Trust reverse proxy client IP headers

.env.example

@@ -20,6 +20,9 @@ DDNS_TTL=60
 # Run a single Uvicorn worker by default. Rate-limit counters and per-host update locks are process-local.
 # DDNS_TRUSTED_HOSTS=karldns.de,www.karldns.de
 # DDNS_DNS_ZONES=karldns.de
+# Trust CF-Connecting-IP / X-Forwarded-For when the direct peer is a private/local reverse proxy.
+# This is the normal Docker + Nginx Proxy Manager setup. Set to 0 if the app port is reachable by untrusted LAN clients.
+# DDNS_TRUST_PRIVATE_PROXY_HEADERS=1
 # DDNS_TRUSTED_PROXY_IPS=127.0.0.1,::1
 # DDNS_RATE_LIMIT_PER_MINUTE=60
 # DDNS_ADMIN_RATE_LIMIT_PER_MINUTE=20