cluster

commit 5eda7eb9ff26b2a2f05a43e53610d4701820673b
parent 367d7fbc87b9637b5b6ac447000ab46fb05e8757
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Tue, 21 Apr 2026 20:08:06 +0200

fix ip forwarding

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
apps/talos_cluster/mediawiki/apache-vhost.conf
 | 
5
+++++
M
apps/talos_cluster/mediawiki/configmap.yaml
 | 
8
++++++++

2 files changed, 13 insertions(+), 0 deletions(-)
diff --git a/apps/talos_cluster/mediawiki/apache-vhost.conf b/apps/talos_cluster/mediawiki/apache-vhost.conf
@@ -10,6 +10,11 @@
         Require all granted
     </Directory>
 
+    # Pass X-Forwarded-For and X-Forwarded-Proto headers from Envoy to PHP
+    SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
+    RequestHeader set X-Forwarded-For "%{X-Forwarded-For}e" env=forwarded
+    RequestHeader set X-Forwarded-Proto "%{X-Forwarded-Proto}e" env=X-Forwarded-Proto
+
     RewriteEngine On
     RewriteRule ^/?wiki(/.*)?$ %{DOCUMENT_ROOT}/index.php [L]
     RewriteRule ^/?$ %{DOCUMENT_ROOT}/index.php [L]
diff --git a/apps/talos_cluster/mediawiki/configmap.yaml b/apps/talos_cluster/mediawiki/configmap.yaml
@@ -97,9 +97,17 @@ data:
 
     $wgShowExceptionDetails = true;
 
+    # === IP Forwarding from Envoy Gateway ===
     # Trust X-Forwarded-For from Envoy Gateway (pod CIDR and private network)
     $wgUsePrivateIPs = true;
     $wgTrustedProxies = ['10.0.128.0/17', '10.0.96.0/19', 'fd00:10:244::/56', 'fd00:10:96::/112'];
+    
+    # Tell MediaWiki to read client IP from X-Forwarded-For header
+    # (Envoy Gateway adds this header with the real client IP)
+    $wgUseXForwardedFor = true;
+    
+    # Also read protocol from header (HTTP vs HTTPS)
+    $wgHttp['withHttps'] = true;
 
     # === Spam prevention ===
     # Disable public account creation — admins create accounts manually