I cannot properly express my unending gratitude to whoever implemented `rootless_port_forwarder = "pasta"`
I can finally have a completely rootless container stack inside a custom podman network where the only ingress is through a reverse proxy container. The inability for my service containers to see the true source IP was literally the only thing holding me back from going rootless and it is finally HERE! 🎉
I simply added:
[network]
rootless_port_forwarder = "pasta"
into a drop-in conf file in /etc/containers/containers.conf.d and now my Nextcloud and Jellyfin can see where requests are actually coming from instead of my proxy container's internal IP. That means proper brute-force protection in Nextcloud and the ability to do IP banning.
I could not be happier with this setup. Huge thanks to the wonderful human beings who made this possible!