PBS 4.2 behind rev.proxy

[thommie]

I have a pbs behind a rev.proxy, HAProxy in this case. A standard redirect to port 8007 ends in a redirection loop. The roadmap at https://pbs.proxmox.com/wiki/Roadmap mentions https://forum.proxmox.com/threads/proxmox-backup-server-security-advisories.149332/post-841346

Support configuring the proxy daemon's real peer-IP header and allowed source IP addresses through environment variables (PSA-2026-00009-1).The PROXY_REAL_IP_HEADER and PROXY_REAL_IP_ALLOW_FROM variables can be set by overriding the proxmox-backup-proxy.service systemd unit.This enables deploying Proxmox Backup Server behind a reverse proxy while preserving the real client IP address.

I dont understand the sentence

the PROXY_REAL_IP_HEADER and PROXY_REAL_IP_ALLOW_FROM variables can be set by overriding the proxmox-backup-proxy.service systemd unit.

Do I need a CIDR allowing the redirection?

 

[JohnnieKF]

When PBS sits behind a proxy, every request arrives from the proxy's IP. The real client address is lost. Your proxy adds it in a header (X-Forwarded-For), and these two variables tell PBS which header to read and which source addresses it's allowed to believe it from. Without the second part anyone could send a forged X-Forwarded-For and hide their real address from the logs and rate limiter [0].

So the CIDR is your HAProxy's own IP, not the clients:

[Service]
Environment="PROXY_REAL_IP_HEADER=X-Forwarded-For"
Environment="PROXY_REAL_IP_ALLOW_FROM=<haproxy-ip>/32"

[0] https://pve.proxmox.com/pve-docs/pveproxy.8.html#pveproxy_real_ip