Your app sees the visitor, not the tunnel

Every tunnel that terminates somewhere else hands your application someone else's address. The request arrives from the tunnel's exit, the visitor's IP rides in a forwarded header, and your rate limiter, your fail2ban, your audit rows all learn to trust that header: or ban the tunnel.

On Hoody, the proxy that terminates TLS runs on the same server as your container, and it preserves the real client IP all the way in. No X-Forwarded-For parsing, no trusted-proxy list, no header to spoof. The address your app logs is the address that connected.

Rate limits hit the right person. Bans ban the visitor. Audit rows mean what they say.

Nothing stands between you and the visitor, so the address is the visitor's.