X_TRUST_PROXY_UNSET

proxy headers are trusted without saying how many proxies are in front

trustProxy: true with no trustedProxyHops. The leftmost x-forwarded-for entry is whatever the client typed, so without a hop count there is no way to tell the proxy's entry from the caller's — and every per-ip limit and lockout is then keyed on an address the caller chooses. Asked at defineHttpConfig in the same shape as X_RATE_LIMIT_NOT_SHARED, because only the app knows its own topology. Both keys are boot-owned and configureHttp() type-refuses them: a framework-booted process reads the hop count from the ENVIRONMENT, because one image runs behind an ingress in one cluster and behind nothing on a laptop

set TRUSTED_PROXY_HOPS in the deployment environment to the number of proxies that append to x-forwarded-for — 1 for a single ingress or ALB, 2 for a CDN in front of one — and leave it unset for a process reached directly (trustedHopsFromEnv, packages/cli/src/role-start.ts). An embedder calling defineHttpConfig itself passes { trustProxy: true, trustedProxyHops: 1 }