I'm currently working on building a template that puts an Nginx service in front of a database (like Postgres) to manage an IP allow-list. I'm exposing the Nginx service using TCP Proxy.

However, because the traffic routes through the internal load balancers, Nginx only sees the internal edge IP rather than the true client IP. Since it's a raw TCP connection, I can't rely on HTTP headers like X-Forwarded-For.

I have two questions regarding this:

1. Is there currently any supported method or workaround to retrieve the actual client IP when exposing a service via a public TCP proxy?
2. Does the edge network currently support injecting the PROXY protocol for TCP endpoints? This would allow me to simply append proxy_protocol to my Nginx listen directive to recover the real IP.