From e3a4ea3bed2bc087416c41d5fe5d6104c0b9ec5b Mon Sep 17 00:00:00 2001
From: RobHooper <robh@linux.com>
Date: Fri, 5 Dec 2025 12:55:15 +0000
Subject: [PATCH 1/3] feat: fix logging behind cloudflare proxy

---
 salt/apache/cloudflare.sls | 18 ++++++++++++++++++
 salt/apache/init.sls       |  3 +++
 salt/top.sls               |  2 ++
 3 files changed, 23 insertions(+)
 create mode 100644 salt/apache/cloudflare.sls

diff --git a/salt/apache/cloudflare.sls b/salt/apache/cloudflare.sls
new file mode 100644
index 000000000..9f6dc65a1
--- /dev/null
+++ b/salt/apache/cloudflare.sls
@@ -0,0 +1,18 @@
+include:
+  - apache
+  - apache.modules.remoteip
+
+/etc/apache2/conf-enabled/zz-cloudflare-proxy.conf:
+  file.managed:
+    - contents: |
+        RemoteIPHeader CF-Connecting-IP
+{%- for ip in salt.cmd.run('curl -sS https://www.cloudflare.com/ips-v4/').split() %}
+        RemoteIPTrustedProxy {{ ip }}
+{%- endfor %}
+{%- for ip in salt.cmd.run('curl -sS https://www.cloudflare.com/ips-v6/').split() %}
+        RemoteIPTrustedProxy {{ ip }}
+{%- endfor %}
+    - require:
+      - pkg: apache2
+    - watch_in:
+      - module: apache2-reload
diff --git a/salt/apache/init.sls b/salt/apache/init.sls
index 1bfd778f6..50a316d1b 100644
--- a/salt/apache/init.sls
+++ b/salt/apache/init.sls
@@ -92,6 +92,7 @@ disable site 000-default.conf:
 #
 # - Do not disclose the Apache version, to avoid false positives about CVE patching.
 # - Do not log uptime monitoring remote requests and Netdata's mod_status requests, to reduce log noise.
+# - Update LogFormat to use client ip (%a), this allows us to record the client IP through a proxy.
 #
 # https://httpd.apache.org/docs/2.4/logs.html#conditional
 /etc/apache2/conf-available/zz-customization.conf:
@@ -102,6 +103,8 @@ disable site 000-default.conf:
         SetEnvIf User-Agent AppBeat dontlog
         SetEnvIf User-Agent Pingdom.com_bot dontlog
         SetEnvIf Request_URI "^/server-status$" dontlog
+        LogFormat "%v:%p %a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
+        LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
         CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log vhost_combined env=!dontlog
         {{ salt['pillar.get']('apache:customization','') | indent(8) }}
     - require:
diff --git a/salt/top.sls b/salt/top.sls
index 9a320b318..6c974358f 100644
--- a/salt/top.sls
+++ b/salt/top.sls
@@ -75,6 +75,8 @@ base:
     - apache.modules.headers
     # Enable HTTPS redirects on the default site.
     - apache.modules.rewrite
+    # Cloudflare Proxy
+    - apache.cloudflare
 
   # All public web servers should use SSL certificates.
   'I@nginx:public_access:true':

From 44a553cc429d2e4bdba3b8bf0e8c435037e146aa Mon Sep 17 00:00:00 2001
From: James McKinney <26463+jpmckinney@users.noreply.github.com>
Date: Sun, 7 Dec 2025 01:33:58 -0500
Subject: [PATCH 2/3] docs: Update Cloudflare comments

---
 salt/apache/cloudflare.sls | 1 +
 salt/apache/init.sls       | 2 +-
 salt/top.sls               | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/salt/apache/cloudflare.sls b/salt/apache/cloudflare.sls
index 9f6dc65a1..c32ad10e6 100644
--- a/salt/apache/cloudflare.sls
+++ b/salt/apache/cloudflare.sls
@@ -1,3 +1,4 @@
+# https://developers.cloudflare.com/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/
 include:
   - apache
   - apache.modules.remoteip
diff --git a/salt/apache/init.sls b/salt/apache/init.sls
index 50a316d1b..edc72ce00 100644
--- a/salt/apache/init.sls
+++ b/salt/apache/init.sls
@@ -92,7 +92,7 @@ disable site 000-default.conf:
 #
 # - Do not disclose the Apache version, to avoid false positives about CVE patching.
 # - Do not log uptime monitoring remote requests and Netdata's mod_status requests, to reduce log noise.
-# - Update LogFormat to use client ip (%a), this allows us to record the client IP through a proxy.
+# - Restore original visitor IPs in logs when using a proxy. (%a behaves like the default %h if mod_remoteip isn't configured.)
 #
 # https://httpd.apache.org/docs/2.4/logs.html#conditional
 /etc/apache2/conf-available/zz-customization.conf:
diff --git a/salt/top.sls b/salt/top.sls
index 6c974358f..6c0a39b89 100644
--- a/salt/top.sls
+++ b/salt/top.sls
@@ -75,7 +75,7 @@ base:
     - apache.modules.headers
     # Enable HTTPS redirects on the default site.
     - apache.modules.rewrite
-    # Cloudflare Proxy
+    # Restore original visitor IPs in logs.
     - apache.cloudflare
 
   # All public web servers should use SSL certificates.

From 39fe705163fa4e6150b62e82d2e4211627298beb Mon Sep 17 00:00:00 2001
From: James McKinney <26463+jpmckinney@users.noreply.github.com>
Date: Sun, 7 Dec 2025 01:38:06 -0500
Subject: [PATCH 3/3] apache: Write to conf-available and use
 apache_conf.enabled

---
 salt/apache/cloudflare.sls | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/salt/apache/cloudflare.sls b/salt/apache/cloudflare.sls
index c32ad10e6..dcde1923f 100644
--- a/salt/apache/cloudflare.sls
+++ b/salt/apache/cloudflare.sls
@@ -3,7 +3,7 @@ include:
   - apache
   - apache.modules.remoteip
 
-/etc/apache2/conf-enabled/zz-cloudflare-proxy.conf:
+/etc/apache2/conf-available/zz-cloudflare-proxy.conf:
   file.managed:
     - contents: |
         RemoteIPHeader CF-Connecting-IP
@@ -17,3 +17,11 @@ include:
       - pkg: apache2
     - watch_in:
       - module: apache2-reload
+
+enable-conf-zz-cloudflare-proxy.conf:
+  apache_conf.enabled:
+    - name: zz-cloudflare-proxy
+    - require:
+      - file: /etc/apache2/conf-available/zz-cloudflare-proxy.conf
+    - watch_in:
+      - module: apache2-reload