chore(deploy): expose AUTH_TRUSTED_PROXIES in docker-compose.prod and Helm chart

Author: waleedlatif1

docker-compose.prod.yml

@@ -17,6 +17,12 @@ services:
       # addition to NEXT_PUBLIC_APP_URL. Use when serving from multiple domains
       # (apex + www, alias hostnames, reverse-proxy IPs). Empty by default.
       - TRUSTED_ORIGINS=${TRUSTED_ORIGINS:-}
+      # AUTH_TRUSTED_PROXIES: comma-separated reverse-proxy IPs or CIDR ranges in
+      # front of the app (ingress, load balancer). Better Auth walks
+      # x-forwarded-for right to left, skips these hops, and uses the first
+      # untrusted address as the client IP. Required for correct session IPs and
+      # rate-limit keying behind a multi-hop proxy chain. Empty by default.
+      - AUTH_TRUSTED_PROXIES=${AUTH_TRUSTED_PROXIES:-}
       - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET}
       - ENCRYPTION_KEY=${ENCRYPTION_KEY}
       - API_ENCRYPTION_KEY=${API_ENCRYPTION_KEY:-}

helm/sim/values.schema.json

@@ -159,6 +159,10 @@
               "type": "string",
               "description": "Comma-separated additional public origins to trust for auth (e.g. 'https://app.example.com,https://www.example.com'). Merged into Better Auth trustedOrigins."
             },
+            "AUTH_TRUSTED_PROXIES": {
+              "type": "string",
+              "description": "Comma-separated reverse-proxy IPs or CIDR ranges in front of the app (e.g. '10.0.0.0/16'). Better Auth walks x-forwarded-for right to left, skips these hops, and uses the first untrusted address as the client IP."
+            },
             "SSO_TRUSTED_PROVIDER_IDS": {
               "type": "string",
               "description": "Comma-separated SSO provider IDs to trust for automatic account linking when an SSO sign-in matches an existing account's email. Only needed for IdPs that do not assert email_verified. Merged into Better Auth accountLinking.trustedProviders."

helm/sim/values.yaml

@@ -85,6 +85,11 @@ app:
     # TRUSTED_ORIGINS: comma-separated extra public origins to trust for auth (e.g. apex+www, alias hostnames).
     # Merged into Better Auth `trustedOrigins` alongside NEXT_PUBLIC_APP_URL. Leave empty when serving from a single origin.
     TRUSTED_ORIGINS: ""
+    # AUTH_TRUSTED_PROXIES: comma-separated reverse-proxy IPs or CIDR ranges in front of the app
+    # (ingress controller, load balancer). Better Auth walks x-forwarded-for right to left, skips
+    # these hops, and uses the first untrusted address as the client IP. Required for correct
+    # session IPs and rate-limit keying behind a multi-hop proxy chain (e.g. "10.0.0.0/16").
+    AUTH_TRUSTED_PROXIES: ""
     # SOCKET_SERVER_URL: Auto-detected when realtime.enabled=true (uses internal service)
     # NEXT_PUBLIC_SOCKET_URL: public WebSocket URL for browsers. Leave empty to default to the
     # page's own origin (assumes the ingress/reverse proxy routes /socket.io to the realtime service).