nginx (openvibe.chat): /ws/chat sets the client address from the connection again (a location's proxy_set_header replaces the server-level ones, so it could be forged); /ws/call for call signalling, refused by Chat until CHAT_CALLS=1

ddiff --git a/deploy/nginx/openvibe.chat.conf b/deploy/nginx/openvibe.chat.conf
iindex b8006c1..763d145 100644
---- a/deploy/nginx/openvibe.chat.conf
++++ b/deploy/nginx/openvibe.chat.conf
@@@ -76,8 +76,34 @@ server {
      location = /metrics { return 404; }
      location ^~ /internal/ { return 404; }
  
++    # Chat's socket.
++    # A location's proxy_set_header replaces every server-level one, so the client address is set here
++    # again, from the connection only (never a forwarded header from the client).
      location ^~ /ws/chat {
          proxy_pass http://127.0.0.1:4400;
++        proxy_http_version 1.1;
++        proxy_set_header Host $host;
++        proxy_set_header X-Real-IP $remote_addr;
++        proxy_set_header X-Forwarded-For $remote_addr;
++        proxy_set_header CF-Connecting-IP $remote_addr;
++        proxy_set_header X-Forwarded-Proto $scheme;
++        proxy_set_header Upgrade $http_upgrade;
++        proxy_set_header Connection "upgrade";
++        proxy_read_timeout 3600s;
++        proxy_send_timeout 3600s;
++    }
++
++    # Voice and video call signalling (WS-I task 1); Chat refuses it until CHAT_CALLS=1.
++    # A location's proxy_set_header replaces every server-level one, so the client address is set here
++    # again, from the connection only (never a forwarded header from the client).
++    location ^~ /ws/call {
++        proxy_pass http://127.0.0.1:4400;
++        proxy_http_version 1.1;
++        proxy_set_header Host $host;
++        proxy_set_header X-Real-IP $remote_addr;
++        proxy_set_header X-Forwarded-For $remote_addr;
++        proxy_set_header CF-Connecting-IP $remote_addr;
++        proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
          proxy_read_timeout 3600s;