[bug]: real_ip_header directive has typo X-Forward-For instead of X-Forwarded-For in nginx configs

[MinitJain]

Is there an existing issue for this?

• I have searched the existing issues

Current behavior

All three nginx config files (apps/web, apps/admin, apps/space) have a typo in the real_ip_header directive:

real_ip_header X-Forward-For;   ← wrong (not a real HTTP header)

X-Forward-For does not exist as an HTTP header. The correct standard header is X-Forwarded-For. Because of this typo, Nginx never replaces $remote_addr with the actual client IP, so rate limiting (limit_req_zone $binary_remote_addr) and IP logging always see the proxy/load balancer IP instead of the real client IP.

Steps to reproduce

1. Deploy Plane behind a proxy or CDN (e.g. AWS ELB, Cloudflare)
2. Check the IP seen by the application — it will be the proxy IP, not the real client IP
3. Rate limiting (limit_req_zone) applies per-proxy instead of per-client, making it ineffective

Environment

Self-hosted (Docker)

Browser

N/A

Variant

Community Edition / All

Version

All