[BUG] The custom SERVER_HTTP config does not override the header because it is injected outside the reverse proxy location block.

What happened?

Version: 1.6.14

Template: usr/share/bunkerweb/core/reverseproxy/confs/server-http/reverse-proxy.conf

Current: proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Protocol $scheme;

Backend: Tandoor Recipes (Gunicorn)

Result: 400 Contradictory scheme headers

Workaround: proxy_set_header X-Forwarded-Protocol "";

How to reproduce?

I'm using BunkerWeb 1.6.14 as a reverse proxy in front of Tandoor Recipes (Gunicorn based).

After creating a standard reverse proxy site in the UI and pointing it to: http://10.10.140.3:80 all requests fail with: 400 Bad Request Contradictory scheme headers Tandoor logs show: Invalid request from ip=: Contradictory scheme headers I traced the issue to the generated reverse proxy configuration. The template file: /usr/share/bunkerweb/core/reverseproxy/confs/server-http/reverse-proxy.conf contains: Nginx Config proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Protocol $scheme; which generates: Nginx Config proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Protocol $scheme; inside the site reverse proxy configuration. Gunicorn appears to reject this combination and returns: Contradictory scheme headers I verified this by manually editing the generated configuration: /etc/nginx/tandoor.cba-home.de/server-http/reverse-proxy.conf and changing: Nginx Config proxy_set_header X-Forwarded-Protocol $scheme; to: Nginx Config proxy_set_header X-Forwarded-Protocol ""; Then reloading nginx: Shell nginx -s reload Immediately afterwards Tandoor starts working correctly and the "Contradictory scheme headers" errors disappear. I also tried to override the header using a custom SERVER_HTTP configuration: Nginx Config proxy_set_header X-Forwarded-Protocol ""; however this does not work because the custom configuration is injected outside the generated reverse proxy location block, while the generated reverse proxy configuration still contains: Nginx Config proxy_set_header X-Forwarded-Protocol $scheme; So the issue appears to originate from the reverse proxy template itself. Could this header either be removed, made configurable, or only sent when explicitly required? BunkerWeb version: 1.6.14 Backend: Tandoor Recipes Gunicorn

Configuration file(s) (yaml or .env)

Relevant log output

BunkerWeb version

1.6.14

What integration are you using?

Docker

Linux distribution (if applicable)

Debian 13.7

Removed private data

• I have removed all private data from the configuration file and the logs

Code of Conduct

• I agree to follow this project's Code of Conduct