Update Nginx configuration for improved real IP handling and cache bypass settings

Author: mbuechner

config/nginx/nginx.conf

@@ -121,7 +121,7 @@ http {
                                 text/x-component
                                 text/x-cross-domain-policy;
 
-    real_ip_header              X-Real-IP;
+    real_ip_header              X-Forwarded-For;
     real_ip_recursive           on;
 
     set_real_ip_from            127.0.0.1;
@@ -135,9 +135,14 @@ http {
     limit_req_status            429;
     limit_conn_status           429;
 
-    limit_req_zone              $binary_remote_addr zone=drupal_rps:20m rate=20r/s;
-    limit_req_zone              $binary_remote_addr zone=drupal_heavy:20m rate=3r/s;
-    limit_conn_zone             $binary_remote_addr zone=perip_conn:20m;
+    map $http_x_forwarded_for $limit_client_ip {
+        default                 $remote_addr;
+        ~^(?<first>[^,\s]+)    $first;
+    }
+
+    limit_req_zone              $limit_client_ip zone=drupal_rps:20m rate=20r/s;
+    limit_req_zone              $limit_client_ip zone=drupal_heavy:20m rate=3r/s;
+    limit_conn_zone             $limit_client_ip zone=perip_conn:20m;
 
     fastcgi_cache_path          /var/cache/nginx/fastcgi_cache levels=1:2 keys_zone=drupal_microcache:50m inactive=60m max_size=500m;
 

config/nginx/preset.conf

@@ -109,8 +109,8 @@ location @drupal {
     fastcgi_cache_key       "$scheme$request_method$host$request_uri";
     fastcgi_cache_valid     200 301 302 10s;
     fastcgi_cache_valid     404 1s;
-    fastcgi_cache_bypass    $drupal_cache_bypass_method $drupal_cache_bypass_cookie $http_authorization $query_string;
-    fastcgi_no_cache        $drupal_cache_bypass_method $drupal_cache_bypass_cookie $http_authorization $query_string;
+    fastcgi_cache_bypass    $drupal_cache_bypass_method $drupal_cache_bypass_cookie $http_authorization;
+    fastcgi_no_cache        $drupal_cache_bypass_method $drupal_cache_bypass_cookie $http_authorization;
     add_header              X-Cache $upstream_cache_status always;
 
     include fastcgi.conf;
@@ -147,8 +147,8 @@ location = /index.php {
     fastcgi_cache_key       "$scheme$request_method$host$request_uri";
     fastcgi_cache_valid     200 301 302 10s;
     fastcgi_cache_valid     404 1s;
-    fastcgi_cache_bypass    $drupal_cache_bypass_method $drupal_cache_bypass_cookie $http_authorization $query_string;
-    fastcgi_no_cache        $drupal_cache_bypass_method $drupal_cache_bypass_cookie $http_authorization $query_string;
+    fastcgi_cache_bypass    $drupal_cache_bypass_method $drupal_cache_bypass_cookie $http_authorization;
+    fastcgi_no_cache        $drupal_cache_bypass_method $drupal_cache_bypass_cookie $http_authorization;
     add_header              X-Cache $upstream_cache_status always;
 
     fastcgi_pass php;