nginx: Remove obsolete real_ip configuration

[Turbo87]

The configuration for this nginx module was original added in #1596, in combination with an IP-based limit_req rate limit. The rate limit was lately moved to the application layer (see #6875).

Since we no longer use the limit_req rate limit in the nginx config, it looks like we don't need the real_ip config anymore either.

Note that we should still receive and process the X-Forwarded-For header just like before, it just won't be processed by nginx anymore.

[syphar]

Aren't we also using the X-Real-IP header in the blocking-middleware?

[Turbo87]

yeah, I just realized that while testing this on the staging environment. I've switched it over to reading the X-Forwarded-For header that the nginx config was referring to. Let's hope that this helps...

[Turbo87]

oh, you meant the stuff in BLOCKED_TRAFFIC... yeah... right... that is also using X-Real-IP... 😩

[syphar]

since cloudfront was in set_real_ip_from I assume that heroku is behind CloudFront too, so we could set the header there?

Or block the IPs there?

[Turbo87]

Let's hope that this helps...

it did not... this is more complicated than I had hoped 😅

I assume that heroku is behind CloudFront too, so we could set the header there?

Or block the IPs there?

I just took a quick look, and I couldn't find an option in CloudFront to block IPs on that level. My experience with AWS is limited thought, I'm probably just not looking in the right places :D