使用本地託管的 Traefik 代理，我的 Authelia 的“trustedIP”應該是什麼

Question

我的家庭媒體伺服器有一個可用的 docker 堆疊，使用單一 docker compose 檔案：

version: "3"
secrets:
  authelia_jwt_secret:
    file: $SECRETS_PATH/authelia/jwt_secret
  authelia_session_secret:
    file: $SECRETS_PATH/authelia/session_secret
services:
  calibre-web:
    image: linuxserver/calibre-web:nightly
    container_name: calibre-web
    environment:
      - PUID=$PUID
      - PGID=$PGID
    labels:
      - traefik.enable=true
      - traefik.http.routers.calibre-https.rule=Host(`books.pointerstop.ca`)
      - traefik.http.routers.calibre-https.middlewares=authelia@file
      - traefik.http.routers.calibre-https.tls=true
      - traefik.http.routers.calibre-https.tls.certresolver=letsencrypt
    volumes:
      - /srv/calibre/config/calibre-web:/config
      - /srv/calibre/CalibreLibrary:/Calibre_Library up
    restart: unless-stopped
    depends_on:
      - calibre
    expose:
      - 8083
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    command:
    - --api.insecure=true
    - --providers.docker
    - --entrypoints.web.address=:80
    - --entrypoints.websecure.address=:443
    - --certificatesresolvers.letsencrypt.acme.email=${LE_EMAIL}
    - --certificatesresolvers.letsencrypt.acme.storage=/config/acme.json
    - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
    # - --certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
    - --log.filePath=/var/log/traefik.log
    - --log.level=DEBUG
    - --providers.file.directory=/dynamic_config/
    - --providers.file.watch=true

    ports:
      - 8080:8080
      - 80:80
      - 443:443
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik.rule=Host(`traefik.local`)
      ## Services - API
      - traefik.http.routers.traefik.service=api@internal
      ## Global redirect of EXTERNAL domains to HTTPS
      - traefik.http.routers.redirs.rule=hostregexp(`{host:.*pointerstop.ca}`)
      - traefik.http.routers.redirs.entrypoints=web
      - traefik.http.routers.redirs.middlewares=redirect-to-https@file
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/log/media-server:/var/log
      - ${CONFIG_PATH}/traefik:/config
      - ./dynamic_config:/dynamic_config

  # Authelia (Lite) - Self-Hosted Single Sign-On and Two-Factor Authentication
  authelia:
    container_name: authelia
    image: authelia/authelia:latest
    # image: authelia/authelia:4.21.0
    restart: always
    expose:
      - 9091
    volumes:
      - $CONFIG_PATH/authelia:/config
    environment:
      - TZ=${TIME_ZONE}
      - AUTHELIA_JWT_SECRET_FILE=/run/secrets/authelia_jwt_secret
      - AUTHELIA_SESSION_SECRET_FILE=/run/secrets/authelia_session_secret
    secrets:
      - authelia_jwt_secret
      - authelia_session_secret
    labels:
      - traefik.enable=true
      ## HTTP Routers
      - traefik.http.routers.authelia-rtr.entrypoints=websecure
      - traefik.http.routers.authelia-rtr.rule=Host(`auth.pointerstop.ca`)
      - traefik.http.routers.authelia-rtr.tls=true
      - traefik.http.routers.authelia-rtr.tls.certresolver=letsencrypt
      ## Middlewares
      - traefik.http.routers.authelia-rtr.middlewares=chain-authelia@file
      ## HTTP Services
      - traefik.http.services.authelia-media-server.loadbalancer.server.port=9091

現在，我想將代理程式拆分到一個單獨的堆疊中，以便我可以將我的業務域添加到第三個堆疊中，並讓所有內容都受到 Authelia 的保護。

所以，我創建了一個 docker 網絡proxy，一切都在使用該網絡，除了透過 Authelia 進行身份驗證後，一切都成功了https://books.pointerstop.ca/(Calibre-web) 想要再次進行身份驗證。

我知道我需要entrypoints.websecure.forwardedHeaders.trustedIPs在 Traefik 中進行設置，否則 Traefik 會刪除所有重要的標頭，但我無法弄清楚它們應該是什麼。由於所有內容都在同一個 docker 堆疊中，我根本不需要 trustIP。現在它們在不同的堆疊中，但在同一個網路上，我不明白發生了什麼變化。我嘗試設定trustedIPs=172.0.0.0/8覆蓋所有docker網路。*.pointerstop.ca是 的 CNAME pointerstop.ddns.net，以及唯一報告的 IPhttps://books.pointerstop.ca/login是我的外部 IP，但當單一堆疊設定中不需要它時，要求它似乎是錯誤的（並且它是動態分配的，使用起來很尷尬）。