{"id":44009561,"url":"https://github.com/zekihan/traefik-real-ip","last_synced_at":"2026-02-07T14:12:56.530Z","repository":{"id":285494098,"uuid":"958326568","full_name":"zekihan/traefik-real-ip","owner":"zekihan","description":"traefik-real-ip","archived":false,"fork":false,"pushed_at":"2026-02-04T16:35:36.000Z","size":228,"stargazers_count":10,"open_issues_count":2,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-02-05T03:58:38.087Z","etag":null,"topics":["traefik-plugin"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zekihan.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-04-01T02:36:49.000Z","updated_at":"2026-02-04T16:41:01.000Z","dependencies_parsed_at":null,"dependency_job_id":"d7a41986-d981-45b2-b2b3-856d8821c9f4","html_url":"https://github.com/zekihan/traefik-real-ip","commit_stats":null,"previous_names":["zekihan/traefik-real-ip"],"tags_count":20,"template":false,"template_full_name":null,"purl":"pkg:github/zekihan/traefik-real-ip","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zekihan%2Ftraefik-real-ip","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zekihan%2Ftraefik-real-ip/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zekihan%2Ftraefik-real-ip/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zekihan%2Ftraefik-real-ip/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zekihan","download_url":"https://codeload.github.com/zekihan/traefik-real-ip/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zekihan%2Ftraefik-real-ip/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29196854,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-07T12:38:28.597Z","status":"ssl_error","status_checked_at":"2026-02-07T12:38:23.888Z","response_time":63,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["traefik-plugin"],"created_at":"2026-02-07T14:12:54.223Z","updated_at":"2026-02-07T14:12:56.521Z","avatar_url":"https://github.com/zekihan.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Traefik Real IP\n\nA Traefik middleware plugin that extracts the real client IP address from various HTTP headers.\n\n[![Traefik Plugin](https://img.shields.io/badge/Traefik%20Plugin-Traefik%20Real%20IP-blue)](https://plugins.traefik.io/plugins/67eb72e756c7ea30f22dd6be/traefik-real-ip)\n[![Version](https://img.shields.io/badge/version-0.1.20-green)](https://github.com/zekihan/traefik-real-ip/releases/tag/v0.1.20)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/zekihan/traefik-real-ip/blob/main/LICENSE)\n\n## Overview\n\nTraefik Real IP extracts and validates the actual client IP address from commonly used headers such as `X-Forwarded-For`, `X-Real-IP`, and `Cf-Connecting-Ip`. This plugin is particularly useful when Traefik is behind a CDN, proxy, or load balancer like Cloudflare.\n\n## Features\n\n- Extracts real IP from `Cf-Connecting-Ip`, `Eo-Connecting-Ip`, `X-Real-IP`, and `X-Forwarded-For` headers\n- Validates whether the source IP is trusted before accepting header values\n- Built-in support for Cloudflare IP ranges\n- Optional support for EdgeOne IP ranges\n- Supports local/private IP ranges\n- Custom trusted IP configuration\n- Configurable logging level\n\n## Installation\n\n### From Traefik Pilot\n\nThe easiest way to install this plugin is through the [Traefik Plugin Catalog](https://plugins.traefik.io/plugins/67eb72e756c7ea30f22dd6be/traefik-real-ip).\n\n### Manual Installation\n\nAdd the plugin to your Traefik static configuration:\n\n```yaml\nexperimental:\n  plugins:\n    traefik-real-ip:\n      moduleName: github.com/zekihan/traefik-real-ip\n      version: v0.1.20\n```\n\n## Configuration\n\n### Static Configuration Example\n\n```yaml\n# Static configuration\nexperimental:\n  plugins:\n    traefik-real-ip:\n      moduleName: github.com/zekihan/traefik-real-ip\n      version: v0.1.20\n```\n\n### Middleware Configuration\n\n```yaml\n# Dynamic configuration\nhttp:\n  middlewares:\n    traefik-real-ip:\n      plugin:\n        traefik-real-ip:\n          thrustLocal: true\n          thrustCloudFlare: true\n          thrustEdgeOne: false\n          trustedIPs: \n            - \"1.2.3.4/32\"\n            - \"10.0.0.0/8\"\n          logLevel: info\n          denyUntrusted: false\n```\n\n### Configuration Options\n\n| Option             | Type             | Default | Description                                         |\n|--------------------|------------------|---------|-----------------------------------------------------|\n| `thrustLocal`      | boolean          | `true`  | Trust local and private IP ranges                   |\n| `thrustCloudFlare` | boolean          | `true`  | Trust Cloudflare IP ranges                          |\n| `thrustEdgeOne`    | boolean          | `false` | Trust EdgeOne IP ranges                             |\n| `trustedIPs`       | array of strings | `[]`    | Additional IP ranges to trust in CIDR notation      |\n| `logLevel`         | string           | `info`  | Log level (debug, info, warn, error)                |\n| `denyUntrusted`    | boolean          | `false` | Deny requests from untrusted IPs with 403 Forbidden |\n\n## How It Works\n\n1. The plugin extracts the source IP from the incoming request\n2. It checks if the source IP is in the trusted IPs list\n3. If `denyUntrusted` is enabled and the source IP is not trusted, it returns a 403 Forbidden response\n4. If trusted, it looks for real IP in headers in this order: `Cf-Connecting-Ip`, `Eo-Connecting-Ip`, `X-Real-IP`, then `X-Forwarded-For`.\n5. It updates the request headers with the discovered real IP\n6. Adds an `X-Is-Trusted: yes|no` header indicating if the source was trusted\n\n## Protecting Against Direct Access\n\nIf your server has a public IP but uses a WAF/CDN like Cloudflare, you may want to ensure that traffic can only reach your server through the WAF/CDN. Enable the `denyUntrusted` option to reject any traffic that doesn't come from trusted IP ranges (such as Cloudflare IPs).\n\n```yaml\nhttp:\n  middlewares:\n    traefik-real-ip:\n      plugin:\n        traefik-real-ip:\n          thrustCloudFlare: true\n          denyUntrusted: true\n```\n\nWith this configuration, requests that bypass Cloudflare and reach your server directly will receive a `403 Forbidden` response.\n\n## Development\n\n### Testing Locally\n\nA Docker Compose setup is provided in the `testing` folder to test the plugin locally:\n\n```bash\ncd testing\ndocker-compose up -d\n```\n\n### Running Tests\n\n```bash\ngo test ./...\n```\n\n## License\n\nThis project is licensed under the MIT License - see the [LICENSE](https://github.com/zekihan/traefik-real-ip/blob/main/LICENSE) file for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzekihan%2Ftraefik-real-ip","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fzekihan%2Ftraefik-real-ip","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzekihan%2Ftraefik-real-ip/lists"}