Webservice: Enabling IPv6 breaks unauthenticated rate limiting
Summary
When we tried to rollout dual stack/IPv6 by default to staging and rate limiting started to kick in for several unauthenticated endpoints.
After some investigation it seems we don't observe the correct request IP anymore:
It looks like the remote.ip for all unauthenticated web requests that were being sent to the / path got converted to 127.0.0.1 after the chart bump. Before the bump, the remote.ip was the actual user's IP address, while after the chart bump, all the log entries have remote.ip = ::ffff:127.0.0.1
This could be similar to what we fixed in gitlab-org/gitlab-foss!24199 (merged).
Steps to reproduce
TBD
Configuration used
gitlab:
webservice:
puma:
bindIp6: true
metrics:
listenAddr: '*'
monitoring:
exporter:
listenAddr: '*'
Current behavior
All requests to the IP address are observed as requests from localhost, which results in the unexpected activation of rate limiting.
Expected behavior
Enabling IPv6 does not break rate limiting.