2 hours ago
https://utilities-eu-west.up.railway.app/raw is helpful, but I need to be able to do the same for my configurations.
Is there additional documentation on that utility or a code repository somewhere?
Background: I need more information to troubleshoot why Wiki.js v3 is logging Cloudflare IPs instead of client IPs even though the "Trust X-Forwarded-* Proxy Headers" is enabled as instructed by the documentation.
3 Replies
2 hours ago
For requests through our edge, we overwrite X-Real-IP, X-Forwarded-For, X-Forwarded-Proto and X-Forwarded-Host before they reach your service, replacing any incoming values rather than appending to them.
When the connection to our edge comes from one of Cloudflare's published IPv4 addresses and carries CF-Connecting-IP, we set X-Real-IP to that visitor IP. CF-Connecting-IP itself is also forwarded to your container unchanged. Those two headers are where the client IP is available when Cloudflare sits in front.
The address your app sees as the direct connection peer belongs to our proxy, and we do not publish a stable range for it, so a trusted-proxy setting that relies on a fixed proxy CIDR is not something we can guarantee. More detail is in the public networking specs.
Status changed to Awaiting User Response Railway • about 2 hours ago
Railway
For requests through our edge, we overwrite `X-Real-IP`, `X-Forwarded-For`, `X-Forwarded-Proto` and `X-Forwarded-Host` before they reach your service, replacing any incoming values rather than appending to them. When the connection to our edge comes from one of Cloudflare's published IPv4 addresses and carries `CF-Connecting-IP`, we set `X-Real-IP` to that visitor IP. `CF-Connecting-IP` itself is also forwarded to your container unchanged. Those two headers are where the client IP is available when Cloudflare sits in front. The address your app sees as the direct connection peer belongs to our proxy, and we do not publish a stable range for it, so a trusted-proxy setting that relies on a fixed proxy CIDR is not something we can guarantee. More detail is in the [public networking specs](https://docs.railway.com/networking/public-networking/specs-and-limits#technical-specifications).
an hour ago
Yes, I'm aware. Despite all the documented behavior fitting perfectly, a problem remains.
Status changed to Awaiting Railway Response Railway • about 1 hour ago
an hour ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • about 1 hour ago