fix

apps/api/internal/metrics/metrics.go

@@ -185,11 +185,13 @@ func Handler() http.Handler {
 }
 
 // Gate restricts Prometheus scrapes in production: allow when metricsPublic is true
-// (METRICS_PUBLIC=1) or the peer is loopback. Non-production always allows (local scrapes).
+// (METRICS_PUBLIC=1) or the immediate TCP peer is loopback. Non-production always
+// allows (local scrapes). Loopback is ignored when client-IP proxy headers are
+// present so TrustedRealIP cannot mint 127.0.0.1 from X-Forwarded-For.
 func Gate(isProduction, metricsPublic bool) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if !isProduction || metricsPublic || isLoopbackRemoteAddr(r.RemoteAddr) {
+			if !isProduction || metricsPublic || allowLoopbackMetricsPeer(r) {
 				next.ServeHTTP(w, r)
 				return
 			}
@@ -198,6 +200,19 @@ func Gate(isProduction, metricsPublic bool) func(http.Handler) http.Handler {
 	}
 }
 
+func allowLoopbackMetricsPeer(r *http.Request) bool {
+	if forwardedClientIPPresent(r) {
+		return false
+	}
+	return isLoopbackRemoteAddr(r.RemoteAddr)
+}
+
+func forwardedClientIPPresent(r *http.Request) bool {
+	return strings.TrimSpace(r.Header.Get("X-Forwarded-For")) != "" ||
+		strings.TrimSpace(r.Header.Get("X-Real-IP")) != "" ||
+		strings.TrimSpace(r.Header.Get("True-Client-IP")) != ""
+}
+
 func isLoopbackRemoteAddr(remoteAddr string) bool {
 	host := strings.TrimSpace(remoteAddr)
 	if host == "" {