fix(analytics): scope real IP to Umami proxy, default to private ranges, log XFF

- Apply set_real_ip_from/real_ip_header only inside the /x/ Umami proxy
  location, so $remote_addr for all other routes remains the direct
  peer and no client-supplied header is trusted outside analytics.
- Default TRUSTED_PROXY_CIDRS to the private ranges reverse proxies
  normally connect from (10/8, 172.16/12, 192.168/16, fc00::/7) so the
  fix works out of the box behind in-cluster ingresses; internet
  clients cannot spoof these as source addresses. Set
  TRUSTED_PROXY_CIDRS=none to disable real IP resolution entirely.
- Extend the access log format to append xff="$http_x_forwarded_for",
  recording the proxy-reported client chain verbatim alongside the
  direct peer address without trusting it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: mesudip

govtool/frontend/docker-entrypoint.sh

@@ -13,23 +13,34 @@ TRUSTED_PROXY_CIDRS_VALUE="${TRUSTED_PROXY_CIDRS:-}"
 REAL_IP_HEADER_VALUE="${REAL_IP_HEADER:-X-Forwarded-For}"
 REAL_IP_CONFIG=""
 
+# Real IP resolution applies only to the Umami proxy location, so
+# $remote_addr stays the direct peer everywhere else. Unset means trust
+# the private ranges reverse proxies normally connect from; internet
+# clients cannot spoof these as a source address. Set
+# TRUSTED_PROXY_CIDRS=none to disable real IP resolution entirely.
+if [ -z "$TRUSTED_PROXY_CIDRS_VALUE" ]; then
+  TRUSTED_PROXY_CIDRS_VALUE="10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7"
+elif [ "$(printf '%s' "$TRUSTED_PROXY_CIDRS_VALUE" | tr '[:upper:]' '[:lower:]')" = "none" ]; then
+  TRUSTED_PROXY_CIDRS_VALUE=""
+fi
+
 if [ -n "$TRUSTED_PROXY_CIDRS_VALUE" ]; then
   if ! printf '%s' "$REAL_IP_HEADER_VALUE" | grep -Eq '^[A-Za-z0-9-]+$'; then
     echo "WARNING: Real IP resolution is disabled because REAL_IP_HEADER contains unsupported characters." >&2
   else
     SET_REAL_IP_FROM_DIRECTIVES=""
     for TRUSTED_PROXY_CIDR in $(printf '%s' "$TRUSTED_PROXY_CIDRS_VALUE" | tr ',' ' '); do
       if printf '%s' "$TRUSTED_PROXY_CIDR" | grep -Eq '^[0-9A-Fa-f:.]+(/[0-9]{1,3})?$'; then
-        SET_REAL_IP_FROM_DIRECTIVES="${SET_REAL_IP_FROM_DIRECTIVES}  set_real_ip_from ${TRUSTED_PROXY_CIDR};
+        SET_REAL_IP_FROM_DIRECTIVES="${SET_REAL_IP_FROM_DIRECTIVES}    set_real_ip_from ${TRUSTED_PROXY_CIDR};
 "
       else
         echo "WARNING: Ignoring TRUSTED_PROXY_CIDRS entry with unsupported characters: ${TRUSTED_PROXY_CIDR}" >&2
       fi
     done
 
     if [ -n "$SET_REAL_IP_FROM_DIRECTIVES" ]; then
-      REAL_IP_CONFIG="${SET_REAL_IP_FROM_DIRECTIVES}  real_ip_header ${REAL_IP_HEADER_VALUE};
-  real_ip_recursive on;"
+      REAL_IP_CONFIG="${SET_REAL_IP_FROM_DIRECTIVES}    real_ip_header ${REAL_IP_HEADER_VALUE};
+    real_ip_recursive on;"
     fi
   fi
 fi
@@ -124,6 +135,7 @@ upstream umami_backend {
       esac
 
       UMAMI_PROXY_CONFIG="  location /x/ {
+${REAL_IP_CONFIG}
     proxy_pass ${UMAMI_SCHEME}://umami_backend${UMAMI_BASE_PATH}/;
     proxy_set_header Host ${UMAMI_AUTHORITY};
     proxy_set_header X-Real-IP \$remote_addr;
@@ -167,19 +179,13 @@ mv /tmp/index.html /usr/share/nginx/html/index.html
 
 rm -f /usr/share/nginx/html/index.html.br /usr/share/nginx/html/index.html.gz
 
-awk -v umami_upstream="$UMAMI_UPSTREAM_CONFIG" -v umami_proxy="$UMAMI_PROXY_CONFIG" -v real_ip="$REAL_IP_CONFIG" '
+awk -v umami_upstream="$UMAMI_UPSTREAM_CONFIG" -v umami_proxy="$UMAMI_PROXY_CONFIG" '
   /# UMAMI_UPSTREAM_CONFIG/ {
     if (umami_upstream != "") {
       print umami_upstream
     }
     next
   }
-  /# REAL_IP_CONFIG/ {
-    if (real_ip != "") {
-      print real_ip
-    }
-    next
-  }
   /# UMAMI_PROXY_CONFIG/ {
     if (umami_proxy != "") {
       print umami_proxy

govtool/frontend/nginx.conf

@@ -1,8 +1,13 @@
 # UMAMI_UPSTREAM_CONFIG
 
+log_format proxied_combined '$remote_addr - $remote_user [$time_local] '
+                            '"$request" $status $body_bytes_sent '
+                            '"$http_referer" "$http_user_agent" '
+                            'xff="$http_x_forwarded_for"';
+
 server {
   listen 80;
-  # REAL_IP_CONFIG
+  access_log /var/log/nginx/access.log proxied_combined;
   root /usr/share/nginx/html;
   error_page 503 @maintenance;