Notices by Dash 🇸🇬 (dashrandom@kopiti.am), page 4

tl;dr: Don't use Traefik unless you know exactly what the hell it does. Addtionally, don't use Traefik in a docker container unless you are intimately familiar with networking.

Afterthought: idk how the hell the average web developer who just builds apps is going to figure this out. This requires some understanding about networking + containerization tech. Just looking at the number of posts on the Traefik forums asking the same question is quite telling.

职业病 of tech professionals everywhere - throwing a tech solution at every problem. I am sadly also guilty sometimes.

Next, by allowing all forwarded headers into our Traefik entrypoints to be forwarded to the containers by modifying the static Traefik config. (Option of being lazy and going insecure: true or defining the cloudflare IP CIDRs one by one)

Lastly, rewriting the received HTTP Header that Traefik receives with a middleware plugin (shoutout to github.com/Paxxs/traefik-get-real-ip) so that CF-Connecting-IP is now forwarded as X-Forwarded-For or X-Real-IP when the containers receive it.

3/ Traefik also forwards requests, and again, in a docker container on a bridged network, it forwards the requests to containers through the docker NAT (which makes perfect sense)

So the solution required resolving each of these problems, first by exposing the ports Traefik connects to on the host interface. More info here: https://docs.docker.com/compose/compose-file/05-services/#long-syntax-3

So it turns out that there are a few problems to solve.

1/ Cloudflare send X-Real-IP in a CF-Connecting-IP HTTP Header instead of X-Forwarded-For or X-Real-IP because Cloudflare *itself* acts as a proxy. More here: https://developers.cloudflare.com/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/
2/ Traefik is a reverse proxy, it takes in requests and forwards them. However, when you deploy Traefik in a docker container and assign it a bridge network, it takes in traffic through the docker NAT, not the host network.

To make things muddier, reverse proxies in particular complicate the entire thing as they perform routing functions as well. Traefik in particular functions as a virtual router in specific instances. Throw in the fact that docker itself has networking capabilities that are either host or bridge dependent and you get the perfect recipe for a stew of wtf is going on here.

The fact that Traefik in a docker container doesn't pass on client X-forwarded-for or X-Real-IP headers for reverse proxied requests, but instead substitutes them with docker bridged network IPs, is a bit unintuitive especially when you consider that HTTP Requests are part of the TCP protocol, which runs at Layer 4 of the OSI model and not Layer 3. Wait but Traefik is an application? Doesn't it run on Layer 7?

After much wrangling with Traefik plugins configs, and some good old trial and error, finally managed to find a way to restore original visitor IPs to my docker containers on a Cloudflare proxy + Traefik reverse proxy deployed in a docker container on a bridged network set up.

https://www.youtube.com/watch?v=X7jkdBoddUE

@ralf Federating to other instances stores the media of their instances on yours. Welcome to decentralization.

Having sudden flashbacks to the entire contributor covenant bullshit that was happening a few years ago. Gaslighting and bullying FOSS projects that mostly run as someone's hobby. And no, ethics should not matter in code EXACTLY because of things like supply chain attacks. https://www.youtube.com/watch?v=0pT-dWpmwhA

I personally think incompetence is a lot more dangerous than malice. Malice you can guard against, you can mitigate. Malice gives hints and warnings most of the time. Malice usually must be substantiated with sufficient self serving motive.

Incompetence just comes the fuck out of nowhere and shits on all your plans.

All these Linux admins are goddamn scammers. They keep talking about conjobs!

@sebhans @nixCraft I agree with you. It is a superset, but I think the separation is justified in a poll. Some people only see themselves as web developers and not software developers, and perhaps for good reason.

Mancave finally set up

@sebhans @nixCraft I've had personal experience with web devs who can develop something in php but not understand how to deploy it so... I would actually agree with the separation.

The deadline has now passed for US federal government agencies to disconnect all Ivanti Pulse Secure systems from their networks. (Not all have, btw).

https://www.cisa.gov/news-events/directives/supplemental-direction-v1-ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure

More soon on why the USG have told people to kill the product. It’s bad.

#ConnectAround #threatintel

Football is very international. It's common to have coaches or players who don't speak the same language as the rest of the team, and still be successful. The Japanese national team is a great example. The question should be: Why was the FAS so cheapskate and did not hire a dedicate interpreter for this coach?

https://tdy.sg/4bjAhvq

Daughter is happy and comfortable 🐱

@alwynispat Ahhh so it *WAS* added in post intentionally... They should've taken note of the light but I guess sending the message was more important 😅