Problem with reverse-proxy headers (x-forwarded-for / x-real-ip)

[Knight1]

Hi!

If the X-Forwarded-For Header is set the below error only shows the original IP and Port not the forwarded one in the log. Making it harder to identify the client.

https://github.com/d-Rickyy-b/certstream-server-go/blob/master/internal/web/broadcastmanager.go#L117

2025/09/06 23:11:18 broadcastmanager.go:117: Not providing client '10.2.0.35:45712' with cert because client's buffer is full. The client can't keep up. Skipped certs: 22001

[d-Rickyy-b]

Hi there, sorry for the late reply. There are indeed some issues related to the X-Forwarded-For header. It isn't implemented in the cleanest way. There is a somewhat undocumented feature to use the X-Forwarded-For / X-Real-IP headers. You just need to set the real_ip option for the webserver config.

webserver:
  # For IPv6, set the listen_addr to "::"
  listen_addr: "0.0.0.0"
  listen_port: 8080
  real_ip: true

Sadly, this still leads to some weird behavior with IPs:

2025/09/28 23:52:18 server.go:166: Stopping websocket for '85.216.xxx.xxx' (X-Forwarded-For: '85.216.xxx.xxx') - /
2025/09/28 23:52:18 client.go:128: Disconnecting client 127.0.0.1:59152!

I'll add some documentation for this option and maybe add some other feature around this: A config option for trusted_proxy IPs/CIDR ranges and better logging. Sorry for the inconveniences.

[d-Rickyy-b]

Documentation was updated in the sample config in September already (see 735f6e6).

Still missing:

• Proper logging of the correct IP addresses
• Allowlist for proxies from which we accept the X-Forwarded-For and X-Real-IP Headers
• Documentation in the GitHub Wiki