/abra.sh b/abra.sh
index 8abc11d..a6e2b10 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v33
+export TRAEFIK_YML_VERSION=v34
 export FILE_PROVIDER_YML_VERSION=v12
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1
diff --git a/traefik.yml.tmpl b/traefik.yml.tmpl
index 3c4a175..44767a5 100644
--- a/traefik.yml.tmpl
+++ b/traefik.yml.tmpl
@@ -48,6 +48,10 @@ entrypoints:
           to: web-secure
   web-secure:
     address: ":443"
+{{ if ne (env "TRUSTED_IPS") "" }}
+    forwardedHeaders:
+      trustedIPs: {{ env "TRUSTED_IPS" }}
+{{ end }}
     transport:
       respondingTimeouts:
         readTimeout: {{ env "READ_TIMEOUT" }}