feat: trusted ips

when traefik is behind a reverse proxy, we need to tell it which
networks to trust with x-real-ip headers

.env.sample

@@ -226,5 +226,5 @@ WRITE_TIMEOUT=0s
 ## Enable onion service support
 #ONION_ENABLED=1
 
-## Keep access logs
-#COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"
+# YAML array of trusted subnets
+TRUSTED_IPS=

abra.sh

@@ -1,3 +1,3 @@
-export TRAEFIK_YML_VERSION=v33
+export TRAEFIK_YML_VERSION=v32a
 export FILE_PROVIDER_YML_VERSION=v12
 export ENTRYPOINT_VERSION=v5

compose.access-log.yml

@@ -1,10 +0,0 @@
----
-version: "3.8"
-services:
-  app:
-    environment:
-      ACCESS_LOG_ENABLED: "true"
-    volumes:
-      - "access-logs:/var/log/"
-volumes:
-  access-logs:

traefik.yml.tmpl

@@ -6,21 +6,6 @@ log:
   level: {{ env "LOG_LEVEL" }}
   maxAge: {{ env "LOG_MAX_AGE" }}
 
-{{ if eq (env "ACCESS_LOG_ENABLED") "true" }}
-accessLog:
-  format: "json"
-  filePath: "/var/log/access_log.jsonl"
-  fields:
-    defaultMode: "keep"
-    headers:
-      defaultMode: "keep"
-      names:
-        Authorization: "drop"
-        Cookie: "drop"
-    queryParameters:
-      defaultMode: "keep"
-{{ end }}
-
 providers:
   swarm:
     endpoint: "tcp://socket-proxy:2375"
@@ -48,6 +33,10 @@ entrypoints:
           to: web-secure
   web-secure:
     address: ":443"
+{{ if ne (env "TRUSTED_IPS") "" }}
+    forwardedHeaders:
+      trustedIPs: {{ env "TRUSTED_IPS" }}
+{{ end }}
     transport:
       respondingTimeouts:
         readTimeout: {{ env "READ_TIMEOUT" }}