0.3.49

.env.example

@@ -150,6 +150,18 @@ MEMBY_EMBY_HEALTH_INTERVAL=60s
 # settings page overrides it without a redeployment.
 MEMBY_SLOW_REQUEST_THRESHOLD=500ms
 
+# Which reverse proxies the gateway believes when working out where a request came from,
+# for the admin console's Remote IP column and the login/trailer logs. X-Forwarded-For
+# and X-Real-IP are only honoured when the immediate peer is one of these, so a direct
+# client cannot spoof its address with a header. Blank trusts loopback and the private
+# ranges (10/8, 172.16/12, 192.168/16, fc00::/7, link-local) — every proxy a home
+# deployment puts in front of Memby. Set a comma-separated list of addresses or CIDR
+# ranges to narrow or widen it (add your CDN's ranges here if TLS terminates off-site),
+# or "none" to trust no proxy. The reverse proxy must be configured to send the headers
+# — e.g. nginx: proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; and
+# proxy_set_header X-Real-IP $remote_addr;
+MEMBY_TRUSTED_PROXIES=
+
 # Optional Tracearr-powered For You signals. Create a read-only public API key in
 # Tracearr Settings. Server ID is optional unless Tracearr monitors multiple servers.
 MEMBY_TRACEARR_URL=https://tracearr.sublogue.com/