elections has a ReverseProxied wrapper for the WSGI app that attempts to cope with it being reverse-proxied (in fedora_elections/proxy.py).

werkzeug X-Forwarded-For Proxy Fix seems to be a better implementation of this, which is documented by flask upstream and handles things like there being multiple comma-separated values in the forwarded headers. It handles more headers, and allows specifying how many levels of proxy there are known to be for each header.

In all respects it seems like a superior replacement (which we don't have to maintain), so we should switch to it, I think.

Open questions: which of the headers are proxied for the Fedora deployment, and how many levels of proxying should we configure (assuming we go back to the append setting for haproxy.router.openshift.io/set-forwarded-headers)? And should we make the wrapper setup configurable to allow for other deployments and for easy changes if our proxying setup changes in future?