How to configure Rails and Rack::Attack to use the real client IP when running behind Cloudflare

production.rb

Rails.application.configure do  
  # Add Cloudflare's IPs to the trusted proxy list so they are ignored when
  # determining the true client IP.
  #
  # See https://www.cloudflare.com/ips-v4/ and https://www.cloudflare.com/ips-v6/
  config.action_dispatch.trusted_proxies = ActionDispatch::RemoteIp::TRUSTED_PROXIES + %w[
    173.245.48.0/20
    103.21.244.0/22
    103.22.200.0/22
    103.31.4.0/22
    141.101.64.0/18
    108.162.192.0/18
    190.93.240.0/20
    188.114.96.0/20
    197.234.240.0/22
    198.41.128.0/17
    162.158.0.0/15
    104.16.0.0/13
    104.24.0.0/14
    172.64.0.0/13
    131.0.72.0/22
    2400:cb00::/32
    2606:4700::/32
    2803:f800::/32
    2405:b500::/32
    2405:8100::/32
    2a06:98c0::/29
    2c0f:f248::/32
  ].map { |proxy| IPAddr.new(proxy) }
end

rack_attack.rb

Rack::Attack.throttle("req/ip", limit: 300, period: 5.minutes) do |req|
  req.get_header("action_dispatch.remote_ip") unless req.path.start_with?("/assets")
end

Ah yes, I do something similar via:

  blocklist("herokuapp") do |req|
    req.host =~ /herokuapp/
  end

...which works for my case, simply enforcing access through my domain as opposed to Heroku directly.

Thanks for sharing!