department-of-veterans-affairs / va.gov-team

Public resources for building on and in support of VA.gov. Visit complete Knowledge Hub:
https://depo-platform-documentation.scrollhelp.site/index.html
281 stars 201 forks source link

Resolve plugin-traefik-real-ip issues. #57872

Open RachalCassity opened 1 year ago

RachalCassity commented 1 year ago

The current Traefik version, used in vets-api, depends on the plugin traefik-real-ip to resolve IP issues. From the plugin readme, This plugin solves this issue by overwriting the X-Real-Ip with an IP from the X-Forwarded-For or Cf-Connecting-Ip (if from Cloudflare) header. The real IP will be the first one that is not included in any of the CIDRs passed as the ExcludedNets parameter. The evaluation of the X-Forwarded-For or Cf-Connecting-Ip (if from Cloudflare) IPs will go from the last to the first one.

This plugin has been throwing this error plugins-local/src/github.com/soulbalz/traefik-real-ip/real_ip.go:55:18: panic. The plugin repo was archived in Dec 2022.

Updating Traefik might resolve this issue.

Tasks

laineymajor commented 1 year ago

Find a new middleware tool that we can adopt

RachalCassity commented 1 year ago

Research this plugin: https://github.com/Paxxs/traefik-get-real-ip

RachalCassity commented 1 year ago

Researched traefik-get-real-ip and there is quite some modifications to make. During high traffic, the traefik-real-ip sends a panic signal. This ticket is being passed to the devops cop.

LindseySaari commented 1 year ago

@ph-One Could you take a look at this as you make adjustments to the scaling buffer please?