fix client IP handling behind proxies

server/internal/shared/config/config.go

@@ -41,8 +41,9 @@ type Config struct {
 }
 
 type ServerConfig struct {
-	Port int    `mapstructure:"port"`
-	Mode string `mapstructure:"mode"`
+	Port           int      `mapstructure:"port"`
+	Mode           string   `mapstructure:"mode"`
+	TrustedProxies []string `mapstructure:"trusted_proxies"`
 }
 
 type DatabaseConfig struct {
@@ -366,6 +367,7 @@ func loadWithFiles(configPath string) (*Config, []string, error) {
 	}
 
 	applyEnvOverrides(cfg)
+	NormalizeServerConfig(&cfg.Server)
 	NormalizeRedisConfig(&cfg.Redis)
 	NormalizeCacheConfig(&cfg.Cache)
 	normalizeRabbitMQConfig(&cfg.RabbitMQ)
@@ -469,6 +471,42 @@ func ensureMapSetting(settings map[string]any, key string) map[string]any {
 	return next
 }
 
+func DefaultTrustedProxies() []string {
+	return []string{
+		"127.0.0.1",
+		"::1",
+		"10.42.0.0/16",
+		"10.43.0.0/16",
+		"172.16.0.0/12",
+	}
+}
+
+func NormalizeServerConfig(cfg *ServerConfig) {
+	if cfg == nil {
+		return
+	}
+	cfg.Mode = strings.TrimSpace(cfg.Mode)
+	if cfg.TrustedProxies == nil {
+		cfg.TrustedProxies = DefaultTrustedProxies()
+		return
+	}
+	cfg.TrustedProxies = compactStringSlice(cfg.TrustedProxies)
+}
+
+func compactStringSlice(values []string) []string {
+	if values == nil {
+		return nil
+	}
+	out := make([]string, 0, len(values))
+	for _, value := range values {
+		value = strings.TrimSpace(value)
+		if value != "" {
+			out = append(out, value)
+		}
+	}
+	return out
+}
+
 func normalizeMonitoringDispatchConfig(cfg *MonitoringDispatchConfig) {
 	if cfg == nil {
 		return
@@ -747,6 +785,9 @@ func applyEnvOverrides(cfg *Config) {
 	if token, ok := lookupFirstNonEmptyEnv("SCHEDULER_INTERNAL_METRICS_TOKEN", "SCHEDULER_METRICS_TOKEN"); ok {
 		cfg.Scheduler.InternalMetricsToken = token
 	}
+	if trustedProxies, ok := lookupNonEmptyEnv("SERVER_TRUSTED_PROXIES"); ok {
+		cfg.Server.TrustedProxies = strings.Split(trustedProxies, ",")
+	}
 }
 
 func normalizeRabbitMQConfig(cfg *RabbitMQConfig) {

server/internal/shared/config/config_test.go

@@ -132,6 +132,42 @@ brand_library: {}
 	}
 }
 
+func TestLoadAppliesServerTrustedProxyDefaultsAndOverrides(t *testing.T) {
+	defaultConfigPath := writeTestConfig(t, `
+server: {}
+`)
+
+	cfg, err := Load(defaultConfigPath)
+	if err != nil {
+		t.Fatalf("Load() default error = %v", err)
+	}
+	if got := cfg.Server.TrustedProxies; len(got) != len(DefaultTrustedProxies()) {
+		t.Fatalf("expected default trusted proxies, got %#v", got)
+	}
+
+	overrideConfigPath := writeTestConfig(t, `
+server:
+  trusted_proxies:
+    - " 10.42.0.0/16 "
+    - ""
+    - "192.168.1.10"
+`)
+
+	cfg, err = Load(overrideConfigPath)
+	if err != nil {
+		t.Fatalf("Load() override error = %v", err)
+	}
+	want := []string{"10.42.0.0/16", "192.168.1.10"}
+	if len(cfg.Server.TrustedProxies) != len(want) {
+		t.Fatalf("trusted proxies = %#v, want %#v", cfg.Server.TrustedProxies, want)
+	}
+	for i := range want {
+		if cfg.Server.TrustedProxies[i] != want[i] {
+			t.Fatalf("trusted proxies = %#v, want %#v", cfg.Server.TrustedProxies, want)
+		}
+	}
+}
+
 func TestLoadAppliesSchedulerHTTPDefaultsAndDisableSentinel(t *testing.T) {
 	defaultConfigPath := writeTestConfig(t, `
 scheduler: {}

server/internal/shared/config/reload.go

@@ -17,7 +17,7 @@ func Diff(previous, current *Config) []FieldChange {
 		changes = append(changes, FieldChange{Path: path, Hot: hot})
 	}
 
-	if previous.Server != current.Server {
+	if !reflect.DeepEqual(previous.Server, current.Server) {
 		addChange("server", false)
 	}
 	if previous.Database != current.Database {