infrastructure/roles/nginx/templates/proxy-settings.conf.j2

# Here we define which hosts we expect to receive proxied traffic from.
# If we receive traffic from one of these, we'll trust their real client IP as set by the PROXY protocol.
# Without this, we'd end up rate limiting our upstream proxies.
# See also https://nginx.org/en/docs/http/ngx_http_realip_module.html

{% if nginx_proxy_protocol_upstream_host or nginx_proxy_vendor %}
real_ip_header proxy_protocol;
{% endif %}

{% if nginx_proxy_protocol_upstream_host %}
set_real_ip_from {{ nginx_proxy_protocol_upstream_host }};
{% endif %}

{% if nginx_proxy_vendor %}
{% for proxy_ip_addr in vault_proxy_vendor_trusted_ips[nginx_proxy_vendor] %}
set_real_ip_from {{ proxy_ip_addr }};
{% endfor %}
{% endif %}