fix client IP handling behind proxies

server/internal/ops/config/config.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"sync"
 	"time"
@@ -216,7 +217,7 @@ func Diff(previous, current *Config) []FieldChange {
 		changes = append(changes, FieldChange{Path: path, Hot: hot})
 	}
 
-	if previous.Server != current.Server {
+	if !reflect.DeepEqual(previous.Server, current.Server) {
 		add("server", false)
 	}
 	if previous.Database != current.Database {
@@ -330,6 +331,7 @@ func normalizeConfig(cfg *Config) {
 	if strings.TrimSpace(cfg.Server.Mode) == "" {
 		cfg.Server.Mode = "debug"
 	}
+	sharedconfig.NormalizeServerConfig(&cfg.Server)
 	if strings.TrimSpace(cfg.Redis.Addr) == "" {
 		cfg.Redis.Addr = "localhost:6379"
 	}
@@ -361,8 +363,9 @@ func normalizeConfig(cfg *Config) {
 func defaultSettings() map[string]any {
 	return map[string]any{
 		"server": map[string]any{
-			"port": 8090,
-			"mode": "debug",
+			"port":            8090,
+			"mode":            "debug",
+			"trusted_proxies": sharedconfig.DefaultTrustedProxies(),
 		},
 		"redis": map[string]any{
 			"addr": "localhost:6379",
@@ -417,6 +420,9 @@ func applyEnvOverrides(cfg *Config) error {
 	if v := os.Getenv("OPS_IP_REGION_V6_XDB_PATH"); v != "" {
 		cfg.IPRegion.V6XDBPath = v
 	}
+	if v := os.Getenv("OPS_SERVER_TRUSTED_PROXIES"); v != "" {
+		cfg.Server.TrustedProxies = strings.Split(v, ",")
+	}
 	return nil
 }