Merge pull request #61 from Progmasoft/security/cloudflare-real-ipHEADmain

Rate-limit sign-in by visitor behind Cloudflare and stop forwarding h2c

2 files changed, 62 insertions, 12 deletions

diff --git a/ops/nginx/cloudflare-real-ip.conf b/ops/nginx/cloudflare-real-ip.conf
new file mode 100644
index 0000000..2162842
--- /dev/null
+++ b/ops/nginx/cloudflare-real-ip.conf
@@ -0,0 +1,37 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+# Installed as /etc/nginx/conf.d/00-cloudflare-real-ip.conf on the first server.
+#
+# Cloudflare proxies the Progmasoft, Tala and Tazel hosts, so the peer of
+# Nginx is a Cloudflare edge, and each request may come from another edge.
+# Without this file the address the API rate-limits by is that edge: the
+# sign-in limit then never fills for one visitor and is shared by unrelated
+# ones. A connection from a Cloudflare range takes the visitor from
+# CF-Connecting-IP; any other peer keeps its own address, so the header cannot
+# be forged by a direct connection to the server. The ranges are those of
+# https://www.cloudflare.com/ips/ (checked 2026-11-09).
+
+set_real_ip_from 173.245.48.0/20;
+set_real_ip_from 103.21.244.0/22;
+set_real_ip_from 103.22.200.0/22;
+set_real_ip_from 103.31.4.0/22;
+set_real_ip_from 141.101.64.0/18;
+set_real_ip_from 108.162.192.0/18;
+set_real_ip_from 190.93.240.0/20;
+set_real_ip_from 188.114.96.0/20;
+set_real_ip_from 197.234.240.0/22;
+set_real_ip_from 198.41.128.0/17;
+set_real_ip_from 162.158.0.0/15;
+set_real_ip_from 104.16.0.0/13;
+set_real_ip_from 104.24.0.0/14;
+set_real_ip_from 172.64.0.0/13;
+set_real_ip_from 131.0.72.0/22;
+set_real_ip_from 2400:cb00::/32;
+set_real_ip_from 2606:4700::/32;
+set_real_ip_from 2803:f800::/32;
+set_real_ip_from 2405:b500::/32;
+set_real_ip_from 2405:8100::/32;
+set_real_ip_from 2a06:98c0::/29;
+set_real_ip_from 2c0f:f248::/32;
+real_ip_header CF-Connecting-IP;
diff --git a/ops/nginx/progmaweb.conf b/ops/nginx/progmaweb.conf
index f5bdddc..f752b80 100644
--- a/ops/nginx/progmaweb.conf
+++ b/ops/nginx/progmaweb.conf
@@ -1,6 +1,19 @@
 # SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
 # SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
 
+# Only a WebSocket upgrade reaches the applications. Forwarding any Upgrade
+# header with "Connection: upgrade" on every request would let a client ask an
+# upstream for another protocol (h2c) behind Nginx.
+map $http_upgrade $progmaweb_upgrade {
+    default   "";
+    ~*^websocket$ websocket;
+}
+
+map $progmaweb_upgrade $progmaweb_connection {
+    default   "";
+    websocket upgrade;
+}
+
 server {
     listen 80;
     listen [::]:80;
@@ -87,8 +100,8 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
+        proxy_set_header Upgrade $progmaweb_upgrade;
+        proxy_set_header Connection $progmaweb_connection;
         proxy_read_timeout 60s;
     }
 }
@@ -122,8 +135,8 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
+        proxy_set_header Upgrade $progmaweb_upgrade;
+        proxy_set_header Connection $progmaweb_connection;
         proxy_read_timeout 60s;
     }
 }
@@ -206,8 +219,8 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
+        proxy_set_header Upgrade $progmaweb_upgrade;
+        proxy_set_header Connection $progmaweb_connection;
         proxy_read_timeout 60s;
     }
 }
@@ -271,8 +284,8 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
+        proxy_set_header Upgrade $progmaweb_upgrade;
+        proxy_set_header Connection $progmaweb_connection;
         proxy_read_timeout 60s;
     }
 }
@@ -337,8 +350,8 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
+        proxy_set_header Upgrade $progmaweb_upgrade;
+        proxy_set_header Connection $progmaweb_connection;
         proxy_read_timeout 60s;
     }
 }
@@ -399,8 +412,8 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
+        proxy_set_header Upgrade $progmaweb_upgrade;
+        proxy_set_header Connection $progmaweb_connection;
         proxy_read_timeout 60s;
     }
 }