feat: add trusted client IP support for multiple gateways

conf.d/00-maps.conf.template

@@ -11,13 +11,35 @@ geo $is_internal {
     192.168.10.0/24 1;
 }
 
-map $http_x_origin_token $valid_origin_token {
+map $http_x_origin_token $gateway_provider {
-    default            0;
+    default            '';
-    ${EO_ORIGIN_TOKEN} 1;
+    ${EO_ORIGIN_TOKEN} edgeone;
 }
 
-map $is_internal$valid_origin_token $allow_access {
+map $gateway_provider $gateway_client_ip {
-    default 0;
+    default '';
-    10      1;
+    edgeone $http_eo_connecting_ip;
-    01      1;
+}
+
+map $gateway_client_ip $valid_gateway_client_ip {
+    default           0;
+    ~^[0-9A-Fa-f:.]+$ 1;
+}
+
+map $is_internal:$gateway_provider:$valid_gateway_client_ip $access_source {
+    default     denied;
+    ~^1:        internal;
+    0:edgeone:1 edgeone;
+}
+
+map $access_source $allow_access {
+    default  0;
+    internal 1;
+    edgeone  1;
+}
+
+map $access_source $trusted_client_ip {
+    default  $remote_addr;
+    internal $remote_addr;
+    edgeone  $gateway_client_ip;
 }

snippets/proxy.conf.template

@@ -1,13 +1,17 @@
+# restrict access
 if ($allow_access = 0) {
     return 403;
 }
 
 # set headers
 proxy_set_header Host              $host;
-proxy_set_header X-Real-IP         $remote_addr;
+proxy_set_header X-Real-IP         $trusted_client_ip;
-proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-For   $trusted_client_ip;
 proxy_set_header X-Forwarded-Proto $scheme;
+
+# clean headers
 proxy_set_header X-Origin-Token    '';
+proxy_set_header EO-Connecting-IP  '';
 
 # enable websockets: http://nginx.org/en/docs/http/websocket.html
 proxy_http_version 1.1;