From 2268e75c3358a74483e867bab7e6d4ac95ba1f67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9E=97SO?=
 <142557582+Linxiushen@users.noreply.github.com>
Date: Wed, 5 Aug 2026 04:01:38 +0800
Subject: [PATCH] fix: trust ingress forwarded headers

---
 containers/Dockerfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/containers/Dockerfile b/containers/Dockerfile
index c7515e9d..e23a8e55 100644
--- a/containers/Dockerfile
+++ b/containers/Dockerfile
@@ -2,6 +2,9 @@ FROM python:3.12-slim-bookworm
 
 WORKDIR /app
 ENV PYTHONPATH='/app'
+# The service image runs behind an ingress. Direct deployments can override
+# this with their trusted proxy IPs or CIDRs.
+ENV FORWARDED_ALLOW_IPS='*'
 
 # Datadog labels
 LABEL com.datadoghq.tags.service="automation"