Trusted Proxies feature

[diegolr62]

I'm using Postal version 3.3.4. We need to split the front end (caddy proxied) from backend (ruby webserver listening on port 5000). I guess that the trusted_proxies configuration parameter will help with this.

Just to make the situation clear: our postal servers are runing behing a firewall.

Our goal is to have the front end proxy in a remote location with an ip address directly exposed to internet (public IP address) and this front end must relay requests to our backend behind a firewall.

Have anyone tried this??

Could you please tell me if we are in the right direction??

Regards in advance.

[compgeniuses]

Work in progress, but would allow you to do this

https://github.com/[geniusdynamics/ns8-postal](https://github.com/geniusdynamics/ns8-postal/)/

caveate, you need to install it on nethserver 8

[diegolr62]

Thanks, but is not what I'm looking for

[willpower232]

I can't say I've used the feature but it seems to be the way to fix the problem you have if you complete this set up and find the rails framework is blocking your access to Postal.

I'd probably just set up all the running instances of Postal and then see how easy it was to get the caddy to connect.

[diegolr62]

This is the status, the web process (puma) listens on 127.0.0.1:5000 . To make this work puma should also listen on the physical interfaces (ens33 in my case), but is not doing that. Any ideas? Maybe modify the docker to listen ??

[willpower232]

Ah I'm with you now, the setting for binding IP is here

postal/doc/config/yaml.yml

Line 41 in 9c5f96a

default_bind_address: 127.0.0.1

If you don't have docker to deal with the port for you then presumably you could change this to 0.0.0.0 as long as your infrastructure can keep it from the public internet.

[diegolr62]

Hello Will

No luck yet , I'm about to declare a bug in Postal. I have my config with the line:

trusted_proxies: [xxx.xxx.xxx.xxx]

In the server with ip address xxx.xxx.xxx.xxx I've installed Caddy as reverse proxy pointing to my PostalServer address port 5000, I have also suppressed the X-Forwarded-For in the Caddy config .

When I try to enter Postal Server web interface , I receive a 403 - Forbidden. After checking the logs, I can see the address of my trusted proxie being forbidden.

Any ideas ?