From ecb27521b411339d7cf9e9652d37b3e8174ed26c Mon Sep 17 00:00:00 2001
From: Stefano Badoino <16034687+SBado@users.noreply.github.com>
Date: Wed, 23 Feb 2022 11:32:39 +0100
Subject: [PATCH 01/13] PROXY Protocol support implementation
---
backend/internal/nginx.js | 3 +-
.../20220209144645_proxy_protocol.js | 36 +++++++++++++++++++
backend/schema/endpoints/proxy-hosts.json | 28 +++++++++++++++
backend/templates/_listen.conf | 20 ++++++++---
backend/templates/_proxy_protocol.conf | 6 ++++
backend/templates/proxy_host.conf | 1 +
frontend/js/app/nginx/proxy/form.ejs | 17 ++++++++-
frontend/js/app/nginx/proxy/form.js | 14 +++++++-
frontend/js/i18n/messages.json | 4 ++-
frontend/js/models/proxy-host.js | 2 ++
10 files changed, 122 insertions(+), 9 deletions(-)
create mode 100644 backend/migrations/20220209144645_proxy_protocol.js
create mode 100644 backend/templates/_proxy_protocol.conf
diff --git a/backend/internal/nginx.js b/backend/internal/nginx.js
index 52bdd66dcc..0291dfda6d 100644
--- a/backend/internal/nginx.js
+++ b/backend/internal/nginx.js
@@ -157,7 +157,8 @@ const internalNginx = {
for (let i = 0; i < host.locations.length; i++) {
let locationCopy = Object.assign({}, {access_list_id: host.access_list_id}, {certificate_id: host.certificate_id},
{ssl_forced: host.ssl_forced}, {caching_enabled: host.caching_enabled}, {block_exploits: host.block_exploits},
- {allow_websocket_upgrade: host.allow_websocket_upgrade}, {http2_support: host.http2_support},
+ {allow_websocket_upgrade: host.allow_websocket_upgrade}, {enable_proxy_protocol: host.enable_proxy_protocol},
+ {load_balancer_ip: host.load_balancer_ip}, {http2_support: host.http2_support},
{hsts_enabled: host.hsts_enabled}, {hsts_subdomains: host.hsts_subdomains}, {access_list: host.access_list},
{certificate: host.certificate}, host.locations[i]);
diff --git a/backend/migrations/20220209144645_proxy_protocol.js b/backend/migrations/20220209144645_proxy_protocol.js
new file mode 100644
index 0000000000..8c80991288
--- /dev/null
+++ b/backend/migrations/20220209144645_proxy_protocol.js
@@ -0,0 +1,36 @@
+const migrate_name = 'proxy_protocol';
+const logger = require('../logger').migrate;
+
+/**
+ * Migrate
+ *
+ * @see http://knexjs.org/#Schema
+ *
+ * @param {Object} knex
+ * @param {Promise} Promise
+ * @returns {Promise}
+ */
+exports.up = function (knex/*, Promise*/) {
+ logger.info('[' + migrate_name + '] Migrating Up...');
+
+ return knex.schema.table('proxy_host', function (proxy_host) {
+ proxy_host.integer('enable_proxy_protocol').notNull().unsigned().defaultTo(0);
+ proxy_host.string('load_balancer_ip').notNull().defaultTo('');
+ })
+ .then(() => {
+ logger.info('[' + migrate_name + '] proxy_host Table altered');
+ });
+
+};
+
+/**
+ * Undo Migrate
+ *
+ * @param {Object} knex
+ * @param {Promise} Promise
+ * @returns {Promise}
+ */
+exports.down = function (knex, Promise) {
+ logger.warn('[' + migrate_name + '] You can\'t migrate down this one.');
+ return Promise.resolve(true);
+};
\ No newline at end of file
diff --git a/backend/schema/endpoints/proxy-hosts.json b/backend/schema/endpoints/proxy-hosts.json
index 9a3fff2fc7..27a8ec2ab0 100644
--- a/backend/schema/endpoints/proxy-hosts.json
+++ b/backend/schema/endpoints/proxy-hosts.json
@@ -58,6 +58,16 @@
"example": true,
"type": "boolean"
},
+ "enable_proxy_protocol": {
+ "description": "Enable PROXY Protocol support",
+ "example": true,
+ "type": "boolean"
+ },
+ "load_balancer_ip": {
+ "type": "string",
+ "minLength": 0,
+ "maxLength": 255
+ },
"access_list_id": {
"$ref": "../definitions.json#/definitions/access_list_id"
},
@@ -155,6 +165,12 @@
"allow_websocket_upgrade": {
"$ref": "#/definitions/allow_websocket_upgrade"
},
+ "enable_proxy_protocol": {
+ "$ref": "#/definitions/enable_proxy_protocol"
+ },
+ "load_balancer_ip": {
+ "$ref": "#/definitions/load_balancer_ip"
+ },
"access_list_id": {
"$ref": "#/definitions/access_list_id"
},
@@ -245,6 +261,12 @@
"allow_websocket_upgrade": {
"$ref": "#/definitions/allow_websocket_upgrade"
},
+ "enable_proxy_protocol": {
+ "$ref": "#/definitions/enable_proxy_protocol"
+ },
+ "load_balancer_ip": {
+ "$ref": "#/definitions/load_balancer_ip"
+ },
"access_list_id": {
"$ref": "#/definitions/access_list_id"
},
@@ -318,6 +340,12 @@
"allow_websocket_upgrade": {
"$ref": "#/definitions/allow_websocket_upgrade"
},
+ "enable_proxy_protocol": {
+ "$ref": "#/definitions/enable_proxy_protocol"
+ },
+ "load_balancer_ip": {
+ "$ref": "#/definitions/load_balancer_ip"
+ },
"access_list_id": {
"$ref": "#/definitions/access_list_id"
},
diff --git a/backend/templates/_listen.conf b/backend/templates/_listen.conf
index 730f3a7c4d..15f0c86592 100644
--- a/backend/templates/_listen.conf
+++ b/backend/templates/_listen.conf
@@ -1,15 +1,25 @@
+{% if enable_proxy_protocol == 1 or enable_proxy_protocol == true%}
+ listen 88 proxy_protocol;
+{% if ipv6 -%}
+ listen [::]:88 proxy_protocol;
+{% endif %}
+{% else -%}
listen 80;
{% if ipv6 -%}
listen [::]:80;
-{% else -%}
- #listen [::]:80;
+{% endif %}
{% endif %}
{% if certificate -%}
+{% if enable_proxy_protocol == 1 or enable_proxy_protocol == true%}
+ listen 444 ssl{% if http2_support %} http2{% endif %} proxy_protocol;
+{% if ipv6 -%}
+ listen [::]:444 ssl{% if http2_support %} http2{% endif %} proxy_protocol;
+{% endif %}
+{% else -%}
listen 443 ssl{% if http2_support %} http2{% endif %};
{% if ipv6 -%}
listen [::]:443 ssl{% if http2_support %} http2{% endif %};
-{% else -%}
- #listen [::]:443;
{% endif %}
{% endif %}
- server_name {{ domain_names | join: " " }};
+{% endif %}
+ server_name {{ domain_names | join: " " }};
\ No newline at end of file
diff --git a/backend/templates/_proxy_protocol.conf b/backend/templates/_proxy_protocol.conf
new file mode 100644
index 0000000000..fa81494b72
--- /dev/null
+++ b/backend/templates/_proxy_protocol.conf
@@ -0,0 +1,6 @@
+{% if enable_proxy_protocol == 1 or enable_proxy_protocol == true %}
+{% if load_balancer_ip != '' %}
+ set_real_ip_from {{ load_balancer_ip }};
+ real_ip_header proxy_protocol;
+{% endif %}
+{% endif %}
\ No newline at end of file
diff --git a/backend/templates/proxy_host.conf b/backend/templates/proxy_host.conf
index ec30cca0da..d733c853a1 100644
--- a/backend/templates/proxy_host.conf
+++ b/backend/templates/proxy_host.conf
@@ -12,6 +12,7 @@ server {
{% include "_exploits.conf" %}
{% include "_hsts.conf" %}
{% include "_forced_ssl.conf" %}
+{% include "_proxy_protocol.conf" %}
{% if allow_websocket_upgrade == 1 or allow_websocket_upgrade == true %}
proxy_set_header Upgrade $http_upgrade;
diff --git a/frontend/js/app/nginx/proxy/form.ejs b/frontend/js/app/nginx/proxy/form.ejs
index 56868f5528..9c30f13c49 100644
--- a/frontend/js/app/nginx/proxy/form.ejs
+++ b/frontend/js/app/nginx/proxy/form.ejs
@@ -72,7 +72,7 @@
-
+
+
+
@@ -360,7 +360,7 @@ const ProxyHostModal = EasyModal.create(({ id, visible, remove }: Props) => {
Date: Fri, 24 Apr 2026 04:34:00 -0700
Subject: [PATCH 09/13] Fill out missing schema
---
backend/schema/components/proxy-host-object.json | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/backend/schema/components/proxy-host-object.json b/backend/schema/components/proxy-host-object.json
index 2b281e20fa..61e943a4f6 100644
--- a/backend/schema/components/proxy-host-object.json
+++ b/backend/schema/components/proxy-host-object.json
@@ -92,9 +92,11 @@
"type": "boolean"
},
"load_balancer_ip": {
+ "description": "Load balancer or TCP proxy IP / CIDR range",
"type": "string",
"minLength": 0,
- "maxLength": 255
+ "maxLength": 255,
+ "example": "10.0.9.3"
},
"http2_support": {
"$ref": "../common.json#/properties/http2_support"
From 49bb74366cf8658b982288f518da6cc8c8136f2e Mon Sep 17 00:00:00 2001
From: Julia V Rose
Date: Fri, 24 Apr 2026 04:34:10 -0700
Subject: [PATCH 10/13] Add PROXY protocol ports
---
docker/docker-compose.dev.yml | 2 ++
scripts/start-dev | 11 ++++++++---
2 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/docker/docker-compose.dev.yml b/docker/docker-compose.dev.yml
index 4d519f8acd..8c316ac513 100644
--- a/docker/docker-compose.dev.yml
+++ b/docker/docker-compose.dev.yml
@@ -9,7 +9,9 @@ services:
ports:
- 3080:80
- 3081:81
+ - 3088:88
- 3443:443
+ - 3444:444
networks:
nginx_proxy_manager:
aliases:
diff --git a/scripts/start-dev b/scripts/start-dev
index c561ac9adf..0652bddc1f 100755
--- a/scripts/start-dev
+++ b/scripts/start-dev
@@ -45,9 +45,14 @@ if hash docker 2>/dev/null; then
bash "$DIR/wait-healthy" "$(docker compose ps --all -q fullstack)" 120
echo ""
- echo -e "${CYAN}Admin UI: http://127.0.0.1:3081${RESET}"
- echo -e "${CYAN}Nginx: http://127.0.0.1:3080${RESET}"
- echo -e "${CYAN}Swagger Doc: http://127.0.0.1:3001${RESET}"
+ echo -e "${CYAN}Admin UI: http://127.0.0.1:3081${RESET}"
+ echo -e "${CYAN}Nginx (HTTP): http://127.0.0.1:3080${RESET}"
+ echo -e "${CYAN}Nginx (HTTPS): http://127.0.0.1:3443${RESET}"
+ echo -e "${CYAN}Swagger Doc: http://127.0.0.1:3001${RESET}"
+ echo -e
+ echo -e "${CYAN}PROXY protocol:${RESET}"
+ echo -e "${CYAN}Nginx (HTTP): http://127.0.0.1:3088${RESET}"
+ echo -e "${CYAN}Nginx (HTTPS): http://127.0.0.1:3444${RESET}"
echo ""
if [ "$1" == "-f" ]; then
From d9990df2ae3d637f9a4850bbedb25a552ab424a2 Mon Sep 17 00:00:00 2001
From: Julia V Rose
Date: Fri, 24 Apr 2026 05:06:14 -0700
Subject: [PATCH 11/13] conditionally require and disable the load balancer ip
---
frontend/src/modals/ProxyHostModal.tsx | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/frontend/src/modals/ProxyHostModal.tsx b/frontend/src/modals/ProxyHostModal.tsx
index 2c77dad1f1..f110c737e5 100644
--- a/frontend/src/modals/ProxyHostModal.tsx
+++ b/frontend/src/modals/ProxyHostModal.tsx
@@ -355,7 +355,7 @@ const ProxyHostModal = EasyModal.create(({ id, visible, remove }: Props) => {
-
+
{({ field, form }: any) => (