diff --git a/apps/templates/nextcloud-helm.yaml b/apps/templates/nextcloud-helm.yaml
index 55483f7..c1ea6c8 100644
--- a/apps/templates/nextcloud-helm.yaml
+++ b/apps/templates/nextcloud-helm.yaml
@@ -40,7 +40,7 @@ spec:
             proxy.config.php: |
               <?php
               $CONFIG = array (
-                'trusted_proxies' => ['10.0.0.0/8'],
+                'trusted_proxies' => ['10.0.0.0/8', '192.168.1.1/32'],
                 );
         phpClientHttpsFix:
           enabled: true
@@ -54,31 +54,31 @@ spec:
               more_set_headers "Strict-Transport-Security: max-age=15552000; includeSubDomains";
           #  kubernetes.io/tls-acme: "true"
             cert-manager.io/cluster-issuer: prod-cluster-issuer
-          #  # Keep this in sync with the README.md:
-            nginx.ingress.kubernetes.io/server-snippet: |
-              server_tokens off
-              proxy_hide_header X-Powered-By;
-              rewrite ^/.well-known/webfinger /index.php/.well-known/webfinger last;
-              rewrite ^/.well-known/nodeinfo /index.php/.well-known/nodeinfo last;
-              rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-              rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
-              location = /.well-known/carddav {
-                return 301 $scheme://$host/remote.php/dav;
-              }
-              location = /.well-known/caldav {
-                return 301 $scheme://$host/remote.php/dav;
-              }
-              location = /robots.txt {
-                allow all;
-                log_not_found off;
-                access_log off;
-              }
-              location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
-                deny all;
-              }
-              location ~ ^/(?:autotest|occ|issue|indie|db_|console) {
-                deny all;
-              }
+            #  # Keep this in sync with the README.md:
+            # nginx.ingress.kubernetes.io/server-snippet: |
+            #   server_tokens off
+            #   proxy_hide_header X-Powered-By;
+            #   rewrite ^/.well-known/webfinger /index.php/.well-known/webfinger last;
+            #   rewrite ^/.well-known/nodeinfo /index.php/.well-known/nodeinfo last;
+            #   rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
+            #   rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
+            #   location = /.well-known/carddav {
+            #     return 301 $scheme://$host/remote.php/dav;
+            #   }
+            #   location = /.well-known/caldav {
+            #     return 301 $scheme://$host/remote.php/dav;
+            #   }
+            #   location = /robots.txt {
+            #     allow all;
+            #     log_not_found off;
+            #     access_log off;
+            #   }
+            #   location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+            #     deny all;
+            #   }
+            #   location ~ ^/(?:autotest|occ|issue|indie|db_|console) {
+            #     deny all;
+            #   }
           tls:
             - secretName: nextcloud-tls
               hosts: