Add TRUST_PROXY configuration for reverse proxy settings

server/index.js

@@ -18,8 +18,11 @@ const __dirname = path.dirname(__filename);
 const app = express();
 const PORT = process.env.PORT || 3001;
 
-// Trust proxy for correct req.protocol behind reverse proxy
-app.set('trust proxy', true);
+// Trust proxy – configurable via TRUST_PROXY env var (default: 1 = one local reverse proxy)
+// Use a number to trust that many hops, or a string like 'loopback' / an IP/CIDR.
+const rawTrustProxy = process.env.TRUST_PROXY ?? 'loopback';
+const trustProxy = /^\d+$/.test(rawTrustProxy) ? parseInt(rawTrustProxy, 10) : rawTrustProxy;
+app.set('trust proxy', trustProxy);
 
 // Middleware
 app.use(cors());