Replace PeerIpKeyExtractor with custom RealIpKeyExtractor that extracts the real client IP from X-Real-IP/X-Forwarded-For headers when the request comes from a trusted proxy (default 127.0.0.1). This fixes rate limiting being applied to the proxy IP instead of individual clients when deployed behind Nginx.