NPM behind HAProxy, X-Real-IP

Networking & Firewalls
1

I’m running Nginx Proxy Manager behind HAProxy. Reason being that HAProxy runs on my pfSense, which can display a custom error page if my server is offline, but it doesn’t support authentication, which NPM does.

I’m a bit confused about how these headers work. I’ve gotten so far as having X-Forwarded-For containing the client IP and the HAProxy IP, however the X-Real-IP contains the HAProxy IP.

Looking in the configs of NPM, it seems to have real_ip_recursive off; which will incorrectly set $remote_addr to the HAProxy IP, and then it sets X-Real-IP to $remote_addr. I can’t seem to override it to real_ip_recursive on;

By default, HAProxy doesn’t seem to set the X-Real-IP header at all. If I add it with the client IP, NPM will set $remote_addr and therefore X-Real-IP to the client IP. Problem solved? Yes, but the X-Forwarded-For header will now contain the client IP twice.

Is there some special config I have to do when running NPM behind another reverse proxy?

2

First of all, I wouldn’t recommend putting two reverse proxies behind one another, as it only makes things more complicated, as you’ve already noticed yourself.

Second, both things, adding custom error pages to Nginx Proxy Manager and adding basic authentication to HAProxy, are absolutely possible. They’re just not exposed in the respective UIs of the products you’re using.

Google turned up this guide for HAProxy on pfSense and this one for custom error pages in Nginx Proxy Manager. These were just among first results I found from a quick search, and there’s probably more documentation and guides out there if you dig a bit deeper.

So again, both things are definitely possible, they just require a bit of manual configuration. The easier of the two is probably adding custom pages to NPM.

3

Well, the problems with those solutions are:

  • HAProxy doesn’t seem to play well with Authentik/Authelia and the like. I’ve seen some random posts claiming they have gotten it to work, but not explaining how, and lots of people saying they never managed or simply stating it doesn’t work.
  • If my server is down, NPM is also down, which is why pfSense/HAProxy is the one that has to display the error page.
4

@bb77 is correct. You will be looking for a hard time if you run 2 proxies. Also I have ran authelia with HAproxy without issue. Not sure where you are getting that they don’t play well together.