Anti-spoofing system, fixes the counter viewer

server.ts

@@ -102,8 +102,19 @@ function parsePositiveInt(value: string | undefined, fallback: number): number {
 }
 
 function getClientIp(req: Request, server: Bun.Server<WsData>): string {
+  // Railway's edge proxy strips client-provided X-Real-IP and sets the actual
+  // client IP. All traffic goes through the edge proxy — it cannot be bypassed.
+  // As a fallback, use the rightmost X-Forwarded-For value (the one Railway
+  // appends), then Bun's requestIP (which sees the proxy IP on Railway).
   const realIp = req.headers.get("x-real-ip")?.trim();
   if (realIp) return realIp;
+
+  const xff = req.headers.get("x-forwarded-for");
+  if (xff) {
+    const rightmost = xff.split(",").at(-1)?.trim();
+    if (rightmost) return rightmost;
+  }
+
   return server.requestIP(req)?.address ?? "unknown";
 }