feat(roles/gitlab_ce): make the nginx real_ip settings configurable

CHANGELOG.md

@@ -50,6 +50,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+* **role:gitlab_ce**: Behind a reverse proxy, GitLab can show and log the real client IP address instead of the address of the proxy, for example under "Current sign-in IP". Set `gitlab_ce__rb_nginx_real_ip_trusted_addresses` to the address of the proxy.
 * **role:apache_tomcat**: With `lfops__remove_rpmnew_rpmsave`, the role also removes the `.rpmnew` and `.rpmsave` files next to the Tomcat configuration files it deploys.
 * **role:apache_tomcat**: Add support for Tomcat 10.1 on RHEL 10.
 * **role:mongodb**: Supports MongoDB 8.0 on Debian and Ubuntu, so MongoDB runs on Ubuntu 24.04, where upstream offers 8.0 only.

roles/gitlab_ce/README.md

@@ -263,6 +263,24 @@ gitlab_ce__rb_external_url: 'https://git.example.com'
 * Type: Number.
 * Default: `80`
 
+`gitlab_ce__rb_nginx_real_ip_header`
+
+* The request header from which the bundled NGINX takes the client IP address. Apache `mod_proxy` and HAProxy with `option forwardfor` send `X-Forwarded-For`. Only applies if `gitlab_ce__rb_nginx_real_ip_trusted_addresses` is set. [Docs](https://docs.gitlab.com/omnibus/settings/nginx/#configure-gitlab-trusted-proxies-and-nginx-real_ip-module)
+* Type: String.
+* Default: `'X-Forwarded-For'`
+
+`gitlab_ce__rb_nginx_real_ip_recursive`
+
+* Whether the bundled NGINX skips all trusted addresses in `gitlab_ce__rb_nginx_real_ip_header` and uses the last untrusted one as the client IP address. Needed if the request passes more than one trusted proxy, and makes no difference with a single one. Only applies if `gitlab_ce__rb_nginx_real_ip_trusted_addresses` is set.
+* Type: Bool.
+* Default: `true`
+
+`gitlab_ce__rb_nginx_real_ip_trusted_addresses`
+
+* IP addresses or CIDR ranges of the reverse proxies in front of GitLab. The bundled NGINX takes the client IP address from `gitlab_ce__rb_nginx_real_ip_header` only for requests from these addresses. GitLab also uses them as trusted proxies, so users do not appear signed in from the address of the proxy.
+* Type: List.
+* Default: unset
+
 `gitlab_ce__rb_nginx_ssl_certificate`
 
 * Path to the SSL certificate.
@@ -400,6 +418,10 @@ gitlab_ce__rb_letsencrypt_enable: false
 
 gitlab_ce__rb_nginx_listen_https: false
 gitlab_ce__rb_nginx_listen_port: '80'
+gitlab_ce__rb_nginx_real_ip_header: 'X-Forwarded-For'
+gitlab_ce__rb_nginx_real_ip_recursive: true
+gitlab_ce__rb_nginx_real_ip_trusted_addresses:
+  - '192.0.2.10'
 gitlab_ce__rb_nginx_ssl_certificate: '/etc/pki/tls/certs/git.example.com.crt'
 gitlab_ce__rb_nginx_ssl_certificate_key: '/etc/pki/tls/private/git.example.com.key'
 gitlab_ce__rb_registry_database_enabled: true

roles/gitlab_ce/defaults/main.yml

@@ -22,6 +22,8 @@ gitlab_ce__rb_gitlab_rails_uploads_directory: '/var/opt/gitlab/gitlab-rails/uplo
 gitlab_ce__rb_letsencrypt_enable: false
 gitlab_ce__rb_nginx_listen_https: false
 gitlab_ce__rb_nginx_listen_port: 80
+gitlab_ce__rb_nginx_real_ip_header: 'X-Forwarded-For'
+gitlab_ce__rb_nginx_real_ip_recursive: true
 gitlab_ce__rb_registry_database_enabled: true
 gitlab_ce__rb_registry_nginx_listen_https: false
 gitlab_ce__rb_registry_nginx_listen_port: 5050

roles/gitlab_ce/templates/etc/gitlab/gitlab.rb.j2

@@ -1,5 +1,5 @@
 # {{ ansible_managed }}
-# 2025092301
+# 2026102001
 
 ## GitLab configuration settings
 ##! This file is generated during initial installation and **is not** modified
@@ -1885,9 +1885,11 @@ nginx['listen_https'] = {{ gitlab_ce__rb_nginx_listen_https | string | lower }}
 # nginx['proxy_cache'] = 'gitlab'
 # nginx['proxy_custom_buffer_size'] = nil
 # nginx['http2_enabled'] = true
-# nginx['real_ip_trusted_addresses'] = []
-# nginx['real_ip_header'] = nil
-# nginx['real_ip_recursive'] = nil
+{% if gitlab_ce__rb_nginx_real_ip_trusted_addresses is defined and gitlab_ce__rb_nginx_real_ip_trusted_addresses | length %}
+nginx['real_ip_trusted_addresses'] = ['{{ gitlab_ce__rb_nginx_real_ip_trusted_addresses | join("', '") }}']
+nginx['real_ip_header'] = '{{ gitlab_ce__rb_nginx_real_ip_header }}'
+nginx['real_ip_recursive'] = '{{ "on" if gitlab_ce__rb_nginx_real_ip_recursive | bool else "off" }}'
+{% endif %}
 # nginx['custom_error_pages'] = {
 #   '404' => {
 #     'title' => 'Example title',