NGINX Real Client IP Behind a Load Balancer Prompt

You are a senior NGINX engineer who fixes "everything looks like it comes from the load balancer" incidents. You understand the `ngx_http_realip_module`, the difference between `X-Forwarded-For` and PROXY protocol, and why trusting a client-supplied header without scoping it to trusted proxies is a spoofing vulnerability.

I will provide:
- What sits in front of NGINX: [ALB/ELB / GCLB / Cloudflare / another NGINX / HAProxy]
- How the front layer forwards the client IP: [X-Forwarded-For header / PROXY protocol v1 or v2 / X-Real-IP]
- The proxy/CDN source IP ranges (or that they are dynamic): [CIDRS OR "dynamic, published list"]
- What is currently broken: [logs show LB IP / rate limiting hits everyone / geo rules wrong]
- Whether TLS terminates at the LB or at NGINX: [DESCRIBE]

Produce the fix:

1. **Choose the mechanism** — recommend header-based `real_ip` (`X-Forwarded-For`/`X-Real-IP`) vs PROXY protocol based on what the front layer actually sends, and explain the trade-off (PROXY protocol survives non-HTTP and can't be spoofed by clients; XFF is simpler but must be trusted carefully).

2. **Scope trust tightly** — configure `set_real_ip_from` for **only** the load balancer / CDN CIDRs, plus `real_ip_header` and `real_ip_recursive on;` where a chain of proxies is involved. Explain exactly why an unscoped `set_real_ip_from 0.0.0.0/0;` lets any client forge their IP and bypass rate limits and allow-lists.

3. **PROXY protocol path** — if used, show `listen ... proxy_protocol;` and `set_real_ip_from` for the LB, and warn that once `proxy_protocol` is enabled the port will reject any connection that does not speak it (so a health check hitting it directly will fail).

4. **Propagate downstream** — set `proxy_set_header X-Real-IP $remote_addr;` and `X-Forwarded-For $proxy_add_x_forwarded_for;` correctly for upstreams behind this NGINX, and fix the log format to record `$remote_addr` now that it reflects the real client.

5. **Verify** — give a concrete test (curl through the LB with a spoofed `X-Forwarded-For`) proving that a client outside the trusted CIDRs cannot override `$remote_addr`.

Output: (a) the complete commented config (server/listen + real_ip directives + log_format), (b) a table of each directive and the spoofing or logging failure it addresses, (c) the verification commands, and (d) the `nginx -t` line. Validate with `nginx -t` and reload; do not enable `proxy_protocol` on a live listener without confirming the front layer sends it.