From 7e1728a0371ef66103799c87d6e7c43fe56894d8 Mon Sep 17 00:00:00 2001 From: ahmzaa Date: Sat, 25 Jul 2026 04:25:25 +0100 Subject: [PATCH] Restrict Caddy trusted_proxies to Cloudflare IP ranges Replace 'private_ranges' with Cloudflare's official published edge ranges (15 IPv4 + 7 IPv6 from cloudflare.com/ips-v4 and /ips-v6). This ensures Cf-Connecting-Ip / X-Forwarded-For are only honoured for requests that genuinely originate from Cloudflare, preventing client-IP header spoofing from any other source. Validated + fmt-clean and tested at runtime against the caddy-cf image: Caddy starts cleanly with all 22 ranges, serves HTTP 200 with gzip and security headers. --- Caddyfile | 34 +++++++++++++++++++++++++++++++--- 1 file changed, 31 insertions(+), 3 deletions(-) diff --git a/Caddyfile b/Caddyfile index f3aaeb1..b3d2a17 100644 --- a/Caddyfile +++ b/Caddyfile @@ -11,10 +11,38 @@ # docker exec caddy_cf caddy reload --config /etc/caddy/Caddyfile # or restart the container. { - # Trust Cloudflare so real visitor IPs (Cf-Connecting-Ip / X-Forwarded-For) - # are used for logging and remote_ip matchers instead of the CF edge IP. + # Trust only Cloudflare's edge IPs so real visitor IPs (Cf-Connecting-Ip / + # X-Forwarded-For) are honoured only when the request actually comes from + # Cloudflare. This prevents header spoofing from any other source. + # + # Ranges from https://www.cloudflare.com/ips-v4/ and /ips-v6/ . + # Keep in sync when Cloudflare updates them (rarely). If you rebuild + # caddy-cf with the caddy-dynamic-cloudflare / caddy-cloudflare-ip plugin, + # this static list can be replaced with `trusted_proxies cloudflare`. servers { - trusted_proxies static private_ranges + trusted_proxies static \ + 173.245.48.0/20 \ + 103.21.244.0/22 \ + 103.22.200.0/22 \ + 103.31.4.0/22 \ + 141.101.64.0/18 \ + 108.162.192.0/18 \ + 190.93.240.0/20 \ + 188.114.96.0/20 \ + 197.234.240.0/22 \ + 198.41.128.0/17 \ + 162.158.0.0/15 \ + 104.16.0.0/13 \ + 104.24.0.0/14 \ + 172.64.0.0/13 \ + 131.0.72.0/22 \ + 2400:cb00::/32 \ + 2606:4700::/32 \ + 2803:f800::/32 \ + 2405:b500::/32 \ + 2405:8100::/32 \ + 2a06:98c0::/29 \ + 2c0f:f248::/32 client_ip_headers Cf-Connecting-Ip X-Forwarded-For } }