I'm running Jellyfin natively on a Mac Mini and Caddy inside an OrbStack container on the same Mac. Traffic comes from Cloudflare in DNS-only mode, through my router's port forwarding, into the Mac, then to Caddy and finally Jellyfin on localhost:8096. Caddy currently receives every connection with a source address of 127.0.0.1 or ::1, so it forwards localhost as X-Forwarded-For and Jellyfin-based tools cannot identify the actual remote users. The logs show the address is already rewritten before Caddy handles the request. Is there an OrbStack or macOS networking option that preserves the original client IP for published ports? Would host networking help, or are the practical solutions to run Caddy natively on macOS or use a Cloudflare Tunnel?
3 Answers
Running a separate Linux VM with its own carefully configured bridged or forwarded networking may offer more control, but ordinary port forwarding into a VM has the same fundamental issue unless the networking layer preserves the source address. For this setup, moving the reverse proxy onto macOS or using a tunnel is likely simpler than trying to modify the Caddyfile.
This is a limitation of the Linux VM and userland port-forwarding layer used by container runtimes on macOS. By the time the connection reaches the container, the original source address has already been replaced, so Caddy cannot recover it with header settings. Host networking generally does not fix traffic entering through the macOS-to-VM forwarding path either.
A native Caddy installation on macOS is the most direct way to preserve the client address, since the router will deliver the connection directly to the host network stack. A tunnel is another workable option, but it changes the traffic path and requires configuring the application to trust the tunnel’s forwarded identity headers. Changing X-Real-IP or X-Forwarded-For in the current setup cannot restore an address that was already removed by NAT.
That matches what I’m seeing: even when using host-style networking, the address is still lost before the request reaches the container.