Trust Cloudflare's published ranges and the private proxy hop, so the client IP and scheme are right behind Cloudflare.

Laravel middleware that restores the real client IP behind a CDN, load balancer or ingress controller that overwrites X-Forwarded-For, verified with a shared secret so the header cannot be spoofed.