nextcloud / nextcloud/docker

`TRUSTED_PROXIES` doesn't evaluate `gethostbyname`

Open
#2,218 9 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement feature: auto config (environment variables) needs review
Dominant language
Shell
Stars
7.4k
Forks
1.9k
PR merge metrics
No merged PRs in 30d

Description

When setting the TRUSTED_PROXIES environment variable as shown in https://github.com/nextcloud/server/pull/44495#issuecomment-2079798695 (TRUSTED_PROXIES=gethostbyname('nginx-proxy'), I get the warning Your "trusted_proxies" setting is not correctly set, it should be an array of IP addresses - optionally with range in CIDR notation. and when executing php occ config:system:get trusted_proxies, the result is gethostbyname('proxy'). When manually editing config.php, the result of php occ config:system:get trusted_proxies will be the IP of the proxy as the gethostbyname function will get evaluated correctly.

Since it's best practice to not assign static IP's in a compose file, being able to evaluate gethostbyname when using the TRUSTED_PROXIES environment variable is quite important especially for the Nextcloud Docker image.

As @xeluior mentioned in this comment, we might be able to naively apply gethostbyname to all trusted proxies when the container starts, however container restarts would likely break this, and I'm not sure if Nextcloud's config works across container restarts with gethostbyname either.

Furthermore, it might be good to also discuss if we want to only evaluate gethostbyname or if we should evaluate the exact same way as config.php does for consistency.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the TRUSTED_PROXIES handling in the Nextcloud Docker image and compare its result with config.php evaluation. Reproduce the behavior using php occ config:system:get trusted_proxies, then determine how hostname resolution should behave across container starts and what consistent output should be expected.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, php, shell
Domain
devops, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.