0

I've deployed a Matomo application using the official docker image. I'm trying to activate geolocalization (using a plugin) and it's not working.

I can see that Matomo (apache) only gets the docker container IP, instead of client's IP.

I can't figure out if the problem comes from a missing Docker config (yes, I'm a newbie) or from a missing Apache config.


Some network details

Testing it locally (same behavior as in production env) :

  1. IP address of external default-gateway : 192.168.253.254
  2. IP address of docker host (from ifconfig command) : 192.168.253.96 | docker0 172.17.0.1
  3. IP address of matomo container : 172.28.0.3

All visitor's IP are tracked as 172.28.0.1 (as far as I understand, locally it should be 127.0.0.1).

I was wondering if the problem could be related to the docker network config? Matomo app and it's DB are deployed using a same bridge network.

0

When you deploy something via a Docker-container, you have to keep in mind that it's (normally) not-directly-connected to the rest of the world (the Internet, in your case) and that such a connection (container <=> Internet) is mediated by the Docker-host (the PC hosting the docker environment and properly running your container) resulting in a chain that looks like:

<your container> <=> <docker host> <=> <Internet>

Actually, even if you haven't provided the details, I expect a real scenario like this:

<your container> <=> <docker host> <=> <your Internet router> <=> <Internet>

Note: this is what happens "commonly". Lots of edges can be tuned by properly configuring Docker networking parameters to adapt them to your needs. But in general, you can assume the above.

So, back to your case, as your container is receiving the HTTP request from the docker-host, this is exactly the reason why you see what you see (the HTTP request coming from the IP of your HOST, and not the one of the real source, on the Internet).

In technical terms, the docker-host is acting --with respect to your container-- as a (sort-of) REVERSE PROXY. In other words:

  1. the real source host send the request to your docker-host (to the public IP address associated to the external interface of your docker host);
  2. docker-host receive the request and...
  3. ...it "proxy" (actually: "forward") the request to your container.

The above is really common within so-called "cloud environment" and, as such, there are several ways to solve the visibility problem you're facing (knowing the real source IP of the HTTP request you're serving).

In your case, I'd suggest going through the official document to get un understanding about the whole concept and related countermeasures.

But...

...unfortunately the above is not strightly suited to your case as the docker-host is not strictly running a REVERSE-PROXY "server", but, instead, is acting as a PORT-FORWARDER router. Without entering into details (out of scope of this answer), the problem is that you DON'T have the place to properly configure the reverse-proxy actions you need.

So, in the end, you have only two options:

  1. change the docker configuration, asking the docker-host to logically connect your matomo container to the EXTERNAL network, exposing it exactly like any other host on your LAN. Afterwards, you only need to setup your external networking, sending the HTTP traffic to the container IP, and no more the docker-host IP. In other words, the scenario will be: <your container> <=> <your Internet router> <=> <Internet>

  2. on the docker-host, install a real REVERSE-PROXY (like NGINX) and configure it accordingly to matomo documentation mentioned above. In other words, the scenario will be: <your container> <=> <NGINX Reverse-proxy running on the docker host> <=> <your Internet router> <=> <Internet>

A final note: I've heavily oversimplified the above description and I'm well aware that is NOT 100% correct. But it should be enough to help you solving your problem :-)

3
  • Hello Damiano, thank you very much for using your time to give me such a complete answer. Actually, my problem is that I can't even get the host IP. I always get the docker container IP on each request. It's as if inside the container I can't get the outside information, and I can't figure out if this is a missing apache configuration or if I have to look on the docker side of the thing. Do you have an opinion? Thanks again!
    – Gigs
    Sep 25 at 16:16
  • Please, edit your original post, adding a section with the related networking details (you can obfuscate public IP addresses, if involved). I'm specifically interested in: 1) the IP address of your external default-gateway; 2) the IP address of your docker-host host, both the external one (connecting the host to the def-gw) and the internal lan (the docker-lan one); 3) the IP address of your matomo container. Also if your external LAN is "private", details regarding port-forwarding from def-gw to docker-host, could be useful as well. Sep 26 at 7:37
  • Hello Damiano ! I apologize for the delay, I was working on another project. I edited my answer with networking details. My answer is probably not exactly what you're expecting (I'm still learning about network and docker, so I'm not sure about what you're asking me, please tell me if I should provide you another details). Thanks again, I really appreciate your help.
    – Gigs
    Oct 4 at 9:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.