fix client IP handling behind proxies

server/internal/shared/config/config_test.go

@@ -132,6 +132,42 @@ brand_library: {}
 	}
 }
 
+func TestLoadAppliesServerTrustedProxyDefaultsAndOverrides(t *testing.T) {
+	defaultConfigPath := writeTestConfig(t, `
+server: {}
+`)
+
+	cfg, err := Load(defaultConfigPath)
+	if err != nil {
+		t.Fatalf("Load() default error = %v", err)
+	}
+	if got := cfg.Server.TrustedProxies; len(got) != len(DefaultTrustedProxies()) {
+		t.Fatalf("expected default trusted proxies, got %#v", got)
+	}
+
+	overrideConfigPath := writeTestConfig(t, `
+server:
+  trusted_proxies:
+    - " 10.42.0.0/16 "
+    - ""
+    - "192.168.1.10"
+`)
+
+	cfg, err = Load(overrideConfigPath)
+	if err != nil {
+		t.Fatalf("Load() override error = %v", err)
+	}
+	want := []string{"10.42.0.0/16", "192.168.1.10"}
+	if len(cfg.Server.TrustedProxies) != len(want) {
+		t.Fatalf("trusted proxies = %#v, want %#v", cfg.Server.TrustedProxies, want)
+	}
+	for i := range want {
+		if cfg.Server.TrustedProxies[i] != want[i] {
+			t.Fatalf("trusted proxies = %#v, want %#v", cfg.Server.TrustedProxies, want)
+		}
+	}
+}
+
 func TestLoadAppliesSchedulerHTTPDefaultsAndDisableSentinel(t *testing.T) {
 	defaultConfigPath := writeTestConfig(t, `
 scheduler: {}