Unable to setup trusted proxies

[leonida92]

Code:

*.example.com {
tls {
dns cloudflare <API>
}

@jellyfin host jellyfin.example.com
handle @jellyfin {
reverse_proxy 192.168.1.5:8096
}

This is my caddy configuration for jellyfin using cloudflaredns module. My caddy LXC IP is 192.168.1.20. When I enter this IP in trusted proxies, Jellyfin shows only the caddy IP for every device connected through it. I don't know where to start to troubleshoot this issue.

It was working fine before the update without specifying the trusted proxies.

Any help on where should I get started?
Maybe I should mention that I have configured adguardhome dns as the DNS for tailscale which redirects to the caddy ip. I only access my services outside of my local network via tailscale. The local subnet is advertised via tailscale.

Both caddy and Jellyfin are running as independent LXC on proxmox.

Thanks in advance.

[TheDreadPirate]

IIRC, Caddy should be using X-Forwarded-For and X-Real-IP headers when using reverse_proxy. Both of which are required for the appropriate logging in Jellyfin when using a reverse proxy.

Unless you've disabled them somewhere else in your config.

[Duvel]

I confirm that everything works fine with Caddy by default a slong as you properly define your caddy server's LAN IP in jellyfin trusted proxies.

What does this mean ??

Jellyfin shows only the caddy IP for every device connected through it.

[TheDreadPirate]

What does this mean ??

Jellyfin shows only the caddy IP for every device connected through it.

All the client activity is being reported as originating from the reverse proxy's IP instead of the client's actual IP.  Which shouldn't be the case as long as the IP set for known proxies is correct and that the proxy is using the two headers I mentioned.

[leonida92]

IIRC, Caddy should be using X-Forwarded-For and X-Real-IP headers when using reverse_proxy.  Both of which are required for the appropriate logging in Jellyfin when using a reverse proxy.

Unless you've disabled them somewhere else in your config.

I didn't disable them anywhere. I also tried adding them manually to my jellyfin caddy config, got a message saying that it's not necessary because caddy uses them by default, and still the same.

[leonida92]

I confirm that everything works fine with Caddy by default a slong as you properly define your caddy server's LAN IP in jellyfin trusted proxies.

Do you have tailscale setup in your caddy server? Are you using any Caddy module? Is caddy running as docker or bare metal?

[pxr5]

I have 2 instances of Jellyfin running. One, bare metal on a Win11 Pro MiniPC and the other in docker on a Synology NAS. Both are behind a reverse proxy running directly on a Raspberry Pi. The Caddyfile contains the same commands for each Jellyfin server. I've set the trusted proxies on both instances of Jellyfin to 192.168.1.100/24 - which is the IP address of the Pi running Caddy. Everything works OK and both instances reports the correct IP address of the remote connection and not of the Pi running Caddy.

I looked at some information on Caddy and it seems that the headers are forwarded by default so my simple Caddy file appears to be fine without any extra forward headers.

It's important to restart the Jellyfin server for this to kick in properly as without a reboot the remote connections will incorrectly report the ip of the caddy proxy.