Add configurable IP forward header for Varnish purge ACL

[Copilot]

Adds backend configuration for specifying which HTTP header (e.g., X-Forwarded-For, X-Real-IP) to use when checking purge request authorization against the ACL.

Changes

Configuration

• Added ip_forward_header field in admin panel (defaults to X-Forwarded-For)
• Added getIpForwardHeader() method to Model/Config.php

VCL Template
Updated purge ACL checks to use configurable header with first-IP extraction:

# Before
if (client.ip ~ purge) {

# After  
if (std.ip(regsub(req.http.{{var ip_forward_header}}, "^([^,]+),?.*$", "\1"), client.ip) ~ purge) {

The regsub() extracts the first IP from comma-separated lists (common when requests traverse multiple proxies), falling back to client.ip if header is absent or unparseable.

Testing

• Added ip_forward_header.vtc test case
• Updated test parser with default value

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add backend field for IP Forward Header</issue_title>
<issue_description>For example X-Forwarded-For or X-Real-IP.

X-Forwarded-For should be the default.

And update the VCL to use that var instead of if (client.ip ~ purge) { in vcl_recv;

if (std.ip({{var ip_forwarded_header}}, client.ip) ~ purge) {

</issue_description>

<agent_instructions>The field should be added in etc/adminhtml/system.xml

With the default setting in etc/config.xml

The etc/varnish6.vcl should then be updated with the change mentioned in the issue.

The Model/Config.php should have a method for it, like already exists for the sslOffloadedHeader.

It should be added to the Console/Command/GenerateVclCommand.php file, like sslOffloadedHeader is.

It should also be added to Model/Varnish/VCLGenerator.php.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Add backend field for IP Forward Header #113

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[peterjaap]

@toonvd did it get it right in one go?!

I got mad prompt engineering skills.

[toonvd]

export SERVER1_IP="10.0.0.1"

[toonvd]

should not be set as SERVER1_IP overrides it

[toonvd]

@peterjaap looks good, I have to add that this can be solved without a regex with Varnish in proxy mode.
https://info.varnish-software.com/blog/failure-to-purge-a-story-about-client.ip-and-proxies

[peterjaap]

@peterjaap looks good, I have to add that this can be solved without a regex with Varnish in proxy mode. https://info.varnish-software.com/blog/failure-to-purge-a-story-about-client.ip-and-proxies

Huh, just noticed Guillaime also uses the 0.0.0.0 as a fallback there?

[toonvd]

In Belgium we say, if Guillaume jumps from a bridge... :3

[tdgroot]

I like this change. @toonvd is right, but I think this is also a good option to have.