[nathanklick]

Fixes #57.

What this changes

The image never enabled mod_remoteip. It ships in the base image, but nothing links it into mods-enabled and no RemoteIP* directive is shipped, so Apache attributes every request to the TCP peer — %h, %a and REMOTE_ADDR are all the proxy. X-Forwarded-For arrives and is never consulted, and AllowOverride None on the document root leaves no way to correct it from outside the image.

This adds a remote-ip.conf following the global-server-name.conf idiom already in this image: ship the conf, enable it at boot only when configured.

variable	meaning
HTTPD_GLOBAL_REMOTE_IP_HEADER	header carrying the client address; defaults to X-Forwarded-For
HTTPD_GLOBAL_REMOTE_IP_INTERNAL_PROXY	peers trusted to set it, excluded from client selection
HTTPD_GLOBAL_REMOTE_IP_TRUSTED_PROXY	peers trusted to set it

Whichever proxy directive is configured gets uncommented, then a2enmod remoteip and a2enconf remote-ip.

Why there is no on/off flag

Presence of a proxy variable is deliberately the enabling condition. A separate flag would permit the one configuration that must not exist: the module active with no declared trusted peers. mod_remoteip trusting every peer lets any client set its own apparent address through the header — that turns a logging gap into a spoofing primitive, strictly worse than the status quo. Making the trust list the enabling condition removes that state structurally rather than by documentation.

Backward compatibility

Leaving the variables unset leaves the module unlinked from mods-enabled, exactly as today. The default is off.

Verification

Against the published 0.4.2 image with these files overlaid:

case	%h logged
no variables set (default)	peer address	unchanged; module not in mods-enabled
INTERNAL_PROXY covers peer, X-Forwarded-For: 203.0.113.10	203.0.113.10
TRUSTED_PROXY covers peer, HEADER=CF-Connecting-IP	198.51.100.5	correct directive uncommented, other left commented
INTERNAL_PROXY does not cover peer, spoofed header	peer address	header correctly ignored

apache2ctl configtest reports Syntax OK with the module enabled. shellcheck on both scripts reports nothing beyond the pre-existing SC1091 for the logger.sh source.

Note the full image build could not be exercised locally — repro-sources-list.sh plus the pinned snapshot repos fail to resolve here. That is pre-existing and unrelated to this change; CI builds it. The overlay approach is the same one used to verify #54 and #56.

Side effect worth recording

mod_remoteip consumes the header it reads. mod_auth_openidc hashes the left-most X-Forwarded-For value into the OIDC state (oidc_get_browser_state_hash, with OIDCStateInputHeaders defaulting to user-agent plus x-forwarded-for), so enabling this drops that component from the hash. A flow whose X-Forwarded-For differs between the authorization request and the callback now completes, where it previously failed with calculated state from cookie does not match state parameter passed back in URL.

That is a real fix for deployments behind a CDN, where the proxy address varies per request, but it is a side effect rather than the intent. Deployments wanting the fingerprint pinned deliberately should set OIDCStateInputHeaders, which this image does not yet expose.