Unfortunately the host header is spoofable
Yeah that's a good call: I need to do these checks only based on IP.
I could allow users to enter host names which I would resolve to the IP before checking though, which matches how networking is used in things like Kubernetes.