feat(nextcloud): Get real client IP from proxies and show X-Real-IP in Nextcloud logs

[JulesTriomphe]

This PR enables getting the clients' real IP addresses in Nextcloud when Nginx is itself behind a proxy, e.g. Cloudflare.

[stavros-k]

I'm wondering if we should just add an include directive in the nginx config and let users provide their own configurations.
It will become cumbersome to maintain/update the list of IPs and I imagine if this gets in,
that a lot of such customization will be requested/added afterwards, which then each will need it's own set of options.

What do you think?

[JulesTriomphe]

That would be ideal. I would leave default Cloudflare configuration however since it's used by many users.

To reduce the maintenance burden, we can generate the Cloudflare IPs on pod startup.

So we could do something like this:

• Have an option in questions.yaml to include custom configuration. This would make visible an option to mount an extra volume at /etc/nginx/includes/
• Add an include statement below the location / block, in the server.http section like include /etc/nginx/includes/*.conf if the custom configuration option is selected
• Have an option in questions.yaml to set real IPs from Cloudflare, which would activate (i.e. mount) the script in /docker-entrypoint.d/. This script would generate the list of Cloudflare IPs with set_real_ip_from directives in a /etc/nginx/includes/10-set-real-ip-from-cloudflare.conf file and would end with real_ip_header CF-Connecting-IP following the docs
• Keep the apache2 config change as this helps in any case

The 10-... prefix will allow users to create configs that will be evaluated before the cloudflare one, since they are evaluated alphabetically.

What do you think ?

[stavros-k]

I'm not sure I want having such scripts (eg for updating CF ips).

---

I think nginx will ingore includes if there are not files matched. So we can add it unconditionally, then present a storage option in the UI for nginx confs.

As for the apache log formats, what is the default/current format?
What happens if x-real-ip is empty?