Add reverse proxy IP header support for web server logging#429
Draft
MorquinDevlar wants to merge 11 commits intomasterfrom
Draft
Add reverse proxy IP header support for web server logging#429MorquinDevlar wants to merge 11 commits intomasterfrom
MorquinDevlar wants to merge 11 commits intomasterfrom
Conversation
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR adds reverse proxy IP header support for web server logging and introduces secure telnet connection tracking capabilities. The main purpose is to properly log real client IP addresses when the web server is behind a trusted reverse proxy, and to add infrastructure for supporting TLS-enabled telnet connections.
Key changes:
- Added getClientIP function to extract real client IPs from X-Real-IP and X-Forwarded-For headers when requests come from localhost
- Added secure telnet port configuration and connection type tracking
- Enhanced online user display to show connection types (Web, Telnet, TLS)
Reviewed Changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| internal/web/web.go | Implements getClientIP function and updates logging to use real client IPs |
| internal/configs/config.network.go | Adds SecureTelnetPort and SecureTelnetLocalPort configuration fields |
| internal/users/userrecord.go | Adds connection type detection logic for TLS connections |
| internal/users/onlineinfo.go | Adds ConnectionType field to track connection method |
| internal/connections/connections.go | Adds GetConnectionPort function for port retrieval |
| internal/connections/connectiondetails.go | Implements GetLocalPort method to extract local port from connections |
| main.go | Adds secure telnet local port listening logic |
| world.go | Updates stats collection to include secure telnet ports |
| internal/web/stats.go | Adds SecureTelnetPorts field to stats structure |
| _datafiles/html/public/online.html | Adds Connection column to online users table |
| _datafiles/html/public/index.html | Updates homepage to display secure telnet ports |
| _datafiles/config.yaml | Adds configuration documentation for secure telnet ports |
Added: - getClientIP helper function to extract real client IPs from proxy headers - X-Real-IP header parsing (higher priority) - X-Forwarded-For header parsing with comma-separated IP support - Security check to only trust headers from localhost connections Changed: - Web request logging to use getClientIP instead of r.RemoteAddr - Log output now shows real client IPs when behind trusted reverse proxy
Added: - SecureTelnetPort configuration field to Network struct - SecureTelnetPorts tracking in web Stats struct - Secure telnet port parsing in world stats update - Conditional display of secure telnet ports on homepage Changed: - Web request logging to show real client IPs behind proxy - Underlay width for ports display reduced for better visual balance
Overview: Secure ports only listen to localhost like the LocalPort, and will display on the website as secure if added to config. Added: - ConnectionType field to OnlineInfo struct showing "Web", "Telnet", or "Secure" - GetLocalPort method to ConnectionDetails for port detection - GetConnectionPort helper function in connections package - SecureTelnetPort configuration field for localhost-only secure connections - Automatic listening on SecureTelnetPort (localhost-only, like LocalPort) - Connection type detection based on WebSocket status and port number - Connection type column to online users HTML table Changed: - GetOnlineInfo method to determine and include connection type - Online page to display how each user is connected - Config documentation to clarify SecureTelnetPort behavior
- SecureTelnetPort is now display-only (shown on website, not bound) - Added SecureTelnetLocalPort for internal binding (where TLS proxy forwards) - Updated connection detection to check SecureTelnetLocalPort - This allows proper stunnel4/HAProxy integration: * TLS proxy binds to public SecureTelnetPort (e.g., 33334) * TLS proxy forwards to SecureTelnetLocalPort (e.g., 9998) * Game binds to SecureTelnetLocalPort on localhost only * Connections via SecureTelnetLocalPort show as 'TLS' on online page
- Changed SecureTelnetLocalPort from single ConfigInt to ConfigSliceString - Now supports multiple secure local ports: [9998, 9997] - Updated connection detection to check all ports in the slice - Allows multiple TLS proxies to forward to different local ports - Consistent with SecureTelnetPort being a slice
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Removed: - Debug logging in GetOnlineInfo that was firing every 10 seconds with stats updates - These logs were creating unnecessary noise in production environments
Certain files - config.network.go, mapper.go, rooms.go and userrecords.go always error out when doing the fmtcheck during the make process. This hopefully fixes this permanently by comitting the change always enforced by fmtcheck.
310b595 to
1ae985b
Compare
Removed excessive debug comments and "what" comments. Only retained the relevent stuff.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added:
Changed: