Update trusted_proxies to match docker.address range #4014
Conversation
Updating `DOCS.md` to reflect that HA/Supervisor uses `172.30.32.0/23` network for docker so `trusted_proxies` should match or it's possible for connections to fail with a error of `Connection refused) while connecting to upstream`. ``` ~# ha net info docker: address: 172.30.32.0/23 dns: 172.30.32.3 gateway: 172.30.32.1 interface: hassio ``` See https://community.home-assistant.io/t/nginx-configuration-connection-refused/62407 and https://github.com/home-assistant/supervisor/blob/7c6c982414794172298b2f29ce2358df062b1c0a/supervisor/const.py#L35 for additional info.
![home-assistant[bot]](https://avatars.githubusercontent.com/in/97978?s=60&v=4){kind=small}
|
Please take a look at the requested changes, and use the Ready for review button when you are done, thanks 👍 |
home-assistant
bot
added
cla-recheck
cla-signed
and removed
cla-recheck
cla-needed
labels
📝 WalkthroughWalkthroughThe documentation for the NGINX Proxy add-on was updated to expand the example Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant HomeAssistantConfig
participant NGINXProxy
User -> HomeAssistantConfig: Edits configuration.yaml
HomeAssistantConfig -> NGINXProxy: Sets trusted_proxies: 172.30.32.0/23
NGINXProxy -> HomeAssistantConfig: Accepts requests from expanded IP range
Tip ⚡️ Faster reviews with caching
Enjoy the performance boost—your workflow just got faster. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
nginx_proxy/DOCS.md (2)
9-9: Use bold for UI strings instead of quotes.Replace the quoted UI string
"INSTALL"with bold formatting:- 3. Click on the "INSTALL" button. + 3. Click on the **INSTALL** button.
7-8: Front the goal in step-by-step instructions.Lead with the action goal before the location. For example:
- 1. Navigate in your Home Assistant frontend to **Settings** -> **Add-ons** -> **Add-on store**. + 1. Open the add-on store in the Home Assistant frontend: **Settings** > **Add-ons**.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
nginx_proxy/DOCS.md(1 hunks)
🧰 Additional context used
📓 Path-based instructions (6)
`*/**(html|markdown|md)`: - For instructional content in documentation, use a direct and authoritative tone. Avoid expressions of politeness such as 'may' or 'please', and ensure t...
*/**(html|markdown|md): - For instructional content in documentation, use a direct and authoritative tone. Avoid expressions of politeness such as 'may' or 'please', and ensure the goal of the instruction is fronted.
- Apply the Microsoft Style Guide to ensure documentation maintains clarity and conciseness.
- In step-by-step instructions, front the location phrase in the instructional sentence.
- In step-by-step instructions, front the 'goal' in the instructional sentence.
- In step-by-step instructions, if in doubt what to front, front the 'goal' before the location phrase in the instructional sentence.
- do not hyphenate terms like 'top-right' or 'bottom-left' with 'corner'
nginx_proxy/DOCS.md
`*/**(html|markdown|md)`: - Use bold to mark UI strings. - If "" are used to mark UI strings, replace them by bold.
*/**(html|markdown|md): - Use bold to mark UI strings.
- If "" are used to mark UI strings, replace them by bold.
nginx_proxy/DOCS.md
`*/**(html|markdown|md)`: - Be brief in your replies and don't add fluff like "thank you for..." and "Please let me know if"
*/**(html|markdown|md): - Be brief in your replies and don't add fluff like "thank you for..." and "Please let me know if"
nginx_proxy/DOCS.md
`*/**(html|markdown|md)`: - Use sentence-style capitalization also in headings.
*/**(html|markdown|md): - Use sentence-style capitalization also in headings.
nginx_proxy/DOCS.md
`*/**(html|markdown|md)`: do not comment on HTML used for icons
*/**(html|markdown|md): do not comment on HTML used for icons
nginx_proxy/DOCS.md
`*/**(html|markdown|md)`: Avoid flagging inline HTML for embedding videos in future reviews for this repository.
*/**(html|markdown|md): Avoid flagging inline HTML for embedding videos in future reviews for this repository.
nginx_proxy/DOCS.md
🔇 Additional comments (1)
nginx_proxy/DOCS.md (1)
21-23: Trusted proxies range updated to encompass Docker network.Changing
trusted_proxiesfrom a single/24to172.30.32.0/23correctly covers both172.30.32.0/24and172.30.33.0/24, matching the Supervisor Docker address.
Well, the proxy runs as an add-on, and gets an IP from the IP assignment pool, which is That said, widen the range doesn't hurt. But it really should not be necessary. Did you actually encounter that issue? What IP did the NGINX proxy add-on have at that time? |
|
Uh, could it be that your clients connect through IPv6? In that case it seems that the proxy sees the hassio host IP 172.30.32.1 (see also this discussion). However, defining 172.30.32.1 as trusted proxy IP is not the right solution here, as this would mean all IPv6 addresses are considered trusted. We need to have a NGINX proxy which can make proper IPv6 sockets such that the source IP is correctly mapped to the connecting IPv6 address. |
Updating
DOCS.mdto reflect that HA/Supervisor uses172.30.32.0/23network for docker sotrusted_proxiesshould match or it's possible for connections to fail with a error ofConnection refused) while connecting to upstream.See https://community.home-assistant.io/t/nginx-configuration-connection-refused/62407 and https://github.com/home-assistant/supervisor/blob/7c6c982414794172298b2f29ce2358df062b1c0a/supervisor/const.py#L35 for additional info.
Summary by CodeRabbit