real external ip in php message container log

[revers59]

I use the last build docnker image nginx.

Are there a way to receive the real ip in log for php error ?
I see client:172.20.0.9 what i want is the real ip not the docker one

[error] 51#51: *1 FastCGI sent in stderr: "PHP message: user admin authentication failure for Baikal" while reading response header from upstream, client: 172.20.0.9, server: _, request: "POST /admin/ HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm.sock:", host: "dav.[redacted].com", referrer: "https://dav.[redacted].com/admin/"

172.20.0.9 is the docker ip of my traefik docker
the goal is to intercept this error log message for crowdsec.

I can see real ip on POST message log but not for php

example I can see that real ip in container log when POST ( not the docker one ) :

[06/Aug/2025:09:07:46 +0200] "POST /admin/ HTTP/1.1" 200 2401 "https://dav.[redacted].com/admin/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" "156.146.xx.xxx"

I use traefik v3 and i set my docker range in my entrypoint

`entryPoints:

Not used in apps, but redirect everything from HTTP to HTTPS

http:
address: ":80"
proxyProtocol:
trustedIPs:
- "172.20.0.0/16"
forwardedHeaders:
trustedIPs:
- "172.20.0.0/16"
http:
redirections:
entryPoint:
to: https
scheme: http`

[revers59]

All work with the whoami docker image of traefik.
traefik send
X-Forwarded-For
and
X-Forwarded-For
with the good external ip.

What I do :
I change my baikal docker image from nginx to apache for test.

activate remoteip mode

a2enmod remoteip

#edit the conf of remoteip
create /etc/apache2/conf-available/remoteip.conf
in /etc/apache2/conf-available/remoteip.conf add:

RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxy [ip of my traefik]

]

we load the newly created config

a2enconf remoteip

we restart Apache so everything is taken into account

service apache2 restart

Now I have the good external ip in my log

improvement of the docker image

One improvement for the Docker image would be to provide this feature automatically with a variable that lets you specify the IP of our reverse proxy. I see quite a few Unraid users, for example, downloading this image, and it would be useful to have the real IP addresses of the people connecting to the Baikal interface in the origin logs.
Example, for crowdsec.
Since this is a domain I'm not very familiar with, I'll let the experts weigh in. :)

[onlynow2]

I'm using the nginx image of baikal.
To get the real IPs in my logs I mounted a real_ip.conf - file into the container to extended nginx.conf

For this to work, nginx needs to include every *.conf file within /conf.d - directory, which is the case here, as the following statement is part of nginx.conf: include /etc/nginx/conf.d/*.conf;

# docker-compose.yml
volumes:
   - ./real_ip.conf:/etc/nginx/conf.d/real_ip.conf:ro

# real_ip.conf
set_real_ip_from 172.16.0.0/12; # whatever IP your reverse proxy has
real_ip_header X-Forwarded-For;
real_ip_recursive on;