Yep you are correct, that’s what I was trying to when I was talking about the logs on the public instance and forwarding them to a central place of that is important information, sorry if it didn’t make sense, I must have been tired haha.
I forgot before, it is also possible use ProxyProtocol for TCP applications but the application will need to understand it for it to show in the application logs. It would also be possible to use this to allow the on-prem instance (nginx->nginx let’s say) to see the true client IP from the public instance, the exact configuration is implementation dependent though.