Configure environment behind proxy

Reverse proxy overview

When the primary server or gateway is placed behind a reverse proxy (for example a load balancer in front of the server), requests reach the server from the proxy's IP address, not from the real client. The proxy communicates the real client IP via the X-Forwarded-For header.

The server only honors X-Forwarded-For (and other X-Forwarded-* headers) when the request's direct peer is an explicitly trusted reverse proxy. Without this configured, the server treats the proxy's IP as the client IP everywhere it matters — most notably the Allowed IPs check on API access keys , which will then not match against the real client address.

Prerequisites

Before configuring, make sure you know:

• The IP address (or address range) from which the reverse proxy connects to the primary server/gateway — i.e. its direct connection to the server, not its own public-facing IP.

• That the reverse proxy is actually configured to set the X-Forwarded-For header with the real client IP.

• Access to the server's configuration file, /opt/safeqcloud/conf/application.conf.

Configuration

1. Open /opt/safeqcloud/conf/application.conf in an editor.

2. Under the web section, set trusted-proxy-cidrs to the CIDR range(s) of your reverse proxy:

   web {
     ...
     trusted-proxy-cidrs = ["10.0.0.0/16"]
     ...
   }
   

• trusted-proxy-cidrs – list of CIDR ranges allowed to set X-Forwarded-* headers, e.g. ["10.0.0.0/16", "192.168.1.0/24"]. Default is ["0.0.0.0/0", "::/0"] — every peer is trusted, so X-Forwarded-* headers are honored by default.

3. Save the file and restart the server: systemctl restart safeq-cloud-server.