simplesaml virtualhost: set the real client ip address when behind a load balancer.

library/roles/simplesaml/templates/nginx-virthost.conf

@@ -28,6 +28,14 @@ server {
     include /etc/nginx/snippets/nginx-server-ssl.conf;
     server_tokens off;
     
+    {% if haproxy_ips is defined %}
+    # We are behind haproxy
+    {% for ip in haproxy_ips %}
+    set_real_ip_from {{ ip }};
+    {% endfor %}
+    real_ip_header X-Forwarded-For;
+    {% endif %}
+
     # Add headers to serve security related headers
     # Before enabling Strict-Transport-Security headers please read into this
     # topic first.