traefik: add cloudflare ips as trusted for forwarded headers

2025-03-25 20:47:04 -07:00
parent 963ba3d785
commit cafdc07631
2 changed files with 24 additions and 14 deletions
--- a/roles/alpina/templates/services/traefik/traefik.yml.j2
+++ b/roles/alpina/templates/services/traefik/traefik.yml.j2
@@ -12,6 +12,16 @@ entryPoints:
    address: ":443"
    http3:
      advertisedPort: 443
+    forwardedHeaders:
+      trustedIPs:
+        # https://www.cloudflare.com/ips-v6
+        - 2400:cb00::/32
+        - 2606:4700::/32
+        - 2803:f800::/32
+        - 2405:b500::/32
+        - 2405:8100::/32
+        - 2a06:98c0::/29
+        - 2c0f:f248::/32
  metrics:
    address: ":8082"