From 2af010216a67dcadce1e5f4d95ff4a505eca5dd2 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Wed, 19 Aug 2026 22:42:20 +0200
Subject: [PATCH] nginx: set real ip

---
 modules/services/nginx.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/modules/services/nginx.nix b/modules/services/nginx.nix
index b15423d..ec78fdd 100644
--- a/modules/services/nginx.nix
+++ b/modules/services/nginx.nix
@@ -6,5 +6,13 @@
     recommendedOptimisation = true;
 
     clientMaxBodySize = "512M";
+
+    # On trust nos ip internes pour bien indiquer le client au bout
+    # i.e. on considère pas le reverseproxy comme notre client
+    appendHttpConfig = ''
+      set_real_ip_from 172.16.0.0/16;
+      set_real_ip_from fd00::/56;
+      real_ip_header X-Real-Ip;
+    '';
   };
 }