allow domains to get ips of users instead of docker 172

.env.example

@@ -47,6 +47,18 @@
 # OVERLORD_TLS_CERT=/custom/path/server.crt
 # OVERLORD_TLS_KEY=/custom/path/server.key
 
+# ============================================
+# ADVANCED: Reverse proxy / domain deployments
+# ============================================
+# If Overlord sits behind a reverse proxy (nginx, Caddy, Cloudflare, Traefik, Render,
+# etc.), the server otherwise sees the proxy's IP for every agent connection — the
+# dashboard, audit log, and IP bans all end up showing the proxy/Docker bridge IP
+# (commonly 172.x.x.x) instead of the real client. Set this to true ONLY when a
+# trusted reverse proxy is in front of Overlord; otherwise agents could spoof
+# their IP by sending their own X-Forwarded-For header. Auto-enabled when
+# OVERLORD_TLS_OFFLOAD=true. Honors X-Forwarded-For, X-Real-IP, CF-Connecting-IP.
+# OVERLORD_TRUST_PROXY=true
+
 # Agent builder settings (only needed if building agents)
 # TARGETS=windows/amd64,windows/386,windows/arm64,linux/amd64,linux/arm64,linux/arm/v7,darwin/amd64,darwin/arm64
 # GO_BUILD_FLAGS=-trimpath