framework:
    secret: '%env(APP_SECRET)%'
    router:
        utf8: true
    php_errors:
        log: true
    assets: ~
    # Traefik terminates TLS and forwards plain HTTP to this container over
    # the docker network, so Symfony has to be told to trust and read its
    # X-Forwarded-* headers — otherwise isSecure()/generated absolute URLs
    # think every request is plain HTTP. Docker's private bridge-network
    # ranges, not a fixed IP, since Traefik's container address isn't stable
    # across restarts.
    trusted_proxies: '127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16'
    trusted_headers: ['x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-port']