Add configurable REMOTEIP_HEADER environment variable for Apache

[frankenbubble]

• Add REMOTEIP_HEADER environment variable with X-Forwarded-For default
• Replace hardcoded RemoteIPHeader with ${REMOTEIP_HEADER} variable
• Update both regular and Alpine Dockerfiles
• Add documentation to README.md
• Maintains backward compatibility while allowing custom headers
• Enables CloudFront setups to use alternative header sources, such as CloudFront-Viewer-Address , vastly simplifying maintaining trusted ip lists

[fzipi]

Thanks for your contribution!

Won't we need to propagate this to nginx configuration templates also?

[fzipi]

Somewhere around https://github.com/coreruleset/modsecurity-crs-docker/blob/main/nginx/templates/includes/proxy_backend.conf.template#L5-L8 ?

[frankenbubble]

Hi, I believe its set here , https://github.com/coreruleset/modsecurity-crs-docker/blob/main/nginx/templates/includes/proxy_backend.conf.template#L20 , my thought was to add the equivalent feature into apache

[fzipi]

Hi @frankenbubble. Reading the docs:

var	desc
SET_REAL_IP_FROM	A string of comma separated IP, CIDR, or UNIX domain socket addresses that are trusted to replace addresses in REAL_IP_HEADER (Default: 127.0.0.1). See set_real_ip_from

So I think this is for a different setting.

[frankenbubble]

Hi, I mean Line 20, real_ip_header ${REAL_IP_HEADER}; , not SET_REAL_IP_FROM

[fzipi]

LGTM for apache then.

[fzipi]

Last ask @frankenbubble: can you sign your commits and ammend this PR? Commits must have verified signatures.

[fzipi]

ping @frankenbubble