Make client IP address available for use in DB functions and/or RLS

I want to use the clients real public IP address (not the forwarded-for header) in either DB functions or RLS (preferred) to restrict certain DB actions (including SELECT) to certain public IP addresses (even for authenticated users).