✨ Add headers (#21)

Signed-off-by: Jacob Woffenden <jacob.woffenden@justice.gov.uk>
ministryofjustice · Nov 6, 2024 · d1c99e6 · d1c99e6
1 parent d996037
commit d1c99e6
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -1,7 +1,7 @@
 #checkov:skip=CKV_DOCKER_3: Current implementation uses off-the-shelf image from OpenResty which doesn't offer a nonroot variant
 
 # docker.io/openresty/openresty:1.25.3.2-alpine-fat
-FROM docker.io/openresty/openresty@sha256:aa8ea52fa35a296558aed8b392fb39d575e39dd4a7717fa44f1fd6fc09c1185d
+FROM docker.io/openresty/openresty@sha256:15270690cb6334dcf9513d679586acec92e14ce7aafb70d14f72b8d579394c7f
 
 LABEL org.opencontainers.image.vendor="Ministry of Justice" \
       org.opencontainers.image.authors="Analytical Platform (analytical-platform@digital.justice.gov.uk)" \

diff --git a/src/etc/nginx/nginx.conf.template b/src/etc/nginx/nginx.conf.template
@@ -229,9 +229,11 @@ http {
 
       # https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_set_header
       # Default is "Host $proxy_host" and "Connection close"
-      proxy_set_header Connection $connection_upgrade;
-      proxy_set_header Host       $host;
-      proxy_set_header Upgrade    $http_upgrade;
+      proxy_set_header Connection      $connection_upgrade;
+      proxy_set_header Host            $host;
+      proxy_set_header Upgrade         $http_upgrade;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Real-IP       $remote_addr;
 
       # https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout
       # Default is 60s