fds

config/nginx/f0ck.conf

@@ -2,10 +2,3 @@ client_max_body_size 10000M;
 client_body_timeout 120s;
 client_header_timeout 120s;
 
-# Pass real IP and forwarded headers from Nginx to Node.js backend
-proxy_set_header X-Real-IP $remote_addr;
-proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-proxy_set_header X-Forwarded-Proto $scheme;
-proxy_set_header Host $http_host;
-proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
-

docker-compose.yml

@@ -103,21 +103,17 @@ services:
   f0ckm-nginx:
     image: nginxproxy/nginx-proxy:latest
     container_name: f0ckm-nginx
+    network_mode: "host"
     profiles:
       - f0ckm-nginx
     environment:
       - ENABLE_IPV6=true
-    ports:
-      - "80:80"
-      - "443:443"
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
       - certs:/etc/nginx/certs:rw
       - vhost:/etc/nginx/vhost.d:rw
       - html:/usr/share/nginx/html:rw
       - ./config/nginx/f0ck.conf:/etc/nginx/conf.d/f0ckm.conf:ro
-    networks:
-      - f0ckm-net
     restart: unless-stopped
 
   acme-companion:

src/inc/security.mjs

@@ -26,14 +26,17 @@ export default new class {
      * @returns {string}
      */
     getRealIP(req) {
-        let ip = req.headers['cf-connecting-ip'] ||
+        let rawIp = req.headers['cf-connecting-ip'] ||
             req.headers['true-client-ip'] ||
             req.headers['x-client-ip'] ||
             req.headers['x-real-ip'] ||
-            (req.headers['x-forwarded-for'] ? req.headers['x-forwarded-for'].split(',')[0].trim() : null) ||
+            req.headers['x-forwarded-for'] ||
-            req.socket.remoteAddress;
+            req.socket?.remoteAddress;
 
-        if (!ip) return "unknown";
+        if (!rawIp) return "unknown";
+
+        // If the header contains a comma-separated proxy chain (e.g. "IP1, IP2"), extract the client IP (first element)
+        let ip = String(rawIp).split(',')[0].trim();
 
         // Handle IPv6 loopback and mapped IPv4
         if (ip === "::1") ip = "127.0.0.1";