Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use X-Forwarded-For in Apache logs #504

Open
LiFiCode opened this issue Nov 18, 2023 · 0 comments
Open

Use X-Forwarded-For in Apache logs #504

LiFiCode opened this issue Nov 18, 2023 · 0 comments

Comments

@LiFiCode
Copy link

LiFiCode commented Nov 18, 2023

The client IP in nominatim-docker / Apache logs is not informative

The Apache logs now only show 172.17.0.1 or whatever docker network the container is attached to.
This only tells you that something made a request...

Describe the solution you'd like

It would be helpful to see the actual IP of the client request.

Solution (as long as the docker image is not updated)

If you like to see actual IP addresses of clients querying nominatim you can do following steps.
Make sure your proxy server sends the right header - in this case X-Forwarded-For...

  1. enter the nominatim docker container
docker exec -ti nominatim /bin/bash
  1. install text editor - in this case nano
apt install nano
  1. enable the apache remoteip mod
a2enmod remoteip
  1. edit the apache config file
nano /etc/apache2/apache2.conf

# change
# LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
# to
# LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

that's %a instead of %h

  1. create the apache mod remoteip config file
nano /etc/apache2/conf-available/remoteip.conf

# add
# RemoteIPHeader X-Forwarded-For
# RemoteIPTrustedProxy 172.17.0.1/32

use whatever header your proxy server sends - here it is X-Forwarded-For
use whatever IP is shown in the logs now - here it is 172.17.0.1

  1. enable the apache mod remoteip by linking the config into /etc/apache2/conf-enabled
ln -s /etc/apache2/conf-available/remoteip.conf /etc/apache2/conf-enabled/remoteip.conf
  1. check apache config for syntax errors
apache2ctl configtest

it should say Syntax OK

  1. restart apache for changes to take effect
service apache2 restart
  1. exit the container
exit

Now your logs should include the real IP from the client making the request.

Thanks to the nominatim people for their great work!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant