Fix real IP: trust upstream forwardedHeaders in Traefik, use X-Forwarded-For[0]

app/main.py

@@ -67,10 +67,7 @@ logger = logging.getLogger("portal")
 templates = Jinja2Templates(directory="templates")
 
 def _get_real_ip(request) -> str:
-    """Return real client IP. NPM sets X-Real-IP to the actual client IP."""
-    real_ip = request.headers.get("x-real-ip", "").strip()
-    if real_ip:
-        return real_ip
+    """Real client IP from X-Forwarded-For (Traefik trusts NPM via trustedIPs)."""
     forwarded_for = request.headers.get("x-forwarded-for", "")
     if forwarded_for:
         return forwarded_for.split(",")[0].strip()
@@ -494,6 +491,7 @@ async def request_access(request: Request, db: Session = Depends(get_db)):
         f"{products_text}"
     )
 
+    log_event("ip_headers", xff=request.headers.get("x-forwarded-for","–"), xri=request.headers.get("x-real-ip","–"), client=str(request.client.host if request.client else "–"))
     ip  = _get_real_ip(request)
     geo = _get_geo(ip)
     geo_text = ""