Dokploy / Dokploy/dokploy

Add native support for showing real client IP when behind Cloudflare (or other reverse proxies)

Open
#5,248 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
TypeScript
Stars
37.4k
Forks
3k
Avg merge
1d 3h
Merged PRs (30d)
73

Description

What problem will this feature address?

When an application is deployed behind Cloudflare (proxied DNS) or another reverse proxy, both Dokploy's dashboard and the request headers passed to deployed applications reflect Cloudflare's edge IP address rather than the end user's actual IP address.

This creates critical limitations:

  • Inability to perform accurate IP-based access control or allowlisting.
  • Inaccurate rate limiting at the application level.
  • Loss of visibility into actual traffic sources in application logs.

Current Workaround & Friction:
Currently, the only workaround is to SSH into the host server and manually edit Traefik's static configuration (/etc/dokploy/traefik/traefik.yml) to populate entryPoints.<name>.forwardedHeaders.trustedIPs with Cloudflare’s published IP ranges.

This approach is fragile because:

  1. It is not exposed or discoverable in the UI.
  2. Changes risk being silently overwritten whenever Dokploy regenerates the Traefik configuration.
  3. Cloudflare's IP ranges must be maintained manually or through out-of-band scripting.
Describe the solution you'd like

A native configuration toggle in the Dokploy settings (e.g., under Settings > Traefik / Network) to handle trusted reverse proxy headers automatically:

  1. Preset Options: A toggle to enable "Trust Proxy / Restore Real IP" with built-in presets:
    • Cloudflare: Automatically fetches and injects Cloudflare’s official IPv4 and IPv6 ranges (https://www.cloudflare.com/ips-v4 and /ips-v6).
    • Custom / Generic: A text input accepting user-defined CIDR ranges (for Cloudflare Tunnels, AWS ALB, custom NGINX, etc.).
  2. Persistence & Maintenance:
    • Ensure these entries are natively written into Traefik's entryPoints (web, websecure) so they persist across Dokploy updates or Traefik config regenerations.
    • Periodically auto-refresh Cloudflare's IP list (or sync on container restart).
  3. UI Visibility (Optional): Display the resolved real client IP in Dokploy dashboard logs and request analytics.
Describe alternatives you've considered
  • Manual traefik.yml modification + Cron script: Functional, but prone to breakage when Dokploy regenerates Traefik files.
  • Traefik Plugins (e.g., traefik-real-ip, Traefik Warp): Solves parts of the issue, but requires enabling Traefik's plugin system, which is currently unexposed in Dokploy.
Additional context
  • Potentially related to #2349 (IPv6 client IP reporting issues).
Will you send a PR to implement it?

Yes

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how Settings > Traefik / Network configuration is represented and how /etc/dokploy/traefik/traefik.yml is generated. Review Traefik entryPoints for web and websecure, the Cloudflare IPv4/IPv6 sources, and related issue #2349. Done means trusted proxy ranges can be configured through Dokploy and persist across configuration regeneration.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, typescript
Domain
cloud, devops, infrastructure, networking
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.