From ee97ec9b23e95120f139d18455b0ba1970deb953 Mon Sep 17 00:00:00 2001
From: Adam French <adam.a.french@outlook.com>
Date: Sat, 11 Apr 2026 00:43:29 +0100
Subject: [PATCH] Pin app-network subnet to match trusted proxy CIDR

Gin's trusted proxies list is hardcoded to 172.28.0.0/16, but Docker was
assigning the bridge network whatever subnet was free, so c.ClientIP()
often returned nginx's container IP instead of the real client.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 docker-compose.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index 2060866..1b3fd06 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,9 @@
 networks:
     app-network:
         driver: bridge
+        ipam:
+            config:
+                - subnet: 172.28.0.0/16
 
 volumes:
     dbdata: