From e37ef82b2912167a20e93fa806e4f778df8b8ccc Mon Sep 17 00:00:00 2001
From: Grant Slater <github@firefishy.com>
Date: Thu, 15 Oct 2026 22:58:39 +0100
Subject: [PATCH] podman: drop X-Forwarded-For header received from client

---
 cookbooks/podman/templates/default/apache.erb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cookbooks/podman/templates/default/apache.erb b/cookbooks/podman/templates/default/apache.erb
index 92ca2f4c5..fcac61208 100644
--- a/cookbooks/podman/templates/default/apache.erb
+++ b/cookbooks/podman/templates/default/apache.erb
@@ -44,6 +44,9 @@
   SSLCertificateFile /etc/ssl/certs/<%= @name %>.pem
   SSLCertificateKeyFile /etc/ssl/private/<%= @name %>.key
 
+  # Discard any client-supplied X-Forwarded-For
+  RequestHeader unset X-Forwarded-For
+
   RequestHeader set X-Forwarded-Proto "https"
   RequestHeader set X-Forwarded-Port "443"
 
-- 
2.47.3