From 06dd14712de57784d0b76bc381a822c3b4790fbc Mon Sep 17 00:00:00 2001
From: Kibi Kelburton <git@f0ck.it>
Date: Sun, 9 Aug 2026 04:12:11 +0200
Subject: [PATCH] fds

---
 config/nginx/f0ck.conf |  7 -------
 docker-compose.yml     |  6 +-----
 src/inc/security.mjs   | 11 +++++++----
 3 files changed, 8 insertions(+), 16 deletions(-)

diff --git a/config/nginx/f0ck.conf b/config/nginx/f0ck.conf
index 9dbdbe4..7349dc1 100644
--- a/config/nginx/f0ck.conf
+++ b/config/nginx/f0ck.conf
@@ -2,10 +2,3 @@ client_max_body_size 10000M;
 client_body_timeout 120s;
 client_header_timeout 120s;
 
-# Pass real IP and forwarded headers from Nginx to Node.js backend
-proxy_set_header X-Real-IP $remote_addr;
-proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-proxy_set_header X-Forwarded-Proto $scheme;
-proxy_set_header Host $http_host;
-proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
-
diff --git a/docker-compose.yml b/docker-compose.yml
index f638a56..02acf22 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -103,21 +103,17 @@ services:
   f0ckm-nginx:
     image: nginxproxy/nginx-proxy:latest
     container_name: f0ckm-nginx
+    network_mode: "host"
     profiles:
       - f0ckm-nginx
     environment:
       - ENABLE_IPV6=true
-    ports:
-      - "80:80"
-      - "443:443"
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
       - certs:/etc/nginx/certs:rw
       - vhost:/etc/nginx/vhost.d:rw
       - html:/usr/share/nginx/html:rw
       - ./config/nginx/f0ck.conf:/etc/nginx/conf.d/f0ckm.conf:ro
-    networks:
-      - f0ckm-net
     restart: unless-stopped
 
   acme-companion:
diff --git a/src/inc/security.mjs b/src/inc/security.mjs
index 3268ad7..25cc2ce 100644
--- a/src/inc/security.mjs
+++ b/src/inc/security.mjs
@@ -26,14 +26,17 @@ export default new class {
      * @returns {string}
      */
     getRealIP(req) {
-        let ip = req.headers['cf-connecting-ip'] ||
+        let rawIp = req.headers['cf-connecting-ip'] ||
             req.headers['true-client-ip'] ||
             req.headers['x-client-ip'] ||
             req.headers['x-real-ip'] ||
-            (req.headers['x-forwarded-for'] ? req.headers['x-forwarded-for'].split(',')[0].trim() : null) ||
-            req.socket.remoteAddress;
+            req.headers['x-forwarded-for'] ||
+            req.socket?.remoteAddress;
 
-        if (!ip) return "unknown";
+        if (!rawIp) return "unknown";
+
+        // If the header contains a comma-separated proxy chain (e.g. "IP1, IP2"), extract the client IP (first element)
+        let ip = String(rawIp).split(',')[0].trim();
 
         // Handle IPv6 loopback and mapped IPv4
         if (ip === "::1") ip = "127.0.0.1";