Is it possible to use set_real_ip_from n a dynamic fashion based on request parameters?

Projects NGINX
, ,
1

nginx version: 1.28.1

I need to deploy an nginx configuration in a situation where we may have some requests coming in from remote proxies that we trust to give us real IP information for actual end users that we want to preserve.

Here’s the gist of what I want to do:

## http context
# check the friendship-is-magic header for a legitimate value
map $http_friendship_is_magic $trusted_proxy {
  default false;
  magic-swordfish true;
}
map $trusted_proxy $real_ip_from_source {
  default 192.168.0.0/16;
  true ::/0; # or 0.0.0.0/0, same result
}

set_real_ip_from $real_ip_from_source;
real_ip_recursive on;
real_ip_header x-forwarded-for;

This gives me the error:

nginx: [emerg] host not found in set_real_ip_from "$real_ip_from_source" in […file…]

The only other thing I could think of to try was:

## http context
# check the friendship-is-magic header for a legitimate value
map $http_friendship_is_magic $trusted_proxy {
  default false;
  magic-swordfish true;
}
map $trusted_proxy $real_ip_from_source {
  default 192.168.0.0/16;
  true [::]/0;
}

## server / location context
if ($trusted_proxy) {
  set_real_ip_from 0.0.0.0/0;
  set_real_ip_from ::/0;
  real_ip_recursive on;
  real_ip_header X-Forwarded-For;
}

yes, even though if is evil

but nginx rejected this:

nginx: [emerg] "set_real_ip_from" directive is not allowed here in […file…]

Is there any way to get what I want done, or am I completely out of luck here?