Selfhosted

Hi,

The client IP problem is a longstanding issue in podman's virtual bridge networks.

As a workaround I'd run HAProxy rootless, using the pasta networking mode as that one allows seeing native client IP. With pasta's -T flag (see docs) I'd forward traffic to another caddy container binding to 127.0.0.1:8080 or something similar.

This would coincide with your firewalld/HAProxy port-forwarding setup, but it has more rootlessness to it. It's still not perfect and you'd still need to tweak sysctls, but I hope it may be useful

You can use rootless caddy via systemd socket activation, here's a basic setup:

1. rootless-caddy.service

[Unit]
Description=rootless-caddy

Requires=rootless-caddy.socket
After=rootless-caddy.socket

[Service]
# a non root user here
User=El_Quentinator
ExecStart=podman run --name caddy --rm -v [...] docker.io/caddy:alpine

[Install]
WantedBy=default.target

2. rootless-caddy.socket

[Socket]
BindIPv6Only=both

### sockets for the HTTP reverse proxy
# fd/3
ListenStream=[::]:443

# fdgram/4
ListenDatagram=[::]:443

[Install]
WantedBy=sockets.target

3. Caddyfile

{$SITE_ADDRESS} {
        # tcp/443
        bind fd/3 {
                protocols h1 h2
        }
        # udp/443
        bind fdgram/4 {
                protocols h3
        }
        [...]
}

And that's it really.

You can find a few more examples over here: https://github.com/eriksjolund/podman-caddy-socket-activation

Systemd socket activation has a few more interesting advantages on top of unlocking binding priviliged ports:

• allowing to not bind any port on the container, which itself allows to use --network none while still being able to connect to it via systemd socket, pretty neat to expose some web app while completely cutting its own external access.
• getting rootful networking performance
• starting up your service only when connecting to it (and potentially shutting it back down after some time)

Drawbacks is that the file descriptor binding is a bit awkward and not always supported (caddy/nginx/haproxy do support it though). And that podman pods / kube do not support it (or at least not yet).

I found these: https://superuser.com/questions/710253/allow-non-root-process-to-bind-to-port-80-and-443

I'm not running your configuration so can't tell you with the assurance that I have it working but Forwarding ports with firewalld appears to address port forwarding to rootless podman using firewalld. If that doesn't work for you you might need to clarify what your firewalld configuration is that obscures the client IP. I wouldn't expect a simple port mapping to affect IP address.

Rootless podman caddy doesn't need those priviliged ports, if you have your server behind a firewall device. You can map your ports on the firewall/router 80:8080 and then on the caddy container 8080:80. This way there is no need for priviliged ports and the traffic seems to go on ports 80 (and 443 the same way).

@SinTan1729 Using privileged ports can be activated with a sysctl setting:
https://access.redhat.com/solutions/7044059

Why does it have to be a priviledged port?