Honor HTTP header 'X-Real-IP' when available

And because X-Real-IP can be spoofed, gate this feature with TRUST_X_REAL_IP
environment variable.

Fix tmate-io#5.

config/prod.exs

@@ -26,7 +26,8 @@ config :tmate, :websocket, Keyword.merge(websocket_ranch_opts,
   cowboy_opts: %{
     compress: true,
     proxy_header: System.get_env("USE_PROXY_PROTOCOL") == "1"},
-  base_url: System.get_env("WEBSOCKET_BASE_URL")
+  base_url: System.get_env("WEBSOCKET_BASE_URL"),
+  trust_x_real_ip: System.get_env("TRUST_X_REAL_IP") == "1"
 )
 
 config :tzdata, :autoupdate, :disabled

lib/tmate/ws_api/websocket.ex

@@ -24,8 +24,12 @@ defmodule Tmate.WsApi.WebSocket do
           {mode, session} ->
             case Tmate.Session.ws_verify_auth(session) do
               :ok ->
+                trust_x_real_ip = Application.get_env(:tmate, :websocket)[:trust_x_real_ip]
                 ip = case req do
                   %{proxy_header: %{src_address: ip}} -> ip
+                  %{headers: %{"x-real-ip" => ipstring}} when trust_x_real_ip ->
+                    {_, ip} = :inet.parse_address(ipstring |> to_charlist)
+                    ip
                   %{peer: {ip, _port}} -> ip
                 end
                 ip = :inet_parse.ntoa(ip) |> to_string