From 56df57252272f2c52d99107e0997b032df8a2c12 Mon Sep 17 00:00:00 2001 From: Mauricio Siu Date: Wed, 8 Jul 2026 01:24:58 -0600 Subject: [PATCH] fix: trust Dokploy's Traefik proxy via LOADBALANCER_IPS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Zulip 12 rejects requests forwarded by an untrusted reverse proxy with a 500 "Proxy-Misconfiguration: Incorrect reverse proxy IPs set in Zulip" error page. TRUST_GATEWAY_IP=True only whitelists the container's default-route gateway IP, but Dokploy's Traefik connects from its own container IP on the (dynamically-subnetted) compose network, so it was never trusted. Replace TRUST_GATEWAY_IP with LOADBALANCER_IPS covering the RFC1918 ranges, which Zulip feeds into nginx set_real_ip_from / its trusted proxy list, so Traefik is trusted regardless of which Docker subnet it connects from. Also align meta.json version with the shipped image tag (12.1-0). Note: the zulip-server image ships a HEALTHCHECK (/health, 300s start period) and first boot runs full migrations, so Traefik only exposes the router once the container turns healthy — expect several minutes of 404 on the domain right after the first deploy. Co-Authored-By: Claude Fable 5 --- blueprints/zulip/docker-compose.yml | 2 +- blueprints/zulip/meta.json | 2 +- blueprints/zulip/template.toml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/blueprints/zulip/docker-compose.yml b/blueprints/zulip/docker-compose.yml index bf9ec636..8a33cfc8 100644 --- a/blueprints/zulip/docker-compose.yml +++ b/blueprints/zulip/docker-compose.yml @@ -86,7 +86,7 @@ services: SETTING_RABBITMQ_HOST: rabbitmq SETTING_REDIS_HOST: redis CONFIG_application_server__http_only: "true" - TRUST_GATEWAY_IP: ${ZULIP_TRUST_GATEWAY_IP} + LOADBALANCER_IPS: ${ZULIP_LOADBALANCER_IPS} volumes: - zulipData:/data ulimits: diff --git a/blueprints/zulip/meta.json b/blueprints/zulip/meta.json index be96cd97..18b6a006 100644 --- a/blueprints/zulip/meta.json +++ b/blueprints/zulip/meta.json @@ -1,7 +1,7 @@ { "id": "zulip", "name": "Zulip", - "version": "12.0-1", + "version": "12.1-0", "description": "Open-source threaded team chat designed to keep team communication organized and productive.", "logo": "zulip.svg", "links": { diff --git a/blueprints/zulip/template.toml b/blueprints/zulip/template.toml index c10eebd6..821c66bd 100644 --- a/blueprints/zulip/template.toml +++ b/blueprints/zulip/template.toml @@ -11,7 +11,7 @@ env = [ "ZULIP_RABBITMQ_PASSWORD=${password:32}", "ZULIP_REDIS_PASSWORD=${password:32}", "ZULIP_SECRET_KEY=${password:64}", - "ZULIP_TRUST_GATEWAY_IP=True", + "ZULIP_LOADBALANCER_IPS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16", ] mounts = []