ip addresses of users

[christianmerges]

When using claudflare docker container as a reverse proxy, i cannot see the public ip in the user profiles, it is showing a locale ip address instead. There has to be some extra configuration to trust the headers from cloudflare.

my yaml:

moodle:
    image: erseco/alpine-moodle
    environment:
      REVERSEPROXY: "false"
      SSLPROXY: "true"
      SITE_URL: https://fqdn

When I do REVERSEPROXY: "true", i cannot access the lms anymore, because I get this error when I try to access it from the public domain with https:

Reverse proxy enabled so the server cannot be accessed directly. Please contact the server administrator.

[erseco]

Thanks for the report.

There is some related context in #101 (and the README section added from it), but I don’t think this is an exact duplicate.

For a typical SSL-terminating reverse proxy setup, the recommended configuration in this image is:

SITE_URL: https://your-public-url
SSLPROXY: true
REVERSEPROXY: false

REVERSEPROXY=true is usually only needed when Moodle is intentionally accessed from multiple different base URLs. In a normal single public URL setup, it should stay false.

That said, the real client IP problem is slightly different from the SSL / redirect problem:

• SSLPROXY / REVERSEPROXY help Moodle understand the proxy setup.
• They do not automatically recover the original client IP if the proxy chain is not forwarding it correctly.
• If the container only receives the Cloudflare / tunnel / proxy IP, Moodle will show that IP.

So for Cloudflare Zero Trust Tunnel, the key part is verifying which headers actually reach the container, for example:

• X-Forwarded-For
• CF-Connecting-IP

If Cloudflare Tunnel is not passing the client IP through to the container in a header that your web stack uses, Moodle cannot display the real user IP.

Could you please check and share:

1. Your full SITE_URL, SSLPROXY, and REVERSEPROXY values
2. The Cloudflare Tunnel / ingress config
3. Which request headers reach the container (X-Forwarded-For, CF-Connecting-IP, etc.)

As a first step, I would recommend trying:

REVERSEPROXY: false
SSLPROXY: true

and then confirming whether the client IP is actually being forwarded by the tunnel/proxy layer.

Meanwhile, I created this issue erseco/alpine-php-webserver#72 to allow this setting in alpine-moodle

[christianmerges]

Hi and thanks for your long message! I can confirm, that for all other services behind the same cloudflare tunnel, the headers are added. The main thing is usually, that the application is not the trusting reverse proxy and therefore ignores it's provided headers. Usually the headers are trusted automatically, when the reverse proxy has a RFC1918 ip, but not with moodle.

[christianmerges]

Okay I have seen, the webserver package already has the change, so I need to wait for it to be merged into this repo?

[erseco]

Thanks, that is correct.

The real IP support has already been added in the base image (alpine-php-webserver), and it has also been backported to the 3.20.x branch.

What is still missing is a new published alpine-moodle image that includes that updated base image.

At the moment, there will not be an immediate stable release just for this change, because releases are usually kept aligned with Moodle releases and/or the corresponding Alpine Linux release cycle.

So for now you have three options:

1. Use the :beta image

   • this already includes the new trusted proxy real IP support

2. Build the image locally

   • for example with your normal make build workflow

3. Wait for the next published image

   • it should be included in the next Moodle beta/update or the next Alpine Linux bugfix-based release

So yes: the feature is already implemented, but if you are using the current stable alpine-moodle image, you need to either use :beta, build it yourself, or wait for the next release.

Your Moodle proxy settings are still correct for this setup:

REVERSEPROXY: "false"
SSLPROXY: "true"
SITE_URL: https://fqdn

Once you are using an image that includes the updated base, you will also need to configure the trusted proxy real IP variables, for example:

REAL_IP_HEADER: CF-Connecting-IP
REAL_IP_RECURSIVE: "on"
REAL_IP_FROM: <trusted proxy CIDRs only>

REVERSEPROXY=true is not needed here and is a different Moodle setting, which is why it causes the access error you saw.

[christianmerges]

I have switched to the beta tag and my environment variables are:

    environment:
      SITE_URL: https://fqdn
      REVERSEPROXY: "false"
      SSLPROXY: "true"
      REAL_IP_HEADER: CF-Connecting-IP
      REAL_IP_RECURSIVE: "on"
      REAL_IP_FROM: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

However i still see the following in the user profile of my own user which just logged in:

Last IP address
10.0.10.16