Repository: WeblateOrg/weblate

Issue:
Support `WEBLATE_IP_PROXY_OFFSET` Environment Variable in Container
### Describe the issue

There is no `WEBLATE_IP_PROXY_OFFSET` environment variable support to customize the [IP_PROXY_OFFSET](https://docs.weblate.org/en/latest/admin/config.html#std-setting-IP_PROXY_OFFSET) configuration.

### I already tried

- [X] I've read and searched [the documentation](https://docs.weblate.org/).
- [X] I've searched for similar issues in this repository.

### Steps to reproduce the behavior

1. Launch Weblate Container with `WEBLATE_IP_PROXY_OFFSET`.
2. Observe no change in behaviour


### Expected behavior

_No response_

### Screenshots

_No response_

### Exception traceback

_No response_

### Additional context

When running behind a AWS Application Loadbalancer (ALB) the only options [supported](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/x-forwarded-headers.html#x-forwarded-for) are to either "preserve", "extend" or "remove" the `X-Forwarded-For` header.

So to get the IP that has connected to the ALB passed to Weblate the "extend" option has to be used. This adds the IP to the **end** of any already existing data in `X-Forwarded-For` as seen in the example table in the [AWS docs](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/x-forwarded-headers.html#x-forwarded-for). 

This header can already contain arbitrary (malicious) content from clients connecting to the ALB. The Weblate container currently parses the _first_ address (`IP_PROXY_OFFSET` is set to `0`). This can lead to bogus address values and also generate "Enter a valid IPv4 or IPv6 address." exceptions from the Django core validator `validate_ipv46_address()`.

Therefor in our AWS setup I'd like to set `WEBLATE_IP_PROXY_OFFSET=-1`.

If making this configurable via environment variable is not desired I'd like to propose changing the default from `1` to `-1` to always use the last and (presumably) most trusted value.


Discussion:
Regarding changing the default to `-1`, MDN also recommends using the final value(s):

> If any trusted reverse proxies are between the client and server, the final `X-Forwarded-For IP` addresses (one for each trusted proxy) are trustworthy, as they were added by trusted proxies. 
> [...]
>  Conversely, leftmost (untrusted) values must only be used where there will be no negative impact from the possibility of using spoofed values. 

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#security_and_privacy_concerns
It needs to be added to https://github.com/WeblateOrg/weblate/blob/main/weblate/settings_docker.py, you are welcome to contribute this.
This issue seems to be a good fit for newbie contributors. You are welcome to contribute to Weblate! Don't hesitate to ask any questions you would have while implementing this.

You can learn about how to get started in our [contributors documentation](https://docs.weblate.org/en/latest/contributing/index.html).

Resolving patch:
diff --git a/weblate/settings_docker.py b/weblate/settings_docker.py
--- a/weblate/settings_docker.py
+++ b/weblate/settings_docker.py
@@ -1001,7 +1001,7 @@
 # Reverse proxy settings
 IP_PROXY_HEADER = get_env_str("WEBLATE_IP_PROXY_HEADER")
 IP_BEHIND_REVERSE_PROXY = bool(IP_PROXY_HEADER)
-IP_PROXY_OFFSET = -1
+IP_PROXY_OFFSET = get_env_int("WEBLATE_IP_PROXY_OFFSET", -1)
 
 # Sending HTML in mails
 EMAIL_SEND_HTML = True


Test patch: