fix client IP handling behind proxies

server/internal/shared/config/config.go

@@ -41,8 +41,9 @@ type Config struct {
 }
 
 type ServerConfig struct {
-	Port int    `mapstructure:"port"`
-	Mode string `mapstructure:"mode"`
+	Port           int      `mapstructure:"port"`
+	Mode           string   `mapstructure:"mode"`
+	TrustedProxies []string `mapstructure:"trusted_proxies"`
 }
 
 type DatabaseConfig struct {
@@ -366,6 +367,7 @@ func loadWithFiles(configPath string) (*Config, []string, error) {
 	}
 
 	applyEnvOverrides(cfg)
+	NormalizeServerConfig(&cfg.Server)
 	NormalizeRedisConfig(&cfg.Redis)
 	NormalizeCacheConfig(&cfg.Cache)
 	normalizeRabbitMQConfig(&cfg.RabbitMQ)
@@ -469,6 +471,42 @@ func ensureMapSetting(settings map[string]any, key string) map[string]any {
 	return next
 }
 
+func DefaultTrustedProxies() []string {
+	return []string{
+		"127.0.0.1",
+		"::1",
+		"10.42.0.0/16",
+		"10.43.0.0/16",
+		"172.16.0.0/12",
+	}
+}
+
+func NormalizeServerConfig(cfg *ServerConfig) {
+	if cfg == nil {
+		return
+	}
+	cfg.Mode = strings.TrimSpace(cfg.Mode)
+	if cfg.TrustedProxies == nil {
+		cfg.TrustedProxies = DefaultTrustedProxies()
+		return
+	}
+	cfg.TrustedProxies = compactStringSlice(cfg.TrustedProxies)
+}
+
+func compactStringSlice(values []string) []string {
+	if values == nil {
+		return nil
+	}
+	out := make([]string, 0, len(values))
+	for _, value := range values {
+		value = strings.TrimSpace(value)
+		if value != "" {
+			out = append(out, value)
+		}
+	}
+	return out
+}
+
 func normalizeMonitoringDispatchConfig(cfg *MonitoringDispatchConfig) {
 	if cfg == nil {
 		return
@@ -747,6 +785,9 @@ func applyEnvOverrides(cfg *Config) {
 	if token, ok := lookupFirstNonEmptyEnv("SCHEDULER_INTERNAL_METRICS_TOKEN", "SCHEDULER_METRICS_TOKEN"); ok {
 		cfg.Scheduler.InternalMetricsToken = token
 	}
+	if trustedProxies, ok := lookupNonEmptyEnv("SERVER_TRUSTED_PROXIES"); ok {
+		cfg.Server.TrustedProxies = strings.Split(trustedProxies, ",")
+	}
 }
 
 func normalizeRabbitMQConfig(cfg *RabbitMQConfig) {