fix: rate limiting X-Real-IP from the real peer

internal/infrastructure/config/settings.go

@@ -29,6 +29,7 @@ type Settings struct {
 	Port               string
 	Smtp               SmtpSettings
 	AuthRateLimit      AuthRateLimitSettings
+	TrustedProxies     []string
 }
 
 func (s Settings) IsProduction() bool {
@@ -53,7 +54,7 @@ func NewSettingsFromEnv() (Settings, error) {
 
 	return Settings{
 		Environment:        os.Getenv("ENVIRONMENT"),
-		CorsAllowedOrigins: parseCorsAllowedOrigins(os.Getenv("CORS_ALLOWED_ORIGINS")),
+		CorsAllowedOrigins: parseSemicolonSeparatedList(os.Getenv("CORS_ALLOWED_ORIGINS")),
 		PublicURL:          os.Getenv("PUBLIC_URL"),
 		UploadDir:          os.Getenv("UPLOAD_DIR"),
 		JWTSecret:          os.Getenv("JWT_SECRET"),
@@ -69,6 +70,7 @@ func NewSettingsFromEnv() (Settings, error) {
 			MaxAttempts: authRateLimitMaxAttempts,
 			Window:      time.Duration(authRateLimitWindowSeconds) * time.Second,
 		},
+		TrustedProxies: parseSemicolonSeparatedList(os.Getenv("TRUSTED_PROXIES")),
 	}, nil
 }
 
@@ -76,7 +78,7 @@ func intEnv(name string) (int, error) {
 	return strconv.Atoi(os.Getenv(name))
 }
 
-func parseCorsAllowedOrigins(raw string) []string {
+func parseSemicolonSeparatedList(raw string) []string {
 	if raw == "" {
 		return nil
 	}