diff --git a/.env.example b/.env.example
index ba247e9..1cf9535 100644
--- a/.env.example
+++ b/.env.example
@@ -2,7 +2,7 @@
 ALISTEN_HOST=127.0.0.1                          # 绑定的 ip
 ALISTEN_PORT=9876                               # 监听的端口
 ALISTEN_ALLOWED_ORIGINS=""                      # 逗号分隔的 Origin 允许列表，留空时仅允许 ALISTEN_PUBLIC_URL
-ALISTEN_TRUSTED_PROXIES=""                      # 逗号分隔的 CIDR，来自这些地址的反向代理传来的 X-Forwarded-For 才被采信；留空时按连接的对端地址限流
+ALISTEN_TRUSTED_PROXIES=""                      # 逗号分隔的 IP 地址或 CIDR，来自这些地址的反向代理传来的 X-Forwarded-For 才被采信；留空时，compose.prod.yaml 信任 proxy 网络 172.31.250.0/24，其他情况按连接的对端地址限流
 ALISTEN_LOG_LEVEL=info                          # 日志等级, 可选值为 debug、info、warn、error
 ALISTEN_WORKER_TMP_SIZE="1g"                    # Worker 临时文件大小
 ALISTEN_ADMIN_TOKEN=""                          # 进入管理后台需要的凭证, 留空则禁用后台
diff --git a/compose.prod.yaml b/compose.prod.yaml
index e5dc230..ad4a5b5 100644
--- a/compose.prod.yaml
+++ b/compose.prod.yaml
@@ -53,6 +53,7 @@ services:
     environment:
       ALISTEN_PUBLIC_URL: https://${ALISTEN_DOMAIN}
       STORAGE_PUBLIC_URL: ${STORAGE_PUBLIC_URL}
+      ALISTEN_TRUSTED_PROXIES: ${ALISTEN_TRUSTED_PROXIES:-172.31.250.0/24}
     networks:
       - backend
       - db
@@ -115,6 +116,10 @@ services:
 networks:
   proxy:
     name: proxy
+    # traefik 经这个网络转发请求，serve 默认信任这个网段传来的 X-Forwarded-For。与已有的 docker 网络冲突时改这里，并同步修改 ALISTEN_TRUSTED_PROXIES。
+    ipam:
+      config:
+        - subnet: 172.31.250.0/24
   backend:
     name: alisten-backend
   db:
diff --git a/compose.yaml b/compose.yaml
index 7eaa430..0708347 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -40,7 +40,7 @@ services:
       <<: *alisten-env
       ALISTEN_PUBLIC_URL: ${ALISTEN_PUBLIC_URL}
       ALISTEN_ALLOWED_ORIGINS: ${ALISTEN_ALLOWED_ORIGINS}
-      ALISTEN_TRUSTED_PROXIES: ${ALISTEN_TRUSTED_PROXIES}
+      ALISTEN_TRUSTED_PROXIES: ${ALISTEN_TRUSTED_PROXIES:-}
       ALISTEN_ADMIN_TOKEN: ${ALISTEN_ADMIN_TOKEN}
       STORAGE_PUBLIC_URL: ${STORAGE_PUBLIC_URL}
       GOMAXPROCS: "2"