Laravel:使用 Docker 获得负载平衡 AWS Elastic Beanstalk 背后的正确 IP

Question

我的 Laravel 6.x 设置包含一个 Docker，运行在一个 Elastic Beanstalk 代理中，使用负载均衡器后面的 NGinx。

通过这种设置，我很难获得正确的 IP 地址，这会影响 Throttle 中间件，因为 Laravel 获得的 IP 来自主机或负载均衡器。

因此，每个用户都同意每个人对 throttle 的限制。

关于如何解决这个问题的任何想法？

那是 $_SERVER 的副本。在这种情况下，正确的 IP 是 HTTP_X_FORWARDED_FOR 中的第一个。此方案的正确 IP 为 188.67.242.77 .

Array
(
    ...
    [HTTP_X_REAL_IP] => 172.31.28.165
    [HTTP_X_FORWARDED_FOR] => 188.67.242.77, 172.31.28.165
    [HTTP_X_FORWARDED_PROTO] => https
    [HTTP_X_FORWARDED_PORT] => 443
    ... 
    [SERVER_SOFTWARE] => Apache/2.4.38 (Debian)
    [SERVER_NAME] => {MASKED}
    [SERVER_ADDR] => 172.17.0.3
    [SERVER_PORT] => 80
    [REMOTE_ADDR] => 172.17.0.1
    ...
    [REMOTE_PORT] => 47334
    ...
    [SCRIPT_NAME] => /index.php
    [PHP_SELF] => /index.php
    [REQUEST_TIME_FLOAT] => 1584032941.764
    [REQUEST_TIME] => 1584032941
)

测试更改了我在 TrustProxies.php 中可以想象的一切。 protected $headers设置为 Request::HEADER_X_FORWARDED_AWS_ELB , Request::HEADER_X_FORWARDED_ALL , Request::HEADER_X_FORWARDED_FOR , 和 protected $proxies至 *和 ** .混合和匹配的可能性。不好。我得到了 172.17.0.1(主机 ip)或 172.31.28.165(负载均衡器 ip)

有任何想法吗？

非常感谢你提前

=== 3 月 17 日更新 ===

AWS 代理 nginx 文件

    map $http_upgrade $connection_upgrade {
        default        "upgrade";
        ""            "";
    }

    server {
        listen 80;

        gzip on;
            gzip_comp_level 4;
            gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

        if ($time_iso8601 ~ "^(\d{4})-(\d{2})-(\d{2})T(\d{2})") {
            set $year $1;
            set $month $2;
            set $day $3;
            set $hour $4;
        }
        access_log /var/log/nginx/healthd/application.log.$year-$month-$day-$hour healthd;

        access_log    /var/log/nginx/access.log;

        location / {
            proxy_pass            http://docker;
            proxy_http_version    1.1;

            proxy_set_header    Connection            $connection_upgrade;
            proxy_set_header    Upgrade                $http_upgrade;
            proxy_set_header    Host                $host;
            proxy_set_header    X-Real-IP            $remote_addr;
            proxy_set_header    X-Forwarded-For        $proxy_add_x_forwarded_for;
        }
    }

=== 3 月 18 日更新 ===

Docker 中的 apache vhost 文件

<VirtualHost *:80>
    # The ServerName directive sets the request scheme, hostname and port that
    # the server uses to identify itself. This is used when creating
    # redirection URLs. In the context of virtual hosts, the ServerName
    # specifies what hostname must appear in the request's Host: header to
    # match this virtual host. For the default virtual host (this file) this
    # value is not decisive as it is used as a last resort host regardless.
    # However, you must set it for any further virtual host explicitly.
    #ServerName www.example.com

    ServerAdmin webmaster@localhost
    DocumentRoot ${APACHE_DOCUMENT_ROOT}

    # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
    # error, crit, alert, emerg.
    # It is also possible to configure the loglevel for particular
    # modules, e.g.
    #LogLevel info ssl:warn

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    # For most configuration files from conf-available/, which are
    # enabled or disabled at a global level, it is possible to
    # include a line for only one particular virtual host. For example the
    # following line enables the CGI configuration for this host only
    # after it has been globally disabled with "a2disconf".
    #Include conf-available/serve-cgi-bin.conf
</VirtualHost>

Answer 1

如果您的 Laravel 实例在 Docker 容器中运行并由 nginx 提供服务，您可以覆盖 REMOTE_ADDR与 HTTP_X_REAL_IP在 Docker 的 nginx 虚拟主机配置中。

server {
    listen 80;

    index index.php index.html;

    error_log  /var/log/nginx/error.log;
    access_log /var/log/nginx/access.log;

    root /var/www/public_html;

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass app:9000;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;

        # Override the load balancer IP with real IP.
        fastcgi_param REMOTE_ADDR $http_x_real_ip;
    }

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
}