fix: rate limiting X-Real-IP from the real peer

docs/deployment.md

@@ -100,7 +100,9 @@ With `ENVIRONMENT=production` the auth cookie is `Secure`, so **the site must be
 
 ```caddyfile
 cms.example.com {
-	reverse_proxy localhost:8080
+	reverse_proxy localhost:8080 {
+		header_up X-Real-IP {remote_host}
+	}
 }
 ```
 
@@ -117,7 +119,7 @@ server {
     location / {
         proxy_pass http://127.0.0.1:8080;
         proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 }
@@ -125,6 +127,8 @@ server {
 
 If RenewCMS runs on the same host as the proxy, consider firewalling port 8080.
 
+Either way, set `TRUSTED_PROXIES` (see [configuration.md](configuration.md)) to the proxy's own address as seen by RenewCMS, typically `127.0.0.1` when the proxy and RenewCMS share a host, so the login/password-reset rate limiter honors the forwarded client IP instead of the proxy's own address.
+
 ## Backups
 
 Everything worth backing up is under the data directory. Take a consistent SQLite copy while the service is running: