TL;DR
Currently, when an ingress controller like traefik configures a loadbalancer svc for port 80 and 443, those services are by default exposed as TCP loadbalancer services on hetzner. Unfortunately, this means the X-FORWARDED-FOR header is not correctly set.
Expected behavior
Ideally, one could set annotations on loadbalancer services to map specific ports to specific protocols, and specific ports to specific certificates.
An additional nice-to-have feature would be the ability to sync certificates from the cluster to Hetzner, such as when cert-manager is in use.