Introduction
When Artifactory is deployed behind a reverse proxy like Nginx, all incoming client requests are forwarded through the proxy server. By default, Artifactory logs the IP address of the direct client connecting to it. In a reverse proxy setup, the direct client is Nginx, so Artifactory logs the Nginx server’s IP instead of the original client IP.
This can be problematic for auditing, monitoring, and security purposes, as administrators want to track the real source IPs of clients accessing Artifactory (e.g., curl, Jenkins, Docker, npm, etc.).
Resolution
To preserve the original client IP in Artifactory logs, the following steps were implemented:
-
Configure Nginx to pass the client IP
In the Nginx configuration (/etc/nginx/sites-available/default), the following headers were added under the location / block:
server {
listen 80;
server_name _;
location / {
proxy_pass http://ARTIFACTORY_PRIVATE_IP:8082;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $host;
proxy_http_version 1.1;
proxy_set_header Connection "";
}
}-
X-Real-IP: Passes the client’s real IP to Artifactory.
-
X-Forwarded-For: Maintains the chain of client IPs if multiple proxies are used.
-
X-Forwarded-Proto: Indicates the original protocol (HTTP/HTTPS).
-
Validate Nginx configuration
nginx -t # Test configuration
nginx -s reload # Reload Nginx
-
Verify
Use a test request from another server:
curl -v http://<nginx-IP>/artifactory/api/system/ping
-
Validate the artifactory request logs
$ARTIFACTORY_HOME/log/artifactory-request.log
Conclusion
By configuring Nginx to forward the original client IP through X-Real-IP and X-Forwarded-For headers and enabling Artifactory to recognize these headers, the problem of seeing the Nginx IP in Artifactory logs is resolved.
This approach ensures accurate tracking of client requests in Artifactory, improving auditability and security monitoring without affecting normal traffic flow.