Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Explain reverse proxy setup for websockets #2121

Merged
merged 2 commits into from
Jan 12, 2024
Merged

Explain reverse proxy setup for websockets #2121

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
00a4c8e
Explain reverse proxy setup for websockets
nealey Jan 11, 2024
68ecf1a
Update MANUAL.md
slingamn Jan 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions docs/MANUAL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -623,6 +623,8 @@ Many clients do not have this support. However, you can designate port 6667 as a

Ergo supports the use of reverse proxies (such as nginx, or a Kubernetes [LoadBalancer](https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer)) that sit between it and the client. In these deployments, the [PROXY protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) is used to pass the end user's IP through to Ergo. These proxies can be used to terminate TLS externally to Ergo, e.g., if you need to support versions of the TLS protocol that are not implemented natively by Go, or if you want to consolidate your certificate management into a single nginx instance.

### IRC Sockets

The first step is to add the reverse proxy's IP to `proxy-allowed-from` and `ip-limits.exempted`. (Use `localhost` to exempt all loopback IPs and Unix domain sockets.)

After that, there are two possibilities:
Expand All @@ -638,6 +640,10 @@ After that, there are two possibilities:
proxy: true
```

### Websockets through HTTP reverse proxies

Ergo will honor the `X-Forwarded-For` headers on incoming websocket connections, if the peer IP address appears in `proxy-allowed-from`. For these connections, set `proxy: false`, or omit the `proxy` option.


## Client certificates

Expand Down