diff --git a/INSTALL.md b/INSTALL.md
index 7cb0abe5..cecb7aae 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -129,7 +129,10 @@ deploy-path = "/newroot/"; # ending slash is important
 ```
 If you use nginx as a reverse proxy, you can simply replace `location /` with `location /newroot/` to achieve the same result.
 ## Reverse proxy settings
-_LMS_ is shipped with an embedded web server, but it is recommended to deploy behind a reverse proxy. You have to set the _behind-reverse-proxy_ option to _true_ in the `lms.conf` configuration file.
+_LMS_ is shipped with an embedded web server, but it is recommended to deploy behind a reverse proxy. You have to set the `behind-reverse-proxy` option to _true_ in the `lms.conf` configuration file and to adjust the trusted proxy list in `trusted-proxies` option.
+
+__Note__: when running in a docker environment, you have to trust the docker gateway IP (which is `172.17.0.1` by default)
+
 Here is an example to make _LMS_ properly work on _myserver.org_ using _nginx_:
 ```
 server {
@@ -147,10 +150,9 @@ server {
 	keepalive_timeout 10m;
 
     location / {
-
-      proxy_set_header        Client-IP $remote_addr;
       proxy_set_header        Host $host;
-      proxy_set_header        X-Forwarded-For $remote_addr;
+      proxy_set_header        X-Real-IP $remote_addr;
+      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header        X-Forwarded-Proto $scheme;
 
       proxy_pass          http://localhost:5082/;
diff --git a/approot/images/unknown-artist.jpg b/approot/images/unknown-artist.jpg
deleted file mode 100755
index 8c3285ef..00000000
Binary files a/approot/images/unknown-artist.jpg and /dev/null differ
diff --git a/conf/lms.conf b/conf/lms.conf
index 82b565ce..d3d7675b 100644
--- a/conf/lms.conf
+++ b/conf/lms.conf
@@ -19,6 +19,13 @@ db-show-queries = false;
 listen-port = 5082;
 listen-addr = "0.0.0.0";
 behind-reverse-proxy = false;
+# original-ip-header and trusted-proxies are used only if behind-reverse-proxy is set to true
+original-ip-header = "X-Forwarded-For";
+trusted-proxies =
+(
+	"127.0.0.1",
+	"::1"
+);
 
 # If enabled, these files have to exist and have correct permissions
 tls-enable = false;
diff --git a/src/lms/main.cpp b/src/lms/main.cpp
index f2586a48..bd6f3467 100644
--- a/src/lms/main.cpp
+++ b/src/lms/main.cpp
@@ -137,7 +137,16 @@ namespace lms
 
             // log-config
             pt.put("server.application-settings.log-config", core::logging::WtLogger::computeLogConfig(minSeverity));
-            pt.put("server.application-settings.behind-reverse-proxy", core::Service<core::IConfig>::get()->getBool("behind-reverse-proxy", false));
+
+            // Reverse proxy
+            if (core::Service<core::IConfig>::get()->getBool("behind-reverse-proxy", false))
+            {
+                pt.put("server.application-settings.trusted-proxy-config.original-ip-header", core::Service<core::IConfig>::get()->getString("original-ip-header", "X-Forwarded-For"));
+                core::Service<core::IConfig>::get()->visitStrings("trusted-proxies", [&](std::string_view trustedProxy) {
+                    pt.add("server.application-settings.trusted-proxy-config.trusted-proxies.proxy", std::string{ trustedProxy });
+                },
+                    { "127.0.0.1", "::1" });
+            }
 
             {
                 boost::property_tree::ptree viewport;