edge: carry the real client address, and make X-Forwarded-For worth trusting

[Wnt]

Why

Every public visitor has been recorded as 127.0.0.1 for as long as the SNI split has existed. Measured downstream in kernel-hive on 2026-09-01 and again on 2026-09-21: the gallery's client log holds 36,746 rows with exactly two distinct values, both private.

The cause is not in the Go code. haproxy.cfg splits :443 in TCP mode and hands Caddy a loopback connection, so Caddy honestly recorded X-Forwarded-For: 127.0.0.1, and the forwarder — which filled the header only when empty — passed that on. Downstream, geography resolves nothing and rate limiting keys on a constant.

What changes

A TCP proxy cannot set a header, so the address travels ahead of the TLS handshake instead:

• haproxy.cfg — send-proxy-v2 on the caddy_https backend; option forwardfor on the :80 frontend, which is already in HTTP mode.
• Caddyfile / install.sh — a proxy_protocol listener wrapper, rendered only when HAProxy is in front. allow 127.0.0.1/32 is the trust boundary: only HAProxy on this box may assert an address. The tls wrapper stays last, because wrappers run in order and the PROXY header precedes the handshake.
• proxy.go — the forwarder stops passing on what arrived.

The trust half

Caddy appends to whatever the client sent, so a non-empty header is <the caller's invention>, <what Caddy saw>. A downstream reader taking the first hop — the conventional choice, and what kernel-hive did — was reading the caller.

realIP now takes the last entry, and only when the peer is loopback; a non-loopback peer means the request did not come through Caddy, so the header carries no weight at all. setForwardingHeaders overwrites rather than filling, so downstream receives a single value written by a hop that could see the connection.

internal/server/realip_test.go pins that boundary, including the spoof-through-Caddy and direct-caller cases.

Paired change

kernel-hive enforces the same boundary on the reading side (scripts/serve/clientip.py): believe the header only from a loopback peer, take the last entry. Landing that first is harmless — it is strictly more conservative than today's behaviour.

Note

Opened as a PR rather than pushed to main because a push to main auto-deploys to the edge, and there is no Go toolchain on either box here — CI is the first place this compiles. Merge once build is green.