feat: add trusted proxies config value

cmd/root.go

@@ -112,6 +112,7 @@ func init() {
 		{"ldap-search-filter", "(uid=%s)", "LDAP search filter for user lookup."},
 		{"resources-dir", "/data/resources", "Path to a directory containing custom resources (e.g. background image)."},
 		{"database-path", "/data/tinyauth.db", "Path to the Sqlite database file."},
+		{"trusted-proxies", "", "Comma separated list of trusted proxies (IP addresses) for correct client IP detection and for header ACLs."},
 	}
 
 	for _, opt := range configOptions {

internal/bootstrap/app_bootstrap.go

@@ -146,6 +146,7 @@ func (app *BootstrapApp) Setup() error {
 
 	// Create engine
 	engine := gin.New()
+	engine.SetTrustedProxies(strings.Split(app.Config.TrustedProxies, ","))
 
 	if config.Version != "development" {
 		gin.SetMode(gin.ReleaseMode)

internal/config/config.go

@@ -53,6 +53,7 @@ type Config struct {
 	LdapSearchFilter        string `mapstructure:"ldap-search-filter"`
 	ResourcesDir            string `mapstructure:"resources-dir"`
 	DatabasePath            string `mapstructure:"database-path" validate:"required"`
+	TrustedProxies          string `mapstructure:"trusted-proxies"`
 }
 
 // OAuth/OIDC config