[NavidSassan]

Summary

Behind a reverse proxy, GitLab shows and logs the address of the proxy as the client IP, for example under "Current sign-in IP".

• New variable gitlab_ce__rb_nginx_real_ip_trusted_addresses. When set, the template renders nginx['real_ip_trusted_addresses'], nginx['real_ip_header'] and nginx['real_ip_recursive'].
• gitlab_ce__rb_nginx_real_ip_header defaults to X-Forwarded-For, which Apache mod_proxy and HAProxy with option forwardfor send. Without it, nginx falls back to X-Real-IP and the setting silently has no effect.
• gitlab_ce__rb_nginx_real_ip_recursive defaults to true. It is required for chained proxies and makes no difference with a single one.
• Header and recursive are only rendered together with the trusted addresses, so the nginx and Rails configuration of hosts that do not use the feature stays the same.
• No separate variable for gitlab_rails['trusted_proxies']: omnibus copies real_ip_trusted_addresses into it when it is unset (parse_gitlab_trusted_proxies in gitlab_rails.rb).

Test

No Molecule scenario exists for gitlab_ce. Tested by hand in a rockylinux:9-ubi-init container with GitLab CE 19.5.0, rendered template with only gitlab_ce__rb_nginx_real_ip_trusted_addresses: ['127.0.0.0/8'], 127.0.0.1 acting as the proxy:

Case	X-Forwarded-For	nginx	Rails (meta.remote_ip)
Single proxy	203.0.113.7	203.0.113.7	203.0.113.7
Chained proxies	203.0.113.7, 127.0.0.5	203.0.113.7	203.0.113.7
Spoofed by client	198.51.100.66, 203.0.113.7	203.0.113.7	203.0.113.7
No header	-	127.0.0.1	127.0.0.1

A sign-in as root stored 203.0.113.7 as current_sign_in_ip. Without the variable, Rails sees 127.0.0.1.