Fix remote IP, fix title

docker/nginx.conf

@@ -22,12 +22,18 @@ server {
     }
 
     # Proxy the API to the Go backend running alongside nginx.
+    #
+    # X-Forwarded-For is set to $remote_addr (the peer nginx actually saw), NOT
+    # $proxy_add_x_forwarded_for. The latter appends to any client-supplied
+    # header, which would let a client spoof its own IP since the backend trusts
+    # the leftmost value. If you deploy behind another trusted proxy, switch to
+    # $proxy_add_x_forwarded_for and make the backend read the correct hop.
     location /api/ {
         proxy_pass http://${BACKEND_HOST}:${BACKEND_PORT};
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-For $remote_addr;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 }