[marekmelichercik]

Standard on-prem installations previously left Apache proxy trust disabled and required operators to discover Caddy's address manually. Configure the bundled Caddy with a reserved address and make Apache trust that address automatically, building on the shared image's client-IP fix from https://github.com/eramba/eramba/pull/6276.

The internal network defaults to 172.30.50.0/24, with dynamic allocations restricted to 172.30.50.128/25 and Caddy reserved at 172.30.50.10. Operators can override APP_INTERNAL_SUBNET, APP_INTERNAL_IP_RANGE and PUBLIC_PROXY_IP. The same PUBLIC_PROXY_IP controls Caddy's address and Apache's default trust. The internal-network flag and Caddy's host-access connection remain intact.

Missing or empty TRUSTED_PROXIES selects the bundled Caddy address, including with older .env files. A nonempty comma-separated list replaces that default and must include Caddy plus any preserved trusted proxy hops. The separate space-separated CADDY_TRUSTED_PROXIES list still defaults to empty and names only external proxies before Caddy. Caddy parses trusted chains from right to left; Apache resolves its trusted hops and canonicalizes X-Forwarded-For before PHP. Enterprise inherits the shared configuration.

README covers automatic defaults, custom-network examples, external load balancers, and an explicit Compose override for disabling Apache trust. Existing installations need a maintenance-window network recreation without deleting volumes; the documented procedure preserves project/volume identity and accounts for subnet conflicts and older static-IP overrides. Ordinary Caddy recreation no longer requires rediscovering its IP.

Validation:

• All 16 Bats tests pass, covering Community/Enterprise contracts, missing/empty legacy settings, custom network values, explicit trust replacement and opt-out, real Caddy HTTPS requests with forged X-Forwarded-For, strict chain parsing, and address stability alongside a dynamic peer.
• Four new Compose contract checks failed against the original configuration before the implementation.
• A fresh isolated Community MySQL/Redis/Eramba/Caddy stack initialized using the official image. Real login API calls through Caddy and directly from an untrusted application-network peer both recorded the actual client address in the User Audit Trail despite forged X-Forwarded-For.
• Recreating Caddy in that running stack preserved its reserved address. Apache's generated trust configuration and syntax were verified.
• Caddy 2.8 configuration validation, seven README shell snippets, both README environment examples for both editions, and git diff --check pass.
• Independent review found no issues and checked eight additional read-only Compose combinations.
• Enterprise runtime, browser UI and session persistence were not verified in this update. The local application proof omitted unrelated MCP/cron/trigger services; existing full-stack CI remains in place.

Requires an Eramba image containing the Apache client-IP fix (3.31.1 or later). This PR does not change Laravel proxy handling, deploy SaaS infrastructure, or rewrite historical IP records.

[shrkz1]

[shrkz1]

Pôvodná požiadavka je splnená: štandardná Docker inštalácia má prednastavenú adresu Caddy a Apache ju automaticky dôveruje aj pri staršom .env bez nových premenných. Vlastné adresy a upstream proxy sa nastavujú len pri upravenom deploymente.

Prešiel som celý diff voči 1.x a na tomto SHA spustil všetkých 16 Bats testov; prešli. Community CI je zelené. Nenašiel som blokujúci nález. Enterprise som overil cez Compose konfiguráciu a testy, nie samostatným runtime nasadením.