Looks good to me, you highlight the super important fact there that you can not just trust any IP address with that header, cause if you did, user IPs can be spoofed.
An alternative I have seen (that we use in haproxy) is setting the IP only if we see some top secret header that we have the CDN always send us.