Skip to content

Commit dbd67f4

Browse files
jaapmarcusjaapmarcus
authored
Update CF ips every update (hestiacp#3338)
* Update CF ips every update * Fine tune sed removal real_ip_header
1 parent 2187278 commit dbd67f4

6 files changed

Lines changed: 70 additions & 23 deletions

File tree

‎func/upgrade.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -550,6 +550,27 @@ upgrade_b2_tool() {
550550
fi
551551
}
552552

553+
upgrade_cloudflare_ip() {
554+
echo "[ * ] Update Cloudflare IP"
555+
# https://github.com/ergin/nginx-cloudflare-real-ip/
556+
CLOUDFLARE_FILE_PATH='/etc/nginx/conf.d/cloudflare.inc'
557+
echo "#Cloudflare" > $CLOUDFLARE_FILE_PATH
558+
echo "" >> $CLOUDFLARE_FILE_PATH
559+
560+
echo "# - IPv4" >> $CLOUDFLARE_FILE_PATH
561+
for i in $(curl -s -L https://www.cloudflare.com/ips-v4); do
562+
echo "set_real_ip_from $i;" >> $CLOUDFLARE_FILE_PATH
563+
done
564+
echo "" >> $CLOUDFLARE_FILE_PATH
565+
echo "# - IPv6" >> $CLOUDFLARE_FILE_PATH
566+
for i in $(curl -s -L https://www.cloudflare.com/ips-v6); do
567+
echo "set_real_ip_from $i;" >> $CLOUDFLARE_FILE_PATH
568+
done
569+
570+
echo "" >> $CLOUDFLARE_FILE_PATH
571+
echo "real_ip_header CF-Connecting-IP;" >> $CLOUDFLARE_FILE_PATH
572+
}
573+
553574
upgrade_phppgadmin() {
554575
if [ -n "$(echo $DB_SYSTEM | grep -w 'pgsql')" ]; then
555576
pga_release=$(cat /usr/share/phppgadmin/libraries/lib.inc.php | grep appVersion | head -n1 | cut -f2 -d\' | cut -f1 -d-)

‎install/deb/nginx/nginx.conf‎

Lines changed: 2 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -78,29 +78,8 @@ http {
7878
application/xml+rss application/x-font-ttf image/svg+xml font/opentype;
7979
gzip_proxied any;
8080
gzip_disable "MSIE [1-6]\.";
81-
# Cloudflare https://www.cloudflare.com/ips
82-
set_real_ip_from 103.21.244.0/22;
83-
set_real_ip_from 103.22.200.0/22;
84-
set_real_ip_from 103.31.4.0/22;
85-
set_real_ip_from 104.16.0.0/13;
86-
set_real_ip_from 104.24.0.0/14;
87-
set_real_ip_from 108.162.192.0/18;
88-
set_real_ip_from 131.0.72.0/22;
89-
set_real_ip_from 141.101.64.0/18;
90-
set_real_ip_from 162.158.0.0/15;
91-
set_real_ip_from 172.64.0.0/13;
92-
set_real_ip_from 173.245.48.0/20;
93-
set_real_ip_from 188.114.96.0/20;
94-
set_real_ip_from 190.93.240.0/20;
95-
set_real_ip_from 197.234.240.0/22;
96-
set_real_ip_from 198.41.128.0/17;
97-
# set_real_ip_from 2400:cb00::/32;
98-
# set_real_ip_from 2405:8100::/32;
99-
# set_real_ip_from 2405:b500::/32;
100-
# set_real_ip_from 2606:4700::/32;
101-
# set_real_ip_from 2803:f800::/32;
102-
# set_real_ip_from 2a06:98c0::/29;
103-
# set_real_ip_from 2c0f:f248::/32;
81+
# Cloudflare ips
82+
include /etc/nginx/conf.d/domains/cloudflare.inc;
10483
real_ip_header CF-Connecting-IP;
10584
# SSL PCI compliance
10685
ssl_session_cache shared:SSL:20m;

‎install/hst-install-debian.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1342,6 +1342,24 @@ if [ -n "$resolver" ]; then
13421342
sed -i "s/1.1.1.1 8.8.8.8/$resolver/g" /usr/local/hestia/nginx/conf/nginx.conf
13431343
fi
13441344

1345+
# https://github.com/ergin/nginx-cloudflare-real-ip/
1346+
CLOUDFLARE_FILE_PATH='/etc/nginx/conf.d/cloudflare.inc'
1347+
echo "#Cloudflare" > $CLOUDFLARE_FILE_PATH
1348+
echo "" >> $CLOUDFLARE_FILE_PATH
1349+
1350+
echo "# - IPv4" >> $CLOUDFLARE_FILE_PATH
1351+
for i in $(curl -s -L https://www.cloudflare.com/ips-v4); do
1352+
echo "set_real_ip_from $i;" >> $CLOUDFLARE_FILE_PATH
1353+
done
1354+
echo "" >> $CLOUDFLARE_FILE_PATH
1355+
echo "# - IPv6" >> $CLOUDFLARE_FILE_PATH
1356+
for i in $(curl -s -L https://www.cloudflare.com/ips-v6); do
1357+
echo "set_real_ip_from $i;" >> $CLOUDFLARE_FILE_PATH
1358+
done
1359+
1360+
echo "" >> $CLOUDFLARE_FILE_PATH
1361+
echo "real_ip_header CF-Connecting-IP;" >> $CLOUDFLARE_FILE_PATH
1362+
13451363
update-rc.d nginx defaults > /dev/null 2>&1
13461364
systemctl start nginx >> $LOG
13471365
check_result $? "nginx start failed"

‎install/hst-install-ubuntu.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1388,6 +1388,24 @@ if [ -n "$resolver" ]; then
13881388
sed -i "s/1.1.1.1 8.8.8.8/$resolver/g" /usr/local/hestia/nginx/conf/nginx.conf
13891389
fi
13901390

1391+
# https://github.com/ergin/nginx-cloudflare-real-ip/
1392+
CLOUDFLARE_FILE_PATH='/etc/nginx/conf.d/cloudflare.inc'
1393+
echo "#Cloudflare" > $CLOUDFLARE_FILE_PATH
1394+
echo "" >> $CLOUDFLARE_FILE_PATH
1395+
1396+
echo "# - IPv4" >> $CLOUDFLARE_FILE_PATH
1397+
for i in $(curl -s -L https://www.cloudflare.com/ips-v4); do
1398+
echo "set_real_ip_from $i;" >> $CLOUDFLARE_FILE_PATH
1399+
done
1400+
echo "" >> $CLOUDFLARE_FILE_PATH
1401+
echo "# - IPv6" >> $CLOUDFLARE_FILE_PATH
1402+
for i in $(curl -s -L https://www.cloudflare.com/ips-v6); do
1403+
echo "set_real_ip_from $i;" >> $CLOUDFLARE_FILE_PATH
1404+
done
1405+
1406+
echo "" >> $CLOUDFLARE_FILE_PATH
1407+
echo "real_ip_header CF-Connecting-IP;" >> $CLOUDFLARE_FILE_PATH
1408+
13911409
update-rc.d nginx defaults > /dev/null 2>&1
13921410
systemctl start nginx >> $LOG
13931411
check_result $? "nginx start failed"

‎install/upgrade/versions/1.7.0.sh‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,3 +111,11 @@ if [ "$PHPMYADMIN_KEY" != "" ]; then
111111
$BIN/v-delete-sys-pma-sso quiet
112112
$BIN/v-add-sys-pma-sso quiet
113113
fi
114+
115+
if [ -f /etc/nginx/nginx.conf ] && [ ! -f /etc/nginx/conf.d/cloudflare.inc ]; then
116+
echo "[ * ] Enable support for updating Cloudflare Ips"
117+
sed -i '/set_real_ip_from/d' /etc/nginx/nginx.conf
118+
sed -i '/real_ip_header/d' /etc/nginx/nginx.conf
119+
sed -i 's|# Cloudflare https://www.cloudflare.com/ips|# Cloudflare https://www.cloudflare.com/ips\n include /etc/nginx/conf.d/cloudflare.inc;|g' /etc/nginx/nginx.conf
120+
# At a later stage a function will run and will load all the new rules
121+
fi

‎src/deb/hestia/postinst‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,9 @@ upgrade_roundcube | tee -a $LOG
8686
# Upgrade PHP php dependencies
8787
upgrade_dependencies | tee -a $LOG
8888

89+
# Upgrade Cloudflare IPs if applicable
90+
upgrade_cloudflare_ip | tee -a $LOG
91+
8992
# Upgrade phpMyAdmin if applicable
9093
upgrade_phpmyadmin | tee -a $LOG
9194

0 commit comments

Comments
 (0)