tuwunel_core/config/ip_source.rs
1//! Defines sources for trusted client IP extraction.
2//!
3//! [`IpSource`] enumerates the TCP peer address and supported forwarding
4//! headers. The default uses the TCP peer address without trusting a proxy.
5
6use serde::Deserialize;
7
8/// Selects the source used to determine the connecting client's IP
9/// address.
10#[derive(Clone, Copy, Debug, Default, Deserialize, Eq, PartialEq)]
11#[serde(rename_all = "snake_case")]
12pub enum IpSource {
13 /// TCP peer address. Safe default; no proxy required.
14 #[default]
15 ConnectInfo,
16
17 /// Rightmost value of `X-Forwarded-For`.
18 RightmostXForwardedFor,
19
20 /// Rightmost value of RFC 7239 `Forwarded`.
21 RightmostForwarded,
22
23 /// `X-Real-IP` header (nginx).
24 XRealIp,
25
26 /// `CF-Connecting-IP` (Cloudflare / cloudflared).
27 CfConnectingIp,
28
29 /// `True-Client-IP` (Akamai, Cloudflare Enterprise).
30 TrueClientIp,
31
32 /// `Fly-Client-IP` (Fly.io).
33 FlyClientIp,
34
35 /// `CloudFront-Viewer-Address` (AWS CloudFront).
36 #[serde(rename = "cloudfront_viewer_address")]
37 CloudFrontViewerAddress,
38}