[GH-ISSUE #3122] 使用proxy protocol caddy vaultwarden无法访问

gitea-mirror commented

2026-05-05 13:36:42 -06:00

Owner

Originally created by @swhoro on GitHub (Oct 9, 2022).
Original GitHub issue: https://github.com/fatedier/frp/issues/3122

Bug Description

frpc运行于openwrt上，caddy运行于群晖的docker中，vaultwarden也位于群晖的docker中
如果去掉proxy_protocol_version=v1可以正常访问
设置为v2也不可以正常访问

frpc Version

0.44.0

frps Version

0.44.0

System Architecture

linux/amd64

Configurations

frpc.ini:

[common]
server_addr=
server_port=
token=
log_level=info
log_max_days=3
protocol=kcp
log_file=/var/etc/frp/frpc.log
tcp_mux=true
tls_enable=false
login_fail_exit=false

[vw]
type=tcp
remote_port=9000
local_ip=192.168.1.4
local_port=4433
proxy_protocol_version=v1
use_encryption=true
use_compression=true

caddyfile:

vw.carriage.fun:443 {
  encode gzip
  tls /etc/caddy/ssl/7483023_***.pem /etc/caddy/ssl/7483023_***.key
  header / {
       # Enable HTTP Strict Transport Security (HSTS)
       Strict-Transport-Security "max-age=31536000;"
       # Enable cross-site filter (XSS) and tell browser to block detected attacks
       X-XSS-Protection "1; mode=block"
       # Disallow the site to be rendered within a frame (clickjacking protection)
       X-Frame-Options "DENY"
       # Prevent search engines from indexing (optional)
       X-Robots-Tag "none"
       # Server name removing
       -Server
   }

  # Notifications redirected to the websockets server
  reverse_proxy /notifications/hub 192.168.1.4:3012

  # Proxy the Root directory to Rocket
  reverse_proxy 192.168.1.4:8082 {
       # Send the true remote IP to Rocket, so that bitwarden_rs can put this in the
       # log, so that fail2ban can ban the correct IP.
       header_up X-Real-IP {remote_host}
  }
}

Logs

No response

Steps to reproduce

...

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @swhoro on GitHub (Oct 9, 2022). Original GitHub issue: https://github.com/fatedier/frp/issues/3122 ### Bug Description frpc运行于openwrt上，caddy运行于群晖的docker中，vaultwarden也位于群晖的docker中如果去掉proxy_protocol_version=v1可以正常访问设置为v2也不可以正常访问 ### frpc Version 0.44.0 ### frps Version 0.44.0 ### System Architecture linux/amd64 ### Configurations frpc.ini: ``` [common] server_addr= server_port= token= log_level=info log_max_days=3 protocol=kcp log_file=/var/etc/frp/frpc.log tcp_mux=true tls_enable=false login_fail_exit=false [vw] type=tcp remote_port=9000 local_ip=192.168.1.4 local_port=4433 proxy_protocol_version=v1 use_encryption=true use_compression=true ``` caddyfile: ``` vw.carriage.fun:443 { encode gzip tls /etc/caddy/ssl/7483023_***.pem /etc/caddy/ssl/7483023_***.key header / { # Enable HTTP Strict Transport Security (HSTS) Strict-Transport-Security "max-age=31536000;" # Enable cross-site filter (XSS) and tell browser to block detected attacks X-XSS-Protection "1; mode=block" # Disallow the site to be rendered within a frame (clickjacking protection) X-Frame-Options "DENY" # Prevent search engines from indexing (optional) X-Robots-Tag "none" # Server name removing -Server } # Notifications redirected to the websockets server reverse_proxy /notifications/hub 192.168.1.4:3012 # Proxy the Root directory to Rocket reverse_proxy 192.168.1.4:8082 { # Send the true remote IP to Rocket, so that bitwarden_rs can put this in the # log, so that fail2ban can ban the correct IP. header_up X-Real-IP {remote_host} } } ``` ### Logs _No response_ ### Steps to reproduce 1. 2. 3. ... ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [ ] Security - [ ] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror

2026-05-05 13:36:42 -06:00

closed this issue
added the
lifecycle/stale
label

gitea-mirror commented

2026-05-05 13:36:45 -06:00

Author

Owner

@Becods commented on GitHub (Oct 11, 2022):

https://pkg.go.dev/github.com/francislavoie/caddy2-proxyprotocol

proxy_protocol {
    timeout <duration>
    allow <IPs...>
}

Using nginx, nginx natively supports proxy_protocol.

@Becods commented on GitHub (Oct 11, 2022): https://pkg.go.dev/github.com/francislavoie/caddy2-proxyprotocol ``` proxy_protocol { timeout <duration> allow <IPs...> } ``` or Using nginx, nginx natively supports proxy_protocol.

gitea-mirror commented

2026-05-05 13:36:46 -06:00

Author

Owner

@github-actions[bot] commented on GitHub (Nov 11, 2022):

Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

@github-actions[bot] commented on GitHub (Nov 11, 2022): Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

gitea-mirror referenced this issue

2026-05-05 14:44:53 -06:00

[PR #2502] [CLOSED] Fix Chrome 92 ERROR_CONNECTION_RESET #4585