# Make ModSecurity see the real client address when the WAF sits behind a
# proxy or load balancer that sets X-Forwarded-For.
#
# The official container can configure the realip module through the
# REAL_IP_HEADER / SET_REAL_IP_FROM variables, but it writes those
# directives into the `location` block. NGINX applies location level realip
# settings in the pre-access phase, and the ModSecurity connector has
# already read the connection address by then (it runs in the rewrite
# phase). Declaring the directives at `http` level, as this file does, makes
# NGINX replace the address in the post-read phase, before ModSecurity runs.
#
# These broad ranges are for the lab only: its traffic generator fakes client
# addresses through X-Forwarded-For. Peers in these ranges can spoof client
# addresses, so keep non-loopback BIND_ADDR access on a controlled network
# and restrict it with firewall rules. This trust list is not suitable for
# production; trust only the addresses of load balancers you control.

set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from 100.64.0.0/10;
real_ip_header X-Forwarded-For;
real_ip_recursive on;