Geolocation problem 2.1.1 - country is not changing (X-Forwarded-For ignored)

[PeerZetZzZzZ]

My plausible is behind nginx reverse proxy. I set headers to forward to Plausible:

    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $host;

I see in Caddy logs that everything is received as expected, X-Forwarded-For header is set on Caddy side with single value: client IP. Geolocation hower is not working correctly, it uses reverse proxy IP rather using X-Forwarded-For value. I've tested with curl and it shows different country when I'm on different IP (changed with VPN), ignoring X-Forwarded-For. It looks like a bug.

I made temporary workaround for that issue. On nginx side I set:

    proxy_set_header CF-Connecting-IP $proxy_add_x_forwarded_for;

and then plausible uses correct IP.

Edit.
It's worth to mention that because country was not changing, my unique visitors metric also looked incorrect (too small). When country works correctly due to CF-Connecting-IP - unique visitors metrics looks good.

[ruslandoga]

👋 @PeerZetZzZzZ

Would you be able to trace the headers Plausible receives? If yes, please search for recon_trace in discussions for how to do it :) That information would speed up finding the root cause of this issue.

[PeerZetZzZzZ]

Caddy configuration is default setup based on this: https://github.com/plausible/community-edition. The only plausible labels set in docker-compose are: virtual.host, virtual.port, virtual.tls-email

[ruslandoga]

I see. So the problem seems to be in Caddy.

From https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#defaults:

For these X-Forwarded-* headers, by default, the proxy will ignore their values from incoming requests, to prevent spoofing.

[ruslandoga]

Note that since you are already using nginx, Caddy is optional and nginx can send requests directly to Plausible. That's one way to fix the issue. Another is to add extra configuration to caddy-gen service, it seems to support relevant directives after wemake-services/caddy-gen#52

[ruslandoga]

Ah, and your proxy_set_header CF-Connecting-IP $proxy_add_x_forwarded_for; workaround seems fine as well, at least for now. The only potential problem with it is that it relies on the current header priority in Plausible.RemoteIP where cf-connecting-ip is preferred over x-forwarded-for. It might stop working if this Plausible's logic in picking the header to read the client IP from changes. Setting x-plausible-ip might be a bit safer.

[PeerZetZzZzZ]

@ruslandoga I have 2 hosts on different domains: application host + plausible host. So both hosts have own proxies. I replaced cf-connecting-ip with x-plausible-ip and looks like working fine, thanks!

So to summarize:

Caddy is ignoring X-Forwarded-* headers this is why country is not correctly obtained based on X-Forwarded-For IP address value. Adding proxy_set_header X-Plausible-IP $proxy_add_x_forwarded_for; to nginx proxy is a workaround, alternatively (CF-Connecting-IP instead of X-Plausible-IP).

Thank you @ruslandoga for your support