Repository navigation
How to get real IP in logs instead of bridge IP? #237
Description
When installed in docker and behind some reverse proxy like nginx, container logs does not show real client IP address even if passing right headers from proxy.
server {
listen [::]:443 ssl http2;
listen 443 ssl http2;
server_name {{ service_domains.passbolt.primary.fqdn }};
ssl_certificate /etc/ssl/private/{{ service_domains.passbolt.primary.domain }}/fullchain.pem;
ssl_certificate_key /etc/ssl/private/{{ service_domains.passbolt.primary.domain }}/private.key;
location / {
proxy_intercept_errors on;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_redirect off;
proxy_buffering off;
proxy_pass http://localhost:8000/;
}
}docker logs --tail 10 passbolt
172.17.0.1 - - [12/Apr/2025:16:10:57 +0000] "GET /auth/is-authenticated.json HTTP/1.0" 401 255 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
2025-04-12 16:10:57,476 INFO reaped unknown pid 397 (exit status 0)
2025-04-12 16:10:57,477 INFO reaped unknown pid 399 (exit status 0)
172.17.0.1 - - [12/Apr/2025:16:11:43 +0000] "GET /auth/is-authenticated.json HTTP/1.0" 401 255 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:137.0) Gecko/20100101 Firefox/137.0"
2025-04-12 16:11:43,816 INFO reaped unknown pid 420 (exit status 0)
2025-04-12 16:11:43,816 INFO reaped unknown pid 422 (exit status 0)
172.17.0.1 - - [12/Apr/2025:16:11:56 +0000] "GET /auth/is-authenticated.json HTTP/1.0" 401 255 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
so, I want to see real client IPs in logs, not bridge IPs.
Activity
[-]How to get real IP in logs instead of bridge.[/-][+]How to get real IP in logs instead of bridge IP?[/+]dlen commentedon Apr 12, 2025
Hi, Have you tried to set PASSBOLT_SECURITY_PROXIES_ACTIVE env var? https://github.com/passbolt/passbolt_api/blob/master/config/default.php#L363
vshuraeff commentedon Apr 12, 2025
ty for info. I've set env
PASSBOLT_SECURITY_PROXIES_ACTIVE=1but it's won't work. Still bridge IP logged.passbolt.phpI should use to define proxies with'trustedProxies'setting?May be I should map
passbolt.default.phpto container aspassbolt.phpand set this settings there?mannp commentedon Aug 13, 2025
I am having the same issue and recall having to mount my own passbolt.php when passbolt first started.
I was hoping something like this would be available, but it isn't,
PASSBOLT_SECURITY_PROXIES_TRUSTED_PROXIES = [ "127.0.0.1","etc" ]Is there a way of directly changing these proxies from env variables @dlen
Thanks in advance :)
dlen commentedon Aug 13, 2025
Hey @mannp, long time no see!
At the moment we don't support such configuration through env vars. I'll forward your request to the backend team so they can provide a path to configure the trusted proxies through an env var.
Thanks for the feedback!
mannp commentedon Aug 13, 2025
Hi @dlen it's been a while for sure :)
Congrats to you and the team on the progress :)
I am not sure what PASSBOLT_SECURITY_PROXIES_ACTIVE does really, as trusted proxies is empty by default
'trustedProxies' => [],so if you cannot set that, it's not doing anything.dlen commentedon Dec 18, 2025
Hi,
I completely forgot to update this thread but as part of passbolt 5.6.0 users should now be able to define the trusted proxies array using an environment variable. Let us know if this fixes this issue.
Xeudoron commentedon Dec 18, 2025
Hi,
using
image: passbolt/passbolt:5.7.2-1-ceI addedin .env for my compose.yaml and after a restart I still see
but also a new log appears
I wasn't able to find any info on this in docs or elsewhere other than what's in 5.6.0