fix: preserve client IPs for proxied requests

Author: Alleny244

docs/user/parameters.md

@@ -58,6 +58,7 @@ There are multiple use cases from the users perspective that dictate what parame
 | `--content-export-path` | Extra file path that Pulp can use for content exports | |
 | `--external-authentication={ipa,ipa_with_api}` | Enable configuration for external authentication via IPA for web UI (or webUI and API for `ipa_with_api`), expects the target machine to [be enrolled into FreeIPA/IDM](https://docs.theforeman.org/3.16/Configuring_User_Authentication/index-katello.html#enrolling-foreman-server-in-freeipa-domain) | `--foreman-ipa-authentication`<br/> `--foreman-ipa-authentication-api` |
 | `--external-authentication-pam-service` | PAM service used for host-based access control in IPA | `--foreman-pam-service` |
+| `--foreman-trusted-proxies` | IP address or CIDR that Foreman trusts for `X-Forwarded-For` (for example a Capsule or load balancer in front of Foreman). May be specified multiple times; values are stored in the installation parameters and merged with `append_unique`. Localhost ranges (`127.0.0.0/8` and `::1`) are always included in Foreman settings. Example: `--foreman-trusted-proxies 10.10.10.20` when a Capsule at that address forwards client requests to Foreman. | `--foreman-trusted-proxies` |
 
 #### Certs
 
@@ -122,7 +123,6 @@ There are multiple use cases from the users perspective that dictate what parame
 | `--foreman-oauth-map-users` | | |
 | `--foreman-plugin-remote-execution-cockpit-ensure` | | |
 | `--foreman-telemetry-prometheus-enabled` | | |
-| `--foreman-trusted-proxies` | | |
 
 
 ## Smart Proxy

src/playbooks/_foreman/metadata.obsah.yaml

@@ -14,6 +14,12 @@ variables:
     parameter: --initial-location
   foreman_puma_workers:
     help: Number of workers for Puma.
+  foreman_trusted_proxies:
+    help: >-
+      IP address or CIDR Foreman should trust for X-Forwarded-For (e.g. Capsule).
+      Can be specified multiple times. Localhost ranges are always included.
+    parameter: --foreman-trusted-proxies
+    action: append_unique
 
 include:
   - _server_aliases

src/roles/foreman/templates/settings.yaml.j2

@@ -8,6 +8,13 @@
   - {{ foreman_alias }}
 {% endfor %}
 
+:trusted_proxies:
+  - 127.0.0.0/8
+  - "::1"
+{% for proxy in foreman_trusted_proxies %}
+  - "{{ proxy }}"
+{% endfor %}
+
 :ssl_certificate: /etc/foreman/client_cert.pem
 :ssl_ca_file: /etc/foreman/katello-default-ca.crt
 :ssl_priv_key: /etc/foreman/client_key.pem

src/roles/httpd/templates/foreman-ssl-vhost.conf.j2

@@ -130,6 +130,7 @@
   ProxyPass / {{ httpd_foreman_backend }}/ retry=0 timeout=900 upgrade=websocket
   ProxyPassReverse / {{ httpd_foreman_backend }}/
 {% else %}
+  ProxyAddHeaders On
 {% if httpd_with_container_gateway %}
   ## Container Gateway
   ProxyPass /v1/ {{ foreman_proxy_url }}/container_gateway/v1/
@@ -139,7 +140,6 @@
   ProxyPass /index/ {{ foreman_proxy_url }}/container_gateway/index/
   ProxyPassReverse /index/ {{ foreman_proxy_url }}/container_gateway/index/
 {% endif %}
-
   ProxyPass /rhsm {{ httpd_foreman_url }}/rhsm disablereuse=on retry=0
   ProxyPassReverse /rhsm {{ httpd_foreman_url }}/rhsm
   ProxyPass /redhat_access {{ httpd_foreman_url }}/redhat_access disablereuse=on retry=0

src/vars/base.yaml

@@ -24,6 +24,8 @@ foreman_client_certificate: "{{ client_certificate }}"
 foreman_plugins: "{{ enabled_features | features_to_foreman_plugins }}"
 foreman_name: "{{ ansible_facts['fqdn'] }}"
 foreman_url: "https://{{ foreman_name }}"
+foreman_trusted_proxies: []
+
 
 foreman_listen_stream: /run/httpd.foreman.sock
 httpd_foreman_backend: "unix://{{ foreman_listen_stream }}|http://foreman"

tests/feature/foreman/trusted_proxies_test.py

@@ -0,0 +1,31 @@
+import pytest
+import yaml
+
+pytestmark = pytest.mark.feature('katello')
+
+TRUSTED_PROXIES_KEY = ':trusted_proxies'
+
+
+@pytest.fixture(scope="module")
+def foreman_settings_yaml(server):
+    result = server.run(
+        "podman secret inspect foreman-settings-yaml "
+        "--format '{{.SecretData}}' --showsecret"
+    )
+    assert result.succeeded, result.stderr
+    return yaml.safe_load(result.stdout)
+
+
+def test_foreman_settings_trusted_proxies_include_localhost(foreman_settings_yaml):
+    trusted = foreman_settings_yaml[TRUSTED_PROXIES_KEY]
+    assert '127.0.0.0/8' in trusted
+    assert '::1' in trusted
+
+
+def test_foreman_settings_trusted_proxies_include_configured_entries(
+    foreman_settings_yaml, obsah_params,
+):
+    configured = obsah_params.get('foreman_trusted_proxies') or []
+    trusted = foreman_settings_yaml[TRUSTED_PROXIES_KEY]
+    for entry in configured:
+        assert entry in trusted

tests/flavor/foreman-proxy-content/httpd_test.py

@@ -7,6 +7,13 @@ def test_pulpcore_vhost_exists(server):
     assert conf.is_file
 
 
+def test_pulpcore_ssl_proxy_add_headers(server):
+    conf = server.file("/etc/httpd/conf.d/pulpcore-ssl.conf")
+    assert conf.exists
+    assert conf.is_file
+    assert "ProxyAddHeaders On" in conf.content_string
+
+
 def test_https_pulp_api_with_client_cert(curl_request):
     cmd = curl_request("pulp/api/v3/smart_proxy/v2/features")
     assert cmd.succeeded