doc: trusted ips context

when traefik is behind a reverse proxy, we need to tell it which
networks to trust with x-real-ip headers

.env.sample

@@ -235,3 +235,11 @@ WRITE_TIMEOUT=0s
 
 ## Access logs
 #COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"
+
+## Behind a reverse proxy
+#
+# YAML array of subnets from which Traefik's trusts the x-real-ip
+# header when behind a reverse proxy.
+#
+# https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-forwardedHeaders-trustedIPs
+#TRUSTED_IPS="['10.13.12.1']" # 10.13.12.1 is an example

abra.sh

@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v33
+export TRAEFIK_YML_VERSION=v34
 export FILE_PROVIDER_YML_VERSION=v12
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1

compose.yml

@@ -62,7 +62,7 @@ services:
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:3.4.4
+    image: lscr.io/linuxserver/socket-proxy:3.4.3
     deploy:
       endpoint_mode: dnsrr
     environment:

traefik.yml.tmpl

@@ -48,6 +48,10 @@ entrypoints:
           to: web-secure
   web-secure:
     address: ":443"
+{{ if ne (env "TRUSTED_IPS") "" }}
+    forwardedHeaders:
+      trustedIPs: {{ env "TRUSTED_IPS" }}
+{{ end }}
     transport:
       respondingTimeouts:
         readTimeout: {{ env "READ_TIMEOUT" }}