Oh, I never expected Cloudflare to handle the problem for free. I would happily have at least a pro level account with them if they treated ipv4 traffic properly. But they don't expose a request's actual v4 address to the backend. The WAF works amazingly well, but it otherwise breaks a critical part of the service.