Tutorial

NGINX, Kong, or Envoy in front

xorappsec 1.0 is a reverse proxy, not an NGINX module. The supported pattern is edge → xorappsec → origin.

Internet NGINX / Kong / Envoy xorappsec :8080 Origin

NGINX

location / {
  proxy_set_header Host $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_pass http://xorappsec:8080;
}

On xorappsec:

trusted-proxies:
  - 10.0.0.0/8          # NGINX pod/node CIDR
XORAPPSEC_UPSTREAM=http://my-app:80

Kong

Create a Kong Service whose host is the xorappsec Service and a Route for the public hostname. xorappsec’s upstream is still the real app. If Kong sets X-Consumer-Username, add a source-identifier on that header to rate-limit per consumer.

Envoy / Istio

Cluster the xorappsec Service from the gateway. Same trusted-proxies rule: only the gateway hop may send XFF.

Do not publish xorappsec :9090 through the edge.