fix: trust proxy headers in production (behind SSL-terminating reverse proxy)

config/app.ts

@@ -13,6 +13,14 @@ export const appUrl = env.get('APP_URL')
  * The configuration settings used by the HTTP server
  */
 export const http = defineConfig({
+  /**
+   * Trust the X-Forwarded-* headers sent by a reverse proxy (e.g. Nginx).
+   * Required so that AdonisJS sees the real client IP and the correct
+   * protocol (https) when running behind an SSL-terminating proxy.
+   * Set to 1 to trust only the immediately-preceding proxy.
+   */
+  trustProxy: app.inProduction,
+
   /**
    * Generate a unique request id for each incoming request.
    * Useful to correlate logs and debug a request flow.