use cratestack::{ForwardedHeader, TrustedProxyConfig};

let config = TrustedProxyConfig::trusting([
    "10.0.0.0/8".parse().unwrap(),      // internal load balancer subnet
    "203.0.113.5".parse::<std::net::IpAddr>().unwrap().into(), // exact peer
])
.max_hops(1)
.forwarded_header(ForwardedHeader::XForwardedFor); // the default; shown for clarity

X-Forwarded-For: 6.6.6.6, 203.0.113.9, 192.0.2.55
                 ^attacker  ^real client  ^what the trusted
                  spoofed                  proxy's own peer
                  (ignored)                 forwarded (its hop)

use std::net::SocketAddr;
use cratestack::axum::Extension;

let router = cratestack_schema::axum::router(db, procedures, JsonCodec, auth)
    // 1. Tell the router which peers/headers to trust.
    .layer(Extension(
        TrustedProxyConfig::trusting(["10.0.0.0/8".parse().unwrap()]).max_hops(1),
    ));

let listener = tokio::net::TcpListener::bind(addr).await?;

// 2. Serve through connect-info so a verified socket peer is ever
//    available to check against the allowlist in the first place.
axum::serve(
    listener,
    // NOT `router.into_make_service()` — that never populates
    // `ConnectInfo<SocketAddr>`, so step 1's allowlist has no peer
    // address to match against and every request behaves exactly as if
    // `TrustedProxyConfig` were never applied.
    router.into_make_service_with_connect_info::<SocketAddr>(),
)
.await?;