fix(web): read the client address from the proxy end of forwarded headers

getRemoteIp took a trusted proxy's X-Real-IP first, otherwise the leftmost
X-Forwarded-For entry. A proxy that forwards a client-sent X-Real-IP
unchanged (Caddy, HAProxy) or appends to X-Forwarded-For leaves both values
to the client. X-Forwarded-For is now read from the right, skipping trusted
proxies. X-Real-IP is believed only when it agrees with that hop or stands
alone, and a disagreement falls back to the proxy's own address.

The documented Caddyfile and the docs reverse-proxy generator now overwrite
X-Real-IP with the address Caddy saw.

docs/content/docs/en/operations/reverse-proxy.mdx

@@ -38,7 +38,9 @@ and it just works:
 
 ```text title="Caddyfile"
 panel.example.com {
-    reverse_proxy 127.0.0.1:2053
+    reverse_proxy 127.0.0.1:2053 {
+        header_up X-Real-IP {remote_host}
+    }
 }
 ```
 

docs/content/docs/fa/operations/reverse-proxy.mdx

@@ -38,7 +38,9 @@ Caddy گواهی‌ها را برای شما دریافت و تمدید می‌
 
 ```text title="Caddyfile"
 panel.example.com {
-    reverse_proxy 127.0.0.1:2053
+    reverse_proxy 127.0.0.1:2053 {
+        header_up X-Real-IP {remote_host}
+    }
 }
 ```
 

docs/content/docs/ru/operations/reverse-proxy.mdx

@@ -39,7 +39,9 @@ Caddy получает и продлевает сертификаты за ва
 
 ```text title="Caddyfile"
 panel.example.com {
-    reverse_proxy 127.0.0.1:2053
+    reverse_proxy 127.0.0.1:2053 {
+        header_up X-Real-IP {remote_host}
+    }
 }
 ```
 

docs/content/docs/zh/operations/reverse-proxy.mdx

@@ -33,7 +33,9 @@ Caddy 会为你获取并续期证书——只需让 Caddyfile 指向面板，它
 
 ```text title="Caddyfile"
 panel.example.com {
-    reverse_proxy 127.0.0.1:2053
+    reverse_proxy 127.0.0.1:2053 {
+        header_up X-Real-IP {remote_host}
+    }
 }
 ```
 

docs/lib/xray/reverse-proxy.test.ts

@@ -31,6 +31,15 @@ describe('buildProxyConfig — caddy', () => {
     const cfg = buildProxyConfig({ ...base, server: 'caddy', panelPath: '/' });
     expect(cfg).toContain('reverse_proxy 127.0.0.1:2053');
   });
+
+  // Caddy forwards a client-sent X-Real-IP unchanged, and the panel's login
+  // limiter would key on it; only an overwrite gives the address Caddy saw.
+  it('overwrites X-Real-IP with the address Caddy saw', () => {
+    for (const panelPath of ['/', '/panel']) {
+      const cfg = buildProxyConfig({ ...base, server: 'caddy', panelPath });
+      expect(cfg).toContain('header_up X-Real-IP {remote_host}');
+    }
+  });
 });
 
 describe('buildCertCommand', () => {

docs/lib/xray/reverse-proxy.ts

@@ -49,14 +49,12 @@ function buildNginx(o: ReverseProxyOptions): string {
 
 function buildCaddy(o: ReverseProxyOptions): string {
   const path = normalizePath(o.panelPath);
-  if (path === '/') {
-    return `${o.domain} {
-    reverse_proxy 127.0.0.1:${o.panelPort}
-}`;
-  }
-  const matcher = `${path.replace(/\/$/, '')}/*`;
+  const matcher = path === '/' ? '' : `${path.replace(/\/$/, '')}/* `;
+  // Caddy forwards a client-sent X-Real-IP as is; the panel's login limiter reads it.
   return `${o.domain} {
-    reverse_proxy ${matcher} 127.0.0.1:${o.panelPort}
+    reverse_proxy ${matcher}127.0.0.1:${o.panelPort} {
+        header_up X-Real-IP {remote_host}
+    }
 }`;
 }