Configure Traefik behind frontend HTTP proxy

When Traefik runs behind another HTTP proxy (e.g. an external load balancer or CDN), the real client IP is only available through X-Forwarded-For headers, which must be accepted only from known proxy addresses. NS8 already supports this at the backend level, but the settings are not exposed in the UI.

Proposed solution

Implement the Figma mockup from #7973 (comment): a new Frontend proxies tab under the HTTP routes page.

The tab configures for each cluster node:

the list of frontend proxy IPv4/IPv6 addresses (backend: trusted proxies)
the Trust depth, i.e. how many proxy levels are trusted (default 1)

The existing Traefik set-trusted-proxies action already covers the write path. A corresponding get-trusted-proxies read action already exists for the UI to display current values.

This issue is a spin-off of the TLS certificates enhancements design (#7973), where trusted proxy settings were originally scoped.

See also

Design issue: #7973

Discussions

https://mattermost.nethesis.it/nethesis/pl/w95t1ufqztd1xqa1u8jtqgy9qo

lucia private talk

Add Frontend proxies tab to the HTTP routes page (#1258)

QA — core 3.22.0-dev.2 — Frontend proxies tab (UI)

Scope: UI only. The PR adds a tab bar to the HTTP routes page, moves the route table into a Routes tab and adds a Frontend proxies tab driving the existing get-trusted-proxies / set-trusted-proxies Traefik actions. No Traefik action, schema or template was modified, so a failure is almost always in the frontend.

PR: NethServer/ns8-core#1258 — issue #8098

Page under test: Settings › HTTP routes, /settings/http-routes

1. Preconditions

Cluster running core:3.22.0-dev.2, browser console open
api-cli run module/traefik1/get-trusted-proxies returns {"proxies": [], "depth": 0}
A few HTTP routes already defined

One node is enough except for the checks marked 2 nodes.

2. Tabs

Opening the page selects Routes and the URL gains view=routes; clicking Frontend proxies sets view=frontend-proxies
Reload, back and forward all land on the same tab; ?view=nonsense falls back to Routes
Each tab keeps its own node filter, selectedNodeId for Routes and proxyNodeId for Frontend proxies, and both survive a reload

3. Routes tab regression

The route table only moved to another component, its behaviour must be identical.

List, filters, pagination, create, edit and delete a route: unchanged
The route modal still accepts 192.168.1.0/24 in the access control field and still rejects a malformed address

4. Add modal

The empty state reads No frontend proxy configured and holds an enabled Add frontend proxy button
The modal lists every node labelled with its Traefik instance, for example Node 1 (traefik1), defaults the trust depth to 1, and warns that Traefik will be restarted once a node is selected

5. Validation

Submit empty: node and proxies both show Required, the node combo box takes the focus
1.1.1.001 → Invalid IPv4 address. Leading zeros are refused on purpose, an octet like 001 can be read as octal elsewhere in the chain.
fe80::zz → Invalid IPv6 address
192.168.1.0/24 → rejected. A CIDR prefix is not accepted here, unlike the route access control field.
Two valid addresses plus an empty line and trailing spaces: accepted, blanks ignored
Trust depth 0 or empty → Enter a number of 1 or higher

6. Save

Submit a valid configuration: Traefik restarts, the websocket drops, and the modal closes on its own instead of staying stuck in loading
The new row lists the node with its Traefik instance, the addresses sorted one per line, and the depth
api-cli run module/traefik1/get-trusted-proxies returns the same values; reload keeps the row
Once every node is configured, the toolbar button is disabled with the tooltip All cluster nodes already have a frontend proxy
2 nodes — a configured node is no longer offered in the Add modal

7. Edit

Row menu Edit: the modal is titled Edit frontend proxies of , has no node combo box, and is prefilled with the current values and the restart warning
Change the depth, remove one address, save: the row and get-trusted-proxies both show the new values
Reopen the modal: it shows the saved values. Cancel changes nothing.

8. Delete

Row menu Delete: the modal is titled Delete frontend proxies of and warns that Traefik will no longer see the real client IP
The delete button stays disabled until node<N> is typed exactly, for example node1
Confirm: Traefik restarts, the row disappears, get-trusted-proxies returns {"proxies": [], "depth": 0}
The node is offered again in the Add modal and the toolbar button is enabled
Deleting the last configuration brings the empty state back

9. Filters

The text filter matches the node name, an address and the depth; the node filter lists Any node plus every Traefik node
A filter matching nothing shows No search results, and Clear filters resets both filters

10. Errors — 2 nodes

Stop one node or its Traefik instance and reload: the rows that answered are still listed, with an error notification above the table
With every read failing, the table shows its error state
Bring the node back and reload: no stale error remains
Switching tabs back and forth does not duplicate rows

Known, not a failure

No backend-validation section: the frontend is stricter than the action on both fields. The backend path works — api-cli run module/traefik1/set-trusted-proxies --data '{"proxies":["1.1.1.001"],"depth":1}' returns bad_ip_address.
::1%lo is refused by the modal, accepted by the backend: the regex allows a zone id only after fe80:.
Clearing the trust depth reports Enter a number of 1 or higher, not Required, and the Required error under the node combo box stays until the next submit.

test cases VERIFIED

Note: to test the first case of point 10 ("Stop one node or its Traefik instance and reload: the rows that answered are still listed, with an error notification above the table), stopping traefik on the target node was not enough, I had to shutdown completely the node.

Released https://github.com/NethServer/ns8-core/releases/tag/3.22.0

Navigation Menu

Repository navigation

Configure Traefik behind frontend HTTP proxy #8098

QA — core 3.22.0-dev.2 — Frontend proxies tab (UI)

1. Preconditions

2. Tabs

3. Routes tab regression

4. Add modal

5. Validation

6. Save

7. Edit

8. Delete

9. Filters

10. Errors — 2 nodes

Known, not a failure

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Configure Traefik behind frontend HTTP proxy #8098

Description

Activity

stephdl commented on Aug 4, 2026

stephdl commented on Aug 28, 2026

QA — core 3.22.0-dev.2 — Frontend proxies tab (UI)

1. Preconditions

2. Tabs

3. Routes tab regression

4. Add modal

5. Validation

6. Save

7. Edit

8. Delete

9. Filters

10. Errors — 2 nodes

Known, not a failure

nrauso commented on Sep 17, 2026

DavidePrincipi commented on Sep 18, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions