[Nginx][Web] Pass the client address to sogo-auth for EAS/DAV logins

data/conf/nginx/templates/nginx.conf.j2

@@ -47,6 +47,12 @@ http {
         default "";
     }
 
+    # client of an internal auth request, X-Real-IP is set by /sogo-auth-verify
+    map $server_port $sogo_auth_client_ip {
+        65510   $http_x_real_ip;
+        default "";
+    }
+
     {% if HTTP_REDIRECT %}
     # HTTP to HTTPS redirect
     server {

data/conf/nginx/templates/sites-default.conf.j2

@@ -119,6 +119,7 @@ location ~ \.php$ {
     fastcgi_param HTTP_X_REAL_IP $remote_addr;
     # trusted internal-auth marker; empty for external clients (see nginx.conf map)
     fastcgi_param SOGO_AUTH_INTERNAL $sogo_auth_internal;
+    fastcgi_param SOGO_AUTH_CLIENT_IP $sogo_auth_client_ip;
     fastcgi_read_timeout 3600;
     fastcgi_send_timeout 3600;
 }

data/web/sogo-auth.php

@@ -12,6 +12,11 @@ $session_var_pass = 'sogo-sso-pass';
 // external clients can never supply it (bare fastcgi param, not an HTTP header)
 $is_internal_auth = (($_SERVER['SOGO_AUTH_INTERNAL'] ?? '') === '1');
 
+// the loopback is no client: use the client of the original request for logs, netfilter and API IP checks
+if ($is_internal_auth && filter_var($_SERVER['SOGO_AUTH_CLIENT_IP'] ?? '', FILTER_VALIDATE_IP)) {
+  $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_REAL_IP'] = $_SERVER['SOGO_AUTH_CLIENT_IP'];
+}
+
 // validate credentials for basic auth requests
 if ($is_internal_auth && isset($_SERVER['PHP_AUTH_USER'])) {
   // load prerequisites only when required