modified: web/app.py

modified:   web/blueprints/auth.py
	modified:   web/blueprints/site_admin.py
	modified:   web/config.py
	modified:   web/panel_db.py
	modified:   web/templates/admin/audit_log.html
	modified:   web/templates/admin/dashboard.html
	new file:   web/templates/auth/consent.html

web/app.py

@@ -6,6 +6,7 @@ Coolify-kompatibel: alle Einstellungen via ENV.
 import secrets
 from datetime import datetime
 from flask import Flask, abort, render_template, request, session, url_for
+from werkzeug.middleware.proxy_fix import ProxyFix
 from config import Config
 from panel_db import init_databases, get_user_groups
 from roles import can_manage_group
@@ -28,6 +29,15 @@ def create_app() -> Flask:
 
     Config.validate_security()
 
+    # Reverse-Proxy: echte Client-IP aus X-Forwarded-For lesen
+    if Config.PROXY_COUNT > 0:
+        app.wsgi_app = ProxyFix(
+            app.wsgi_app,
+            x_for=Config.PROXY_COUNT,
+            x_proto=Config.PROXY_COUNT,
+            x_host=Config.PROXY_COUNT,
+        )
+
     # Blueprints registrieren
     app.register_blueprint(auth)
     app.register_blueprint(site_admin)