diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix
index e111592..f8ba6e3 100644
--- a/hosts/git/forgejo.nix
+++ b/hosts/git/forgejo.nix
@@ -92,6 +92,7 @@ in
             proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}";
             extraConfig = ''
               client_max_body_size 512M;
+              proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
             '';
           };
           "/metrics" = {
diff --git a/hosts/matrix/synapse.nix b/hosts/matrix/synapse.nix
index 9a633e5..0d51d8e 100644
--- a/hosts/matrix/synapse.nix
+++ b/hosts/matrix/synapse.nix
@@ -82,6 +82,7 @@
             client_max_body_size 64M;
             proxy_set_header X-Request-ID $request_id;
             proxy_http_version 1.1;
+            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
           '';
         };
         "/_synapse/metrics" = {
diff --git a/hosts/md/hedgedoc.nix b/hosts/md/hedgedoc.nix
index c33ca1e..78e48e4 100644
--- a/hosts/md/hedgedoc.nix
+++ b/hosts/md/hedgedoc.nix
@@ -34,12 +34,16 @@ in
           recommendedProxySettings = true;
           extraConfig = ''
             add_header Content-Security-Policy "frame-src 'self'; default-src 'self'; script-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; form-action 'self'; upgrade-insecure-requests;" always;
+            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
           '';
         };
         "/socket.io/" = {
           proxyPass = "http://${cfg.host}:${toString cfg.port}";
           proxyWebsockets = true;
           recommendedProxySettings = true;
+          extraConfig = ''
+            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
+          '';
         };
         "/metrics" = {
           proxyPass = "http://${cfg.host}:${toString cfg.port}";
diff --git a/hosts/monitoring/grafana.nix b/hosts/monitoring/grafana.nix
index a8af09b..8dc908c 100644
--- a/hosts/monitoring/grafana.nix
+++ b/hosts/monitoring/grafana.nix
@@ -83,11 +83,17 @@ in
           basicAuthFile = config.age.secrets.grafana_basic_auth.path;
           proxyPass = "http://unix:/run/grafana/grafana.sock";
           recommendedProxySettings = true;
+          extraConfig = ''
+            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
+          '';
         };
         "/api/live/" = {
           proxyPass = "http://unix:/run/grafana/grafana.sock";
           recommendedProxySettings = true;
           proxyWebsockets = true;
+          extraConfig = ''
+            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
+          '';
         };
       };
     };
diff --git a/services/nginx.nix b/services/nginx.nix
index 21b7e66..8574a0d 100644
--- a/services/nginx.nix
+++ b/services/nginx.nix
@@ -17,5 +17,26 @@
     recommendedOptimisation = true;
     recommendedGzipSettings = true;
     recommendedBrotliSettings = true;
+    commonHttpConfig = ''
+      map $remote_addr $proxy_forwarded_for_element {
+        # IPv4 addresses can be sent as-is
+        ~^[0-9.]+$          "for=$remote_addr:$remote_port";
+
+        # IPv6 addresses need to be bracketed and quoted
+        ~^[0-9A-Fa-f:.]+$   "for=\"[$remote_addr]:$remote_port\"";
+
+        default             "for=unknown";
+      }
+
+      map $server_addr $proxy_forwarded_by_element {
+        # IPv4 addresses can be sent as-is
+        ~^[0-9.]+$        "by=$server_addr:$server_port";
+
+        # IPv6 addresses need to be bracketed and quoted
+        ~^[0-9A-Fa-f:.]+$ "by=\"[$server_addr]:$server_port\"";
+
+        default           "by=unknown";
+      }
+    '';
   };
 }