mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-10-24 06:45:01 +03:00
MHSanaei
d50c419e28
getRemoteIp took a trusted proxy's X-Real-IP first, otherwise the leftmost X-Forwarded-For entry. A proxy that forwards a client-sent X-Real-IP unchanged (Caddy, HAProxy) or appends to X-Forwarded-For leaves both values to the client. X-Forwarded-For is now read from the right, skipping trusted proxies. X-Real-IP is believed only when it agrees with that hop or stands alone, and a disagreement falls back to the proxy's own address. The documented Caddyfile and the docs reverse-proxy generator now overwrite X-Real-IP with the address Caddy saw.
67 lines
2.1 KiB
TypeScript
67 lines
2.1 KiB
TypeScript
// Pure builders for reverse-proxy configs (Nginx / Caddy) and cert commands.
|
|
|
|
export type ProxyServer = 'nginx' | 'caddy';
|
|
export type CertTool = 'certbot' | 'acme.sh';
|
|
|
|
export interface ReverseProxyOptions {
|
|
server: ProxyServer;
|
|
domain: string;
|
|
panelPort: string;
|
|
/** Web base path the panel is served under, e.g. `/panel`. */
|
|
panelPath: string;
|
|
certTool: CertTool;
|
|
}
|
|
|
|
function normalizePath(path: string): string {
|
|
const p = path.trim();
|
|
if (!p) return '/';
|
|
return p.startsWith('/') ? p : `/${p}`;
|
|
}
|
|
|
|
export function buildProxyConfig(o: ReverseProxyOptions): string {
|
|
return o.server === 'nginx' ? buildNginx(o) : buildCaddy(o);
|
|
}
|
|
|
|
function buildNginx(o: ReverseProxyOptions): string {
|
|
const path = normalizePath(o.panelPath);
|
|
const loc = path === '/' ? '/' : `${path.replace(/\/$/, '')}/`;
|
|
return `server {
|
|
listen 443 ssl http2;
|
|
server_name ${o.domain};
|
|
|
|
ssl_certificate /etc/letsencrypt/live/${o.domain}/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/${o.domain}/privkey.pem;
|
|
|
|
location ${loc} {
|
|
proxy_pass http://127.0.0.1:${o.panelPort};
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 3600s;
|
|
proxy_send_timeout 3600s;
|
|
}
|
|
}`;
|
|
}
|
|
|
|
function buildCaddy(o: ReverseProxyOptions): string {
|
|
const path = normalizePath(o.panelPath);
|
|
const matcher = path === '/' ? '' : `${path.replace(/\/$/, '')}/* `;
|
|
// Caddy forwards a client-sent X-Real-IP as is; the panel's login limiter reads it.
|
|
return `${o.domain} {
|
|
reverse_proxy ${matcher}127.0.0.1:${o.panelPort} {
|
|
header_up X-Real-IP {remote_host}
|
|
}
|
|
}`;
|
|
}
|
|
|
|
export function buildCertCommand(o: ReverseProxyOptions): string {
|
|
if (o.certTool === 'certbot') {
|
|
return `certbot certonly --nginx -d ${o.domain}`;
|
|
}
|
|
return `acme.sh --issue -d ${o.domain} --nginx`;
|
|
}
|