fedserv/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

proxy: HAProxy PROXY protocol v1+v2 on the plaintext (reactor) and TLS listeners; trusted via proxy=<glob>, rewrites the client IP before connect checks

Browse source
This commit is contained in:
Jean Chevronnet 2026-08-11 11:43:08 +00:00
parent d68f3ce97e
commit 87a683dbd2
5 changed files with 361 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

7
echoircd.conf.example
View file

@ -136,6 +136,13 @@ amu_target = both
# syslog_facility = daemon # kern user mail daemon auth ... local0..local7
# syslog_tag = echoircd
# --- PROXY protocol: trust the HAProxy/nginx PROXY header (v1 or v2) from these
# source IPs (glob, repeatable), so the real client IP is used instead of the
# proxy's. A connection from a trusted proxy MUST lead with a PROXY header.
# Applies to the plaintext and TLS client listeners (WebSocket uses XFF instead).
# proxy = 127.0.0.1
# proxy = 10.0.0.*
# --- security groups: securitygroup = <name> [criteria...]
# criteria: public tls insecure account unregistered oper exclude-oper
# bot exclude-bot webirc exclude-webirc mask=<glob> exclude=<glob>