Add configurable real IP header variables for Apache and NGINX

[ps-20x]

Make real client IP header configurable for Apache and NGINX

Problem

The real client IP header is currently hardcoded to CF-Connecting-IP in both the Apache and NGINX configurations. This works well for deployments sitting directly behind Cloudflare, but users behind other reverse proxies (Traefik, AWS ALB, Kubernetes ingress, generic NGINX, etc.) have to either set DISABLE_DEFAULT_CONFIG, mount override files, or patch the shipped config in a derived image — just to change a single directive.

This is especially inconvenient because the rest of the default configuration is usually still desirable; only the header name needs to change.

Real-world example: I run a WordPress site on Hetzner with fpm-apache behind Traefik as a reverse proxy. Traefik forwards the client IP via X-Forwarded-For, but Apache never picks it up because the VHost templates hardcode CF-Connecting-IP. The result: WordPress shows the internal Docker network IP (e.g. 172.18.0.5) in password reset emails and WooCommerce order logs instead of the actual visitor IP. The only workaround was patching the templates in a derived image.

Changes

Apache — new environment variable APACHE_REMOTE_IP_HEADER (default: CF-Connecting-IP)

Replaces the hardcoded header name in:

• conf-available/remoteip.conf
• vhost-templates/http.conf
• vhost-templates/https.conf
• sites-available/ssl-full.conf

Uses Apache's native ${VAR} substitution at daemon startup — no init script changes needed.

NGINX — new environment variable NGINX_REAL_IP_HEADER (default: CF-Connecting-IP)

Converts the NGINX real IP config into a template:

• server-opts.d/remoteip.conf

Processed via the existing process_template / envsubst mechanism during container init.

Documentation — both variables are added to the environment variable specification reference page.

Backward Compatibility

Both variables default to CF-Connecting-IP. Existing deployments are completely unaffected — behavior only changes when a user explicitly sets a different value.

Usage

environment:
  APACHE_REMOTE_IP_HEADER: "X-Forwarded-For"
  # or for NGINX:
  NGINX_REAL_IP_HEADER: "X-Forwarded-For"

Note on Trusted Proxies

This PR only makes the header name configurable. The trusted proxy CIDR list remains unchanged. Users switching away from Cloudflare should review whether the trusted proxy configuration matches their infrastructure.

Scope

This PR is intentionally narrow: configurable header name, preserved defaults, no changes to trusted proxy semantics or existing user behavior.