ctx.request.ip should be the last value of X-Forwarded-For, not the first
In many default Nginx configs, Nginx appends client IP to X-Forwarded-For header without checking a trust to previous IP addresses in X-Forwarded-For. So, if client for instance sends "X-Forwarded-For: a.a.a.a, b.b.b.b", Nginx adds his IP and sends "a.a.a.a, b.b.b.b, client_ip" to Koa.
It's expected that if app.proxy = true, then the last IP will be set to ctx.request.ip.

But instead, it sets ctx.request.ip to the first record, "a.a.a.a" in example.
Ideally, it should have a list of trusted proxy addresses and set ctx.request.ip to the rightmost untrusted IP (or the leftmost if every IP in the X-Forwarded-For belongs to trusted proxies list).

Also, it can be a situation where app is serving to both load balancer and still allows the direct user connections, in this case koa trusts everything despite the address of load balancer. In express, for instance, we can specify what proxies we trust and what we do not.

My simple package https://www.npmjs.com/package/koa-trust-proxy patches that behavior and rewrites ctx.request.ip based on the trust, but hoping the bug will be fixed in Koa core.