I was struggling with this for a configuration that was behind an Amazon application load balancer. The solution is simple, but for some reason I never got the combination of config items correct until today. Here's what we're using, where 10.0.0.0/16 is our VPC subnet.
web:
address: ":80"
proxyProtocol:
trustedIPs:
- "10.0.0.0/16"
forwardedHeaders:
trustedIPs:
- "10.0.0.0/16"
websecure:
address: ":443"
proxyProtocol:
trustedIPs:
- "10.0.0.0/16"
forwardedHeaders:
trustedIPs:
- "10.0.0.0/16"