refactor: move technical/utility files into scripts/

2026-04-08 15:48:44 -07:00
parent ec7985cb1e
commit b42fcfd9a2
11 changed files with 0 additions and 0 deletions
@@ -0,0 +1,83 @@
+---
+created: '2026-04-08T22:26:44+00:00'
+id: 9d2a0957-c0ab-4777-af26-895740cf4a2c
+keywords:
+- proxy
+- cloudflare
+- searxng
+- ip
+- header
+- configuration
+- proxy_set_header
+- rate
+- logging
+- nginx
+- http_cf_connecting_ip
+- user
+- limiting
+- reverse
+- instance
+links: []
+modified: '2026-04-08T22:26:44+00:00'
+summary: Configuration guide for forwarding real user IPs to SearXNG through Cloudflare
+  Proxy using Nginx CF-Connecting-IP header.
+tags:
+- infrastructure
+- nginx
+- cloudflare
+- searxng
+- proxy
+- security
+title: Cloudflare Proxy and SearXNG IP Header Configuration
+---
+
+# Cloudflare Proxy and SearXNG IP Header Configuration
+
+## Problem
+
+The SearXNG instance behind Cloudflare Proxy only sees requests from the Cloudflare Proxy itself, not the actual IP address of the end user. This causes issues with rate limiting and logging functionality.
+
+## Solution
+
+Every request sent from Cloudflare Proxies includes a separate `CF-Connecting-IP` header containing the real user's IP address. By configuring your reverse proxy (Nginx) to forward this header to SearXNG, you can enable proper IP logging and rate limiting.
+
+## Nginx Configuration
+
+Add the following rules to your Nginx reverse proxy configuration:
+
+```nginx
+proxy_set_header Host $host;
+proxy_set_header Connection $http_connection;
+proxy_set_header X-Forwarded-For $http_cf_connecting_ip;
+proxy_set_header X-Real-IP $http_cf_connecting_ip;
+proxy_set_header X-Scheme $scheme;
+```
+
+## Expected Outcome
+
+- Real user IPs are forwarded to the SearXNG instance
+- IP logging functionality is restored
+- Rate limiting can be re-enabled
+- Should not encounter further rate limit issues
+
+## Additional Use Cases
+
+The `CF-Connecting-IP` header can be useful in other scenarios:
+- Deploying **Fail2Ban** or **CrowdSec** on login prompts
+- Services like **Vaultwarden Server** (some allow header configuration directly)
+- Other reverse proxy setups (Traefik, Caddy alternatives may exist)
+
+## Notes
+
+- SearXNG stores IPs encrypted, so direct verification of logging may not be possible
+- Rate limit issue resolution serves as practical confirmation (95% confidence it works as intended)
+- Alternative to completely disabling Cloudflare proxy (which was recommended but not ideal)
+
+## Related Users
+
+- @unixf0x - Original discovery and recommendation
+- @LincHayes - Also encountered this issue
+
+---
+
+*Source: Cloudflare Proxy SearXNG IP Header Configuration Discussion*