cloudflarewarp

README

Real IP from Cloudflare Proxy/Tunnel

If Traefik is behind a Cloudflare Proxy/Tunnel, it won't be able to get the real IP from the external client as well as other information.

This plugin solves this issue by overwriting the X-Real-IP and X-Forwarded-For with an IP from the CF-Connecting-IP header.
The real IP will be the Cf-Connecting-IP if request is come from cloudflare ( truest ip in configuration file).
The plugin also writes the CF-Visitor scheme to the X-Forwarded-Proto. (This fixes an infinite redirect issue for wordpress when using CF[443]->PROXY/TUNNEL->Traefik[80]->WP[80])

Configuration

Configuration documentation

Supported configurations per body

Setting	Allowed values	Required	Description
trustip	[]string	No	IP or IP range to trust
disableDefault	bool	Yes	Disable the built in list of CloudFlare IPs/Servers

Notes re CloudFlare

One thing included in this plugin is we bundle the CloudFlare server IPs with it, so you do not have to define them manually.
However on the flip-side, if you want to, you can just disable them by setting disableDefault to true.

If you do not define trustip and disableDefault, it doesn't seem to load the plugin, so just set disableDefault to false and you are able to use the default IP list.

Enable the plugin

experimental:
  plugins:
    cloudflarewarp:
      modulename: github.com/Amadeus331/cloudflarewarp
      version: v1.3.4

Plugin configuration

http:
  middlewares:
    cloudflarewarp:
      plugin:
        cloudflarewarp:
          disableDefault: false
          trustip: # Trust IPS not required if disableDefault is false - we will allocate Cloud Flare IPs automatically
            - "2400:cb00::/32"

  routers:
    my-router:
      rule: Path(`/whoami`)
      service: service-whoami
      entryPoints:
        - http
      middlewares:
        - cloudflarewarp

  services:
    service-whoami:
      loadBalancer:
        servers:
          - url: http://127.0.0.1:5000

Testing

https://github.com/Amadeus331/cloudflarewarp/tree/master/test

We have written the following tests in this repo:

• golang linting
• yaegi tests (validate configuration matches what Traefik expects)
• General GO code coverage
• Virtual implementation tests (spin up traefik with yml/toml tests to make sure the plugin actually works)
• Live implementation tests (spin up traefik with the plugin definition as it would be for you, and run the same tests again)

These tests allow us to make sure the plugin is always functional with Traefik and Traefik version updates.

Documentation

Overview

Package cloudflarewarp Traefik Plugin.

Index

• func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error)
• type CFVisitorHeader
• type Config
  • func CreateConfig() *Config
• type RealIPOverWriter
  • func (r *RealIPOverWriter) ServeHTTP(rw http.ResponseWriter, req *http.Request)
• type TrustResult

Functions

func New

func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error)

New created a new plugin.

Types

type CFVisitorHeader

type CFVisitorHeader struct {
	Scheme string `json:"scheme"`
}

CFVisitorHeader definition for the header value.

type Config

type Config struct {
	TrustIP             []string `json:"trustip,omitempty"`
	DisableDefaultCFIPs bool     `json:"disableDefault,omitempty"`
}

Config the plugin configuration.

func CreateConfig

func CreateConfig() *Config

CreateConfig creates the default plugin configuration.

type RealIPOverWriter

type RealIPOverWriter struct {
	TrustIP []*net.IPNet
	// contains filtered or unexported fields
}

RealIPOverWriter is a plugin that overwrite true IP.

func (*RealIPOverWriter) ServeHTTP

func (r *RealIPOverWriter) ServeHTTP(rw http.ResponseWriter, req *http.Request)

type TrustResult

type TrustResult struct {
	// contains filtered or unexported fields
}

TrustResult for Trust IP test result.