fix rewards and bypass ip limits

deploy/Caddyfile.example

@@ -20,7 +20,12 @@ al.example.com {
 	@game path /socket.io/* /socket.io-msgpack/* /server.api/*
 	handle @game {
 		reverse_proxy 10.10.16.28:7192 {
-	}
+			# Overwrite, not append: Adventure Land reads the first
+			# X-Forwarded-For entry for its IP limits. Without this a client
+			# could send a fake header and bypass the limits.
+			header_up X-Forwarded-For {remote_host}
+		}
+	}
 
 	# --- Web backend (container port 8090) ------------------------------
 	# Everything else: HTML, JS, /api/*, static files.
@@ -30,6 +35,8 @@ al.example.com {
 			# auth cookie domain from it.
 			header_up Host {host}
 			# Overwrite the client IP; see the game handler above.
+			header_up X-Forwarded-For {remote_host}
+		}
 	}
 
 	# Internal-only TLS (no Let's Encrypt). Clients must trust Caddy's CA.