When Traefik runs behind another HTTP proxy (e.g. an external load balancer or CDN), the real client IP is only available through X-Forwarded-For headers, which must be accepted only from known proxy addresses. NS8 already supports this at the backend level, but the settings are not exposed in the UI.
Proposed solution
Implement the Figma mockup from #7973 (comment): a new Frontend proxies tab under the HTTP routes page.
The tab configures for each cluster node:
- the list of frontend proxy IPv4/IPv6 addresses (backend: trusted proxies)
- the Trust depth, i.e. how many proxy levels are trusted (default
1)
The existing Traefik set-trusted-proxies action already covers the write path. A corresponding get-trusted-proxies read action already exists for the UI to display current values.
This issue is a spin-off of the TLS certificates enhancements design (#7973), where trusted proxy settings were originally scoped.
See also
Design issue: #7973
Discussions
When Traefik runs behind another HTTP proxy (e.g. an external load balancer or CDN), the real client IP is only available through
X-Forwarded-Forheaders, which must be accepted only from known proxy addresses. NS8 already supports this at the backend level, but the settings are not exposed in the UI.Proposed solution
Implement the Figma mockup from #7973 (comment): a new Frontend proxies tab under the HTTP routes page.
The tab configures for each cluster node:
1)The existing Traefik
set-trusted-proxiesaction already covers the write path. A correspondingget-trusted-proxiesread action already exists for the UI to display current values.This issue is a spin-off of the TLS certificates enhancements design (#7973), where trusted proxy settings were originally scoped.
See also
Design issue: #7973
Discussions