From 418bd1edbdb840977a214c7546e242a0a458269f Mon Sep 17 00:00:00 2001 From: Vidar Langseid Date: Fri, 14 Aug 2026 09:30:47 +0200 Subject: [PATCH 1/2] IBX-11181: Filtered client-supplied X-Forwarded-* headers in Varnish VCL --- docker/entrypoint/varnish/entrypoint.sh | 19 +++++++++++++++++++ docker/entrypoint/varnish/parameters.vcl | 11 +++++++++++ 2 files changed, 30 insertions(+) diff --git a/docker/entrypoint/varnish/entrypoint.sh b/docker/entrypoint/varnish/entrypoint.sh index 1ae5f98..8b6e650 100755 --- a/docker/entrypoint/varnish/entrypoint.sh +++ b/docker/entrypoint/varnish/entrypoint.sh @@ -4,6 +4,7 @@ # [--acl-all-networks] - Add all container's network in the PURGE ACL. # [--acl-add ...] - Add a host or network segment to the PURGE ACL # [--debug-acl-add ...] - Add a host or network segment to the debuggers ACL +# [--trusted-proxy-add ...] - Add a host or network segment to the trusted_proxies ACL function create_template_file { @@ -64,6 +65,15 @@ function add_segment_to_debugger_acl sed -i -s "s|\(.*DEBUGGER.*\)| $segment\n\1|" /etc/varnish/parameters.vcl } +# $1 is segment, format 1.2.3.4/24 or myhostname +function add_segment_to_trusted_proxies_acl +{ + segment=`format_segment $1` + + echo "Adding network segment to varnish trusted_proxies : $segment" + sed -i -s "s|\(.*TRUSTED_PROXY.*\)| $segment\n\1|" /etc/varnish/parameters.vcl +} + create_template_file while (( "$#" )); do @@ -91,6 +101,15 @@ while (( "$#" )); do else add_segment_to_debugger_acl $new_network fi + elif [ "$1" = "--trusted-proxy-add" ]; then + shift + new_network="$1" + + if [ "$new_network" = "" ]; then + echo "Warning : --trusted-proxy-add parameter needs to be followed by a network segment, for instance \"--trusted-proxy-add 10.0.1.0/24\"" + else + add_segment_to_trusted_proxies_acl $new_network + fi else echo "Warning : Unrecognized parameter $1" fi diff --git a/docker/entrypoint/varnish/parameters.vcl b/docker/entrypoint/varnish/parameters.vcl index 652211a..111a3ad 100644 --- a/docker/entrypoint/varnish/parameters.vcl +++ b/docker/entrypoint/varnish/parameters.vcl @@ -18,3 +18,14 @@ acl debuggers { "172.16.0.0"/12; // DEBUGGER } + +// ACL for reverse proxies, TLS terminators and CDNs running in front of Varnish +// +// Only these are allowed to set the "X-Forwarded-*" and "Forwarded" headers, see vcl_recv. +// Deliberately does not include the Docker network segment: nothing runs in front of Varnish in +// this setup, so every incoming request is to be treated as coming straight from a client. +// Extend with --trusted-proxy-add if you put something in front of it. +acl trusted_proxies { + "127.0.0.1"; +// TRUSTED_PROXY +} From 08b814b81442c0a8052dbaa5283898a3f5f9d98b Mon Sep 17 00:00:00 2001 From: Vidar Langseid Date: Fri, 14 Aug 2026 14:04:41 +0200 Subject: [PATCH 2/2] IBX-11181: Added Varnish compose overlay declaring the app container a trusted proxy --- docker/varnish-trusted-proxy.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 docker/varnish-trusted-proxy.yml diff --git a/docker/varnish-trusted-proxy.yml b/docker/varnish-trusted-proxy.yml new file mode 100644 index 0000000..77e6e12 --- /dev/null +++ b/docker/varnish-trusted-proxy.yml @@ -0,0 +1,19 @@ +# Overlay declaring the app container a trusted proxy. +# +# Apply it after any of the varnish compose files - varnish.yml, varnish7.yml, varnish9.yml - as +# they all define the same "varnish" service and share the same entrypoint: +# -f doc/docker/base-dev.yml -f doc/docker/varnish.yml -f doc/docker/varnish-trusted-proxy.yml +# +# By default the trusted_proxies ACL in parameters.vcl holds only localhost, so Varnish strips the +# X-Forwarded-* and Forwarded headers of every incoming request. Adding the app container makes +# Varnish pass those headers through instead, which is what a TLS terminator, load balancer or CDN +# running in front of Varnish relies on. +# +# The invalidators and debuggers flags are repeated here on purpose: Compose replaces "command" +# wholesale, so listing only the new flag would drop the ones varnish.yml sets. Do not rely on the +# 172.16.0.0/12 entry in parameters.vcl covering the app container - that only holds while Docker +# allocates networks from its default pool. + +services: + varnish: + command: ["--acl-add", "app", "--debug-acl-add", "app", "--trusted-proxy-add", "app"]