gitlab-sshd: Make it possible to propagate correlation IDs to Workhorse when PROXY protocol enabled
When the PROXY protocol is enabled, the remote_ip is now the actual client IP instead of the machine that made the request. This is necessary to make the group IP allow listing to work over SSH. However, we have lost the ability to trace a gitlab-shell request through the system because Workhorse generates a new correlation_id for every internal API request made by gitlab-sshd.
We currently use Workhorse's trusted_cidrs_for_propagation config to allow the X-Request-Id to propagate instead of generating a new correlation_id (https://docs.gitlab.com/ee/development/workhorse/configuration.html#propagate-correlation-ids), but this relies on the remote_ip being in an internal IP.
We need some way to make it possible to ensure gitlab-sshd is a trusted requester. Some ideas:
- Pass along the HAProxy IP address somehow and use that in LabKit to verify the request.
- Use a shared secret/token/signature between
gitlab-shelland Workhorse. This removes the need to rely on IPs. - Use mutual TLS. If the peer certificate is signed properly, then trust it.