Document the reverse proxy requirement for X-Real-IP

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -2,8 +2,6 @@
 
 A small little program to manage emails.
 
-The proxy should add X-Real-IP to get a better logging.
-
 ## Setup
 
 Requirements: Docker, Make
@@ -17,6 +15,15 @@ Start with `make run-dev`
 - `MAX_PRODUCTION=1` is set in the Docker image and makes MAX refuse to start
   in debug mode (`FLASK_DEBUG`). Do not override it.
 
+## Reverse proxy
+
+In production, the reverse proxy must set `X-Real-IP` to the client's address and **overwrite** any
+value the client sends. Max uses this address for audit logging. For nginx:
+
+```nginx
+proxy_set_header X-Real-IP $remote_addr;
+```
+
 ## Dependencies
 
 Direct dependencies are listed in `requirements.in` (production) and