Fix: adding "APP_TRUSTED_PROXIES" variable

README.md

@@ -126,6 +126,7 @@ linux/s390x
 * `REAL_IP_FROM`: Trusted addresses that are known to send correct replacement addresses (default `0.0.0.0/32`)
 * `REAL_IP_HEADER`: Request header field whose value will be used to replace the client address (default `X-Forwarded-For`)
 * `LOG_IP_VAR`: Use another variable to retrieve the remote IP address for access [log_format](http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format) on Nginx. (default `remote_addr`)
+* `APP_TRUSTED_PROXIES`: IPs or CIDR ranges trusted to set forwarding headers (X-Forwarded-For, X-Forwarded-Proto, etc.). These hosts can spoof any request header, including authentication headers.
 * `SESSION_DRIVER`: [Driver to use for session storage](https://github.com/librenms/librenms/blob/master/config/session.php) (default `file`)
 * `CACHE_DRIVER`: [Driver to use for cache and locks](https://github.com/librenms/librenms/blob/master/config/cache.php) (default `database`)
 

examples/traefik/compose.yml

@@ -33,6 +33,8 @@ services:
     volumes:
       - "./acme.json:/acme.json"
       - "/var/run/docker.sock:/var/run/docker.sock"
+    networks:
+      - librenms_net
     restart: always
 
   db:
@@ -52,20 +54,26 @@ services:
       - "MYSQL_DATABASE=${MYSQL_DATABASE}"
       - "MYSQL_USER=${MYSQL_USER}"
       - "MYSQL_PASSWORD=${MYSQL_PASSWORD}"
+    networks:
+      - librenms_net
     restart: always
 
   redis:
     image: redis:7.2-alpine
     container_name: librenms_redis
     environment:
       - "TZ=${TZ}"
+    networks:
+      - librenms_net
     restart: always
 
   msmtpd:
     image: crazymax/msmtpd:latest
     container_name: librenms_msmtpd
     env_file:
       - "./msmtpd.env"
+    networks:
+      - librenms_net
     restart: always
 
   librenms:
@@ -97,6 +105,9 @@ services:
       - "DB_USER=${MYSQL_USER}"
       - "DB_PASSWORD=${MYSQL_PASSWORD}"
       - "DB_TIMEOUT=60"
+      - "APP_TRUSTED_PROXIES=172.28.0.0/16"
+    networks:
+      - librenms_net
     restart: always
 
   dispatcher:
@@ -121,6 +132,8 @@ services:
       - "DB_TIMEOUT=60"
       - "DISPATCHER_NODE_ID=dispatcher1"
       - "SIDECAR_DISPATCHER=1"
+    networks:
+      - librenms_net
     restart: always
 
   syslogng:
@@ -151,6 +164,8 @@ services:
       - "DB_PASSWORD=${MYSQL_PASSWORD}"
       - "DB_TIMEOUT=60"
       - "SIDECAR_SYSLOGNG=1"
+    networks:
+      - librenms_net
     restart: always
 
   snmptrapd:
@@ -181,4 +196,13 @@ services:
       - "DB_PASSWORD=${MYSQL_PASSWORD}"
       - "DB_TIMEOUT=60"
       - "SIDECAR_SNMPTRAPD=1"
+    networks:
+      - librenms_net
     restart: always
+
+networks:
+  librenms_net:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.28.0.0/16