nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose the address the service bans and rate-limits by

ddiff --git a/deploy/nginx/search.openvibe.network.conf b/deploy/nginx/search.openvibe.network.conf
iindex 9d7048f..847e81a 100644
---- a/deploy/nginx/search.openvibe.network.conf
++++ b/deploy/nginx/search.openvibe.network.conf
@@@ -48,8 +48,8 @@ server {
      add_header Referrer-Policy strict-origin-when-cross-origin always;
      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
  
--    location = /api/health { proxy_pass http://127.0.0.1:4710; proxy_set_header Host $host; }
--    location = /api/ready  { proxy_pass http://127.0.0.1:4710; proxy_set_header Host $host; }
++    location = /api/health { proxy_pass http://127.0.0.1:4710; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header CF-Connecting-IP $remote_addr; }
++    location = /api/ready  { proxy_pass http://127.0.0.1:4710; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header CF-Connecting-IP $remote_addr; }
  
      # ── Public query API (GET only) ─────────────────────────
      location ~ ^/api/v1/(search|suggest|documents/) {
@@@ -60,7 +60,8 @@ server {
          proxy_set_header Connection "";
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
--        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
++        proxy_set_header X-Forwarded-For $remote_addr;
++        proxy_set_header CF-Connecting-IP $remote_addr;
          proxy_set_header X-Forwarded-Proto $scheme;
          # Never let a shared cache hold a personalised answer.
          proxy_no_cache 1;
@@@ -74,6 +75,9 @@ server {
      location = / {
          proxy_pass http://127.0.0.1:4710;
          proxy_set_header Host $host;
++        proxy_set_header X-Real-IP $remote_addr;
++        proxy_set_header X-Forwarded-For $remote_addr;
++        proxy_set_header CF-Connecting-IP $remote_addr;
      }
  
      location / {