Add TRUSTED_PROXY support & global imports

[jaydrogers]

How to test this image

Use the serversideup/php-dev images that are tagged with this PR number:

serversideup/php-dev:643-*

View the images →

What this PR does

Add TRUSTED_PROXY support

You can now customize your trusted proxy experience via environment variables.

Variation	Affected
cli	❌
fpm	❌
fpm-nginx	✅
fpm-apache	✅
frankenphp	✅

Value	Description
cloudflare (default)	Trusts Cloudflare's IP ranges and uses the CF-Connecting-IP header
sucuri	Trusts Sucuri's IP ranges and uses the X-Forwarded-For header
local	Trusts only private/local network ranges (Docker networks, localhost) and uses the X-Forwarded-For header
off	Disables trusted proxy configuration entirely

Global Imports for FrankenPHP

Instead of using ${CADDY_GLOBAL_OPTIONS} variable (which can be a pain with escaping characters, etc) you can now just import configurations into the global block by copying Caddyfiles over to /etc/frankenphp/caddyfile-global.d/.

Caddy will load any *.caddyfile files:

docker-php/src/variations/frankenphp/etc/frankenphp/Caddyfile

Lines 22 to 23 in 5d5d7a9

	# Add additional Caddy configuration files from the caddyfile-global.d directory
	import caddyfile-global.d/*.caddyfile

[QarthO]

One recommendation would be for local to be somehow tied into cloudflare/sucuri. With this new implementation, if I have my site behind cloudflare, but also running in docker (behind traefik/caddy), then i shouldnt have to pick/choose if i want both

Not sure what the best way to do this, but i do feel like a docker setup is very common

[cloudflare-workers-and-pages]

Deploying serversideup-php with    Cloudflare Pages

Latest commit:	b172d24
Status:	✅  Deploy successful!
Preview URL:	https://e5b52b40.serversideup-php.pages.dev
Branch Preview URL:	https://improvement-webserver-config.serversideup-php.pages.dev

View logs

[jaydrogers]

Valid point!

If you check the file, you'll see that when you set sucuri it will do the local addresses as well as sucuri.

docker-php/src/variations/fpm-nginx/etc/nginx/trusted-proxy/sucuri.conf

Lines 1 to 22 in f696ba5

	##
	# Sucuri - Trusted Proxy
	##
	# Configure docker networks and loopback addresses
	set_real_ip_from 10.0.0.0/8;
	set_real_ip_from 172.16.0.0/12;
	set_real_ip_from 192.168.0.0/16;
	set_real_ip_from 127.0.0.1/8;
	set_real_ip_from ::1;
	set_real_ip_from fd00::/8;
	# Allow Sucuri's IP addresses
	# IP source: https://docs.sucuri.net/website-firewall/sucuri-firewall-troubleshooting-guide/
	set_real_ip_from 192.88.134.0/23;
	set_real_ip_from 185.93.228.0/22;
	set_real_ip_from 66.248.200.0/22;
	set_real_ip_from 2a02:fe80::/29;
	set_real_ip_from 208.109.0.0/22;
	# Set RealIP header
	real_ip_header X-Forwarded-For;

I just added some docs to make it clearer 😃

Next steps

If you want to test out using the images in the top comment, let me know if you're getting your expected results 👍