search

ergochat / ergo

A modern IRC server (daemon/ircd) written in Go.
https://ergo.chat/
MIT License
2.29k stars 181 forks source link

Get real ip from proxy #2188

Closed aikooo7 closed 2 months ago

aikooo7 commented 3 months ago

I use playit.gg as alternative for port forwarding, but then the ip in ergo is the ip of the docker container of the playit.gg client. Any way I can fix this?

slingamn commented 3 months ago

We support the HAProxy PROXY protocol (both versions) for regular IRC traffic, and we support the X-Forwarded-For header for websockets, but it seems unlikely that playit.gg supports either. I found a support thread about it here:

https://discuss.playit.gg/t/is-there-proxy-protocol-or-other-ip-forwarding-method-for-bungeecord/1260/4

If the playit.gg client were open-source it would probably be pretty easy to add PROXY v2 support, but it looks like it's proprietary.

aikooo7 commented 3 months ago

We support the HAProxy PROXY protocol (both versions) for regular IRC traffic, and we support the X-Forwarded-For header for websockets, but it seems unlikely that playit.gg supports either. I found a support thread about it here:

https://discuss.playit.gg/t/is-there-proxy-protocol-or-other-ip-forwarding-method-for-bungeecord/1260/4

If the playit.gg client were open-source it would probably be pretty easy to add PROXY v2 support, but it looks like it's proprietary.

The agent is open source: https://github.com/playit-cloud/playit-agent

Do you have any other alternative to playit.gg for this purpose?

slingamn commented 2 months ago

Nice, I'll take a look (it could be interesting to write some Rust).

What's your primary reason for using Playit --- hiding your home IP? Or you can't forward ports to your home IP (CGNAT, ISP restrictions)?

aikooo7 commented 2 months ago

Nice, I'll take a look (it could be interesting to write some Rust).

What's your primary reason for using Playit --- hiding your home IP? Or you can't forward ports to your home IP (CGNAT, ISP restrictions)?

I am using playit because I can't port forward. I use my phone as my homelab so it walks with me including in mobile data, which doesn't support port forward. I searched a lot and the unique tunnel service that supports the PROXY protocol is ngrok but only on the interprise plan.

slingamn commented 2 months ago

Note to self: other playit.gg users are interested in the PROXY protocol for use with https://github.com/SpigotMC/BungeeCord, which seems to support both versions of the protocol via netty:

https://github.com/xSke/CoreServer/blob/d3655412008da22b58f031f4e7f08a6f6940bf46/src/io/netty/handler/codec/haproxy/HAProxyMessageDecoder.java

aikooo7 commented 2 months ago

Note to self: other playit.gg users are interested in the PROXY protocol for use with https://github.com/SpigotMC/BungeeCord, which seems to support both versions of the protocol via netty:

https://github.com/xSke/CoreServer/blob/d3655412008da22b58f031f4e7f08a6f6940bf46/src/io/netty/handler/codec/haproxy/HAProxyMessageDecoder.java

Can you link "the other users" work?

slingamn commented 2 months ago

No work, just a discussion thread: https://discuss.playit.gg/t/is-there-proxy-protocol-or-other-ip-forwarding-method-for-bungeecord/1260/4

slingamn commented 2 months ago

https://github.com/playit-cloud/playit-agent/issues/93 looks promising! I'm going to close this, and you can follow future developments there.

When playit.gg gets PROXY support, my recommendation would be to enable it and then use IRC-over-TLS in Ergo with this flag set to true:

https://github.com/ergochat/ergo/blob/796bc198edc809764da18056ea9eefbfa43fefa2/default.yaml#L57-L60

The certificate won't be verifiable but you can potentially instruct users to pin it.

aikooo7 commented 2 weeks ago

I can confirm this is implemented at playit.gg side and working