Metadata-Version: 2.1
Name: odoo-addon-proxy_trusted_hops
Version: 16.0.1.0.0.4
Summary: Configure how many reverse proxies Odoo trusts for the client IP
Home-page: https://github.com/OCA/server-tools
Author: Ametras intelligence GmbH, Odoo Community Association (OCA)
Author-email: support@odoo-community.org
License: LGPL-3
Classifier: Programming Language :: Python
Classifier: Framework :: Odoo
Classifier: Framework :: Odoo :: 16.0
Classifier: License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)
Requires-Python: >=3.10
Requires-Dist: odoo<16.1dev,>=16.0a

.. image:: https://odoo-community.org/readme-banner-image
   :target: https://odoo-community.org/get-involved?utm_source=readme
   :alt: Odoo Community Association

==================
Proxy Trusted Hops
==================

.. 
   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
   !! This file is generated by oca-gen-addon-readme !!
   !! changes will be overwritten.                   !!
   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
   !! source digest: sha256:584bbae6b314de57b8ebc18049b9b544f843c1f886c92fa11ea32e7015249ae7
   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png
    :target: https://odoo-community.org/page/development-status
    :alt: Beta
.. |badge2| image:: https://img.shields.io/badge/license-LGPL--3-blue.png
    :target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html
    :alt: License: LGPL-3
.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--tools-lightgray.png?logo=github
    :target: https://github.com/OCA/server-tools/tree/16.0/proxy_trusted_hops
    :alt: OCA/server-tools
.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
    :target: https://translation.odoo-community.org/projects/server-tools-16-0/server-tools-16-0-proxy_trusted_hops
    :alt: Translate me on Weblate
.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
    :target: https://runboat.odoo-community.org/builds?repo=OCA/server-tools&target_branch=16.0
    :alt: Try me on Runboat

|badge1| |badge2| |badge3| |badge4| |badge5|

When ``proxy_mode`` is enabled, Odoo takes the client address from the
``X-Forwarded-For`` header, but it only trusts one proxy: it always takes the
last address of the header. Behind more than one reverse proxy (for example a
cloud load balancer in front of an ingress controller), that address is one of
your own proxies, not the client.

This module lets you configure how many proxies Odoo trusts. Odoo then uses
the address added by your outermost proxy, which is the real client.

This affects every place that uses the client address, for example the access
log, the login log, the login cooldown after failed attempts, reCAPTCHA, and
website visitors.

**Table of contents**

.. contents::
   :local:

Installation
============

You don't have to install this module in a database. Add it to the
``server_wide_modules`` list so it is active as soon as the server starts:

.. code-block:: cfg

    server_wide_modules = base,web,proxy_trusted_hops

Configuration
=============

Set the number of reverse proxies in front of Odoo, either with the
``ODOO_TRUSTED_PROXIES`` environment variable or in a ``[proxy_trusted_hops]``
section of the Odoo configuration file:

.. code-block:: cfg

    [options]
    proxy_mode = True

    [proxy_trusted_hops]
    trusted_proxies = 2

The environment variable takes precedence over the configuration file. When
the ``server_environment`` module is on the addons path, the section is read
through it, so it can also come from its environment files; the Odoo
configuration file is still included there.

As in Odoo itself, the header is only used when ``proxy_mode`` is enabled and
the request contains an ``X-Forwarded-Host`` header.

With ``trusted_proxies = N``, Odoo uses the N-th address from the end of the
``X-Forwarded-For`` header. If the header contains fewer addresses than that,
Odoo keeps the address of the connecting proxy.

**Security warning:** the client can send its own ``X-Forwarded-For`` header,
and proxies only add their entry to it. Never set a value higher than the
number of proxies that actually add an entry: otherwise the client decides
which address Odoo sees, and can for example get around the login cooldown.
Each proxy must add its entry to the header.

Check the server log at startup:

.. code-block:: shell

    INFO ? odoo.addons.proxy_trusted_hops.patch: Trusting 2 proxies for the X-Forwarded-For header.

Bug Tracker
===========

Bugs are tracked on `GitHub Issues <https://github.com/OCA/server-tools/issues>`_.
In case of trouble, please check there if your issue has already been reported.
If you spotted it first, help us to smash it by providing a detailed and welcomed
`feedback <https://github.com/OCA/server-tools/issues/new?body=module:%20proxy_trusted_hops%0Aversion:%2016.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.

Do not contact contributors directly about support or help with technical issues.

Credits
=======

Authors
~~~~~~~

* Ametras intelligence GmbH

Contributors
~~~~~~~~~~~~

* `Ametras intelligence GmbH <https://www.ametras.com>`_:

  * Bastian Günther <bastian.guenther@ametras.com>

Maintainers
~~~~~~~~~~~

This module is maintained by the OCA.

.. image:: https://odoo-community.org/logo.png
   :alt: Odoo Community Association
   :target: https://odoo-community.org

OCA, or the Odoo Community Association, is a nonprofit organization whose
mission is to support the collaborative development of Odoo features and
promote its widespread use.

This module is part of the `OCA/server-tools <https://github.com/OCA/server-tools/tree/16.0/proxy_trusted_hops>`_ project on GitHub.

You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.
