Add trustip config option for Badger middleware (needed for Cloudflare Tunnel / local proxies) #309

New Issue

MrUnknownDE · 2026-04-05T17:05:49+02:00

MrUnknownDE commented

2026-04-05 17:05:49 +02:00

Originally created by @uwuceo on 1/28/2026

Describe the Bug

I'm running Pangolin behind a cloudflared container (Cloudflare Tunnel). Badger is not correctly extracting the real client IP — it uses the cloudflared container's Docker IP instead of the value in CF-Connecting-IP.

Root cause:

Pangolin generates the Badger middleware config in TraefikConfigManager.ts without a trustip option. This means only the default Cloudflare edge IPs are trusted. When using Cloudflare Tunnel, requests arrive from cloudflared's local Docker IP (e.g., 172.20.0.11), which isn't in the Cloudflare IP ranges — so CF-Connecting-IP is ignored.

My dynamic_config.yml has a separate Badger middleware with trustip: ["172.16.0.0/12"], but routes generated by Pangolin use badger@http (from the HTTP provider), not badger@file.
Debug output showing the issue (I added some debug logging):

DEBUG RemoteAddr: 172.20.0.11:45638
DEBUG isTrusted: false
DEBUG CF-Connecting-IP: x.x.x.x
DEBUG trustIP count: 22

The 22 trusted IPs are the default Cloudflare ranges from ips/ips.go, not my custom config.
Suggested fix:
Add a badger.trustip option to config.yml that gets passed through to the generated middleware in TraefikConfigManager.ts.

Environment

OS Type & Version: Debian 13
Pangolin Version: 1.15.1
Gerbil Version: 1.3.0
Traefik Version: 3.6.7
Newt Version: 1.9.0
Badger Version: 1.3.1

To Reproduce

Deploy Pangolin behind a Cloudflare Tunnel (cloudflared container in the same Docker network)
Access any Pangolin-managed resource through the tunnel
Check Traefik logs — Badger's isTrusted is false for requests because RemoteAddr is the cloudflared container's Docker IP (e.g., 172.20.0.11), not a Cloudflare edge IP
The real client IP in CF-Connecting-IP is ignored, and the Docker IP is used instead

Expected Behavior

Badger should trust the cloudflared container's IP and extract the real client IP from CF-Connecting-IP.

Adding a custom Badger middleware with trustip: ["172.16.0.0/12"] in dynamic_config.yml doesn't help because Pangolin-generated routes use badger@http, not badger@file.

*Originally created by @uwuceo on 1/28/2026* ### Describe the Bug I'm running Pangolin behind a cloudflared container (Cloudflare Tunnel). Badger is not correctly extracting the real client IP — it uses the cloudflared container's Docker IP instead of the value in `CF-Connecting-IP`. Root cause: Pangolin generates the Badger middleware config in `TraefikConfigManager.ts` without a `trustip` option. This means only the default Cloudflare edge IPs are trusted. When using Cloudflare Tunnel, requests arrive from cloudflared's local Docker IP (e.g., `172.20.0.11`), which isn't in the Cloudflare IP ranges — so `CF-Connecting-IP` is ignored. My `dynamic_config.yml` has a separate Badger middleware with `trustip: ["172.16.0.0/12"]`, but routes generated by Pangolin use `badger@http` (from the HTTP provider), not `badger@file`. Debug output showing the issue (I added some debug logging): ``` DEBUG RemoteAddr: 172.20.0.11:45638 DEBUG isTrusted: false DEBUG CF-Connecting-IP: x.x.x.x DEBUG trustIP count: 22 ``` The 22 trusted IPs are the default Cloudflare ranges from `ips/ips.go`, not my custom config. Suggested fix: Add a `badger.trustip` option to `config.yml` that gets passed through to the generated middleware in `TraefikConfigManager.ts`. ### Environment - OS Type & Version: Debian 13 - Pangolin Version: 1.15.1 - Gerbil Version: 1.3.0 - Traefik Version: 3.6.7 - Newt Version: 1.9.0 - Badger Version: 1.3.1 ### To Reproduce 1. Deploy Pangolin behind a Cloudflare Tunnel (cloudflared container in the same Docker network) 2. Access any Pangolin-managed resource through the tunnel 3. Check Traefik logs — Badger's isTrusted is false for requests because RemoteAddr is the cloudflared container's Docker IP (e.g., 172.20.0.11), not a Cloudflare edge IP 4. The real client IP in CF-Connecting-IP is ignored, and the Docker IP is used instead ### Expected Behavior Badger should trust the cloudflared container's IP and extract the real client IP from CF-Connecting-IP. Adding a custom Badger middleware with trustip: ["172.16.0.0/12"] in dynamic_config.yml doesn't help because Pangolin-generated routes use badger@http, not badger@file.

MrUnknownDE closed this issue

2026-04-05 17:05:49 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#309