From 3e58447f12bf1261ff45b17a3f3d91d746d0a28b Mon Sep 17 00:00:00 2001 From: rays Date: Mon, 12 Oct 2026 14:17:22 +0000 Subject: [PATCH] ipx-web: pass the tunnel's Access headers when it arrives as ::ffff: (#209) Caddy listens dual-stack, so the ipx_default gateway connects as ::ffff:192.168.64.1, and remote_ip 192.168.64.1 does not match it: every Cf-Access-* header was stripped, the tunnel's too. The browser suite binds Caddy to 127.0.0.1, IPv4 only, so it never saw it. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 4 ++++ web/Caddyfile | 8 +++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e4f2552..2d4fdff 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,6 +20,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - `docker-compose.yml` is a sample to start from, ipx alone on SQLite with its folders beside the file, instead of a copy of the author's server (#208). - The source is a Cargo workspace: the daemon in `crates/ipx`, feed fetching and parsing in `crates/feed`. `cargo build --release` still makes `target/release/ipx` (#202). +### Fixed + +- Signing in through Cloudflare Access works behind ipx-web: Caddy took the tunnel's address for someone else's and dropped its sign-in headers (#209). + ## [0.12.0] - 2026-10-11 ### Added diff --git a/web/Caddyfile b/web/Caddyfile index dc8f25d..e0f85a1 100644 --- a/web/Caddyfile +++ b/web/Caddyfile @@ -2,7 +2,7 @@ # so the session cookie, live updates and Cloudflare Access work as they did when ipx served it. # IPX_UPSTREAM where ipx is, host:port (ipx:8099) # WEB_BIND where to listen (:8080) -# TUNNEL_PEER the one address whose Cf-Access-* headers are passed on: where cloudflared's +# TUNNEL_PEER the one IPv4 address whose Cf-Access-* headers are passed on: where cloudflared's # requests come from. Nobody else's are, so nobody else can claim to be signed in # by Cloudflare. Unset passes none. { @@ -13,8 +13,10 @@ http://{$WEB_BIND::8080} { root * {$WEB_ROOT:/srv} - # Before anything else, so no page or API call sees them: only ipx sets these. - @forged not remote_ip {$TUNNEL_PEER:255.255.255.255} + # Before anything else, so no page or API call sees them: only ipx sets these. Both forms of + # the peer: Caddy listens dual-stack, so an IPv4 peer arrives as ::ffff:a.b.c.d, which the + # plain address does not match, and the tunnel's headers were stripped too (#209). + @forged not remote_ip {$TUNNEL_PEER:255.255.255.255} ::ffff:{$TUNNEL_PEER:255.255.255.255} request_header @forged -Cf-Access-Authenticated-User-Email request_header @forged -Cf-Access-Jwt-Assertion