mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-08 03:09:39 +03:00
Visitors origin IP not shown in audit log - dockerized installation #3905
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @towerplease on GitHub (Jul 6, 2023).
Attempted Debugging
Searched GitHub Issues
Describe the Scenario
I use a dockerized installation, which i migrated 2 months ago from a classic installation.
Earlier, i used a nginx proxy to access bookstack and i have added header-forward-rules to nginx proxy, so the origin ip is shown in audit log.
After migration, i only see the docker-network gateway in audit log. I guess i need to confige something similar in docker-network to get real origin ip-address?
Exact BookStack Version
23.06.1
Log Content
PHP Version
docker -> No idea which php-Version this uses
Hosting Environment
VPS with ubuntu 22.04 and docker-compose (portainer).
Docker-compose.yml:
version: "2"
services:
bookstack:
image: lscr.io/linuxserver/bookstack
container_name: bookstack
environment:
# Konfiguration über .env File in app_data/www/.env
- PUID=1000
- PGID=1000
- APP_URL=https://doku.madgeeks.de
- DB_HOST=bookstack_db
- DB_PORT=3306
- DB_USER=bookstack
- DB_PASS=AAAAAAAAAAA
- DB_DATABASE=bookstackapp
volumes:
- /mnt/docker/volume/bookstack/app_data:/config
ports:
- 6875:80
restart: unless-stopped
depends_on:
- bookstack_db
labels:
- "com.centurylinklabs.watchtower.enable=true"
bookstack_db:
image: lscr.io/linuxserver/mariadb
container_name: bookstack_db
environment:
- PUID=1000
- PGID=1000
- MYSQL_ROOT_PASSWORD=AAAAAAAAAAA
- TZ=Europe/Berlin
- MYSQL_DATABASE=bookstackapp
- MYSQL_USER=bookstack
- MYSQL_PASSWORD=AAAAAAAAAAA
volumes:
- /mnt/docker/volume/bookstack/db_data:/config
restart: unless-stopped
labels:
- "com.centurylinklabs.watchtower.enable=true"
@ssddanbrown commented on GitHub (Jul 6, 2023):
Hi @towerplease, Couple of questions:
Additionally, If using, I'd advise against using watchtower to auto-update the bookstack or bookstack database containers.
If possible (I'm not familiar with watchtower) have it just alter you so you can run the upgrade yourself.
@towerplease commented on GitHub (Jul 6, 2023):
Hi @ssddanbrown
thanks for the fast reply.
Yeah, i use Cloudflare via cloudflared (also dockerized) in cloudflare-tunnels. Its configured via Cloudflare Access. But i think i have no issue there, because cloudflared is routing without masquerading the origin IP. No other proxies are currently in between (except default docker-routing from my home-network to the docker-IP -> 192.168.178.0/24<->172.26.0.0/16)
As written, i think i need to "configure" the docker-network to not masquerade the origin IP, if this is even possible(?).
Sure, i know the risk of auto-updating. But i have multiple backups:
But thanks for the advice, regarding auto-updates.
@ssddanbrown commented on GitHub (Jul 6, 2023):
@towerplease Ah, Okay, fair enough if you have solid backups. I just get nervous as I've see a pattern of issues due to interrupted updates.
For the IP, It's hard to see where exactly things might be getting dropped, but I'll point to a couple of elements that may help:
APP_PROXIESoption as can be seen here, which when configured can allow BookStack to take the IP from the"X-Forwarded-For"header, providing an alternative path of IP travel (Would have to check if the other parts in play provide, or can provide, this).nginxpath of the mounted container/configvolume. If you can find a header with the right IP you could use nginxrealiplike shown in this stack overflow page.This linuxserver thread may also provide some extra clues.
Otherwise, I'm not too familiar with how docker networks themselves may interact with the incoming IP. I wouldn't have expected that to be an issue but could totally depend on the type of networking at play.
@towerplease commented on GitHub (Jul 6, 2023):
@ssddanbrown
It's alright, also this environment is private, just for me, so non-productive :) Otherwise, i am 100% with you, should never have prod-applications on auto-update.
I see, i have some configurable option within the mounted volume (nginx).
I will try some configuration the next days and reply when i found a solution :)
Thank you very much for providing support and the possible configs.
@towerplease commented on GitHub (Jul 11, 2023):
Hey @ssddanbrown
i just want to let you know, that the info you provided helped me to get it working.
What i changed:
I added APP_PROXIES in ".env" and configured my Host-IP and the Docker-Gateway-IP -> 192.168.178.10,172.26.0.1
Then i added the following config in the nginx-config inside the bookstack-volume:
"nginx/site-confs/default.conf"
After that, i restarted the containers.
And it is working. Now my real IPv6/IPv4 address is shown in Audit-Log instead of the docker-gateway.
Again, thank you very much for your help. Isse solved!
@ssddanbrown commented on GitHub (Jul 11, 2023):
Good to hear you get things working, thanks for sharing the solution for your environment!