feat: trusted ips

when traefik is behind a reverse proxy, we need to tell it which
networks to trust with x-real-ip headers

.env.sample

@@ -235,3 +235,9 @@ WRITE_TIMEOUT=0s
 
 ## Access logs
 #COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"
+
+# YAML array of subnets from which Traefik's trusts the x-real-ip
+# header.
+#
+# https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-forwardedHeaders-trustedIPs
+#TRUSTED_IPS="['10.13.12.1']" # 10.13.12.1 is an example

abra.sh

@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v33
+export TRAEFIK_YML_VERSION=v34
 export FILE_PROVIDER_YML_VERSION=v12
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1

traefik.yml.tmpl

@@ -48,6 +48,10 @@ entrypoints:
           to: web-secure
   web-secure:
     address: ":443"
+{{ if ne (env "TRUSTED_IPS") "" }}
+    forwardedHeaders:
+      trustedIPs: {{ env "TRUSTED_IPS" }}
+{{ end }}
     transport:
       respondingTimeouts:
         readTimeout: {{ env "READ_TIMEOUT" }}