demo-service: fix internal IP detection — preserve X-Forwarded-For chain

- Caddy was overwriting X-Forwarded-For with {remote_host} (nginx
  ingress pod IP), losing the original client IP from nginx ingress
- Fix: preserve upstream X-Forwarded-For and append Caddy's remote
- Add X-Real-IP fallback in is_internal_ip() for extra safety
- Clean up the caddy-config ConfigMap accordingly

home-apps/demo-service-caddy.yaml

@@ -32,7 +32,7 @@ data:
         handle /api/* {
             reverse_proxy localhost:3000 {
                 header_up Host {host}
-                header_up X-Forwarded-For {remote_host}
+                header_up X-Forwarded-For {http.request.header.X-Forwarded-For}, {remote_host}
                 header_up X-Forwarded-Proto https
             }
         }
@@ -51,7 +51,7 @@ data:
             rewrite * /site-content{uri}
             reverse_proxy localhost:3000 {
                 header_up Host {host}
-                header_up X-Forwarded-For {remote_host}
+                header_up X-Forwarded-For {http.request.header.X-Forwarded-For}, {remote_host}
                 header_up X-Forwarded-Proto https
                 header_up Cookie {http.request.header.Cookie}
             }

home-apps/demo-service/Caddyfile

@@ -25,7 +25,7 @@
     handle /api/* {
         reverse_proxy localhost:3000 {
             header_up Host {host}
-            header_up X-Forwarded-For {remote_host}
+            header_up X-Forwarded-For {http.request.header.X-Forwarded-For}, {remote_host}
             header_up X-Forwarded-Proto https
         }
     }
@@ -44,7 +44,7 @@
         rewrite * /site-content{uri}
         reverse_proxy localhost:3000 {
             header_up Host {host}
-            header_up X-Forwarded-For {remote_host}
+            header_up X-Forwarded-For {http.request.header.X-Forwarded-For}, {remote_host}
             header_up X-Forwarded-Proto https
             header_up Cookie {http.request.header.Cookie}
         }

home-apps/demo-service/service.py

@@ -35,7 +35,10 @@ def is_internal_ip(request: Request) -> bool:
     forwarded = request.headers.get("X-Forwarded-For", "")
     if forwarded:
         client_ip = forwarded.split(",")[0].strip()
-    elif request.client:
+    else:
+        # Fallback: X-Real-IP (set by nginx ingress) or direct connection
+        client_ip = request.headers.get("X-Real-IP", "")
+    if not client_ip and request.client:
         client_ip = request.client.host
     else:
         return False