fix: nginx XFF 改透传——双层代理下追加自身会掩盖真实客户端IP（生产踩坑修复）

Co-Authored-By: Claude Code <noreply@anthropic.com>
2026-09-16 14:18:25 +08:00
parent 403b8516b0
commit 15ad3fb200
1 changed files with 3 additions and 2 deletions
@@ -14,8 +14,9 @@ server {
    location /api/ {
        client_max_body_size 256k;
        proxy_pass http://web:8000;
-        # X-Forwarded-For 必传：DRF NUM_PROXIES=1 取末段还原真实客户端 IP
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        # XFF 透传上层（1Panel OpenResty 已追加真实客户端IP），勿再追加自身——
+        # 否则 Django 取末段会拿到 Docker 网关 IP（172.20.x.1），真实IP与地理位置全丢
+        proxy_set_header X-Forwarded-For $http_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }