Warning in console: The reverse proxy header configuration is incorrect. This is a security issue and can allow an attacker to spoof their IP address as visible to the Nextcloud

[wwe]

You can consult Apache Docker behind reverse proxy for hints how to adopt Apache to use real IP.

@4slam

They don’t keep a list of proxy IP addresses that I can specify in the trusted_proxies config parameter.

this is a problem as if you don’t limit the header to “known good” trusted proxies everybody could spoof the originating IPs. There is no need to know exact IPs you can use IP ranges like 192.168.0.0/24

If you don’t care about spoofing you can provide the whole IPv4 range (but I’m not going to share the syntax to avoid “copy&paste admins” from adopting this insecure approach).