Add HTTP proxy trust config to Home Assistant init container

Home Assistant was returning 400 errors because it received
X-Forwarded-For headers from the Istio ingress gateway but wasn't
configured to trust reverse proxies. Add use_x_forwarded_for and
trusted_proxies to the init container's configuration.yaml template.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/home-assistant/values.yaml

@@ -49,11 +49,18 @@ initContainers:
 
         # Ensure OIDC config is in configuration.yaml
         if [ ! -f /config/configuration.yaml ]; then
-          echo "Creating configuration.yaml with OIDC config..."
+          echo "Creating configuration.yaml with OIDC + HTTP proxy config..."
           cat > /config/configuration.yaml <<'OIDCEOF'
         # Home Assistant Configuration
         default_config:
 
+        # Trust reverse proxy (Istio ingress gateway) for X-Forwarded-For
+        http:
+          use_x_forwarded_for: true
+          trusted_proxies:
+            - 10.0.0.0/8
+            - 172.16.0.0/12
+
         # OIDC Authentication via Authentik
         openid:
           client_id: !secret oidc_client_id
@@ -64,7 +71,9 @@ initContainers:
           create_user: true
           block_login: false
         OIDCEOF
-        elif ! grep -q "^openid:" /config/configuration.yaml; then
+        else
+          # Ensure OIDC config exists
+          if ! grep -q "^openid:" /config/configuration.yaml; then
             echo "Appending OIDC config to existing configuration.yaml..."
             cat >> /config/configuration.yaml <<'OIDCEOF'
 
@@ -81,6 +90,22 @@ initContainers:
           else
             echo "OIDC config already present in configuration.yaml"
           fi
+          # Ensure HTTP proxy trust exists
+          if ! grep -q "use_x_forwarded_for:" /config/configuration.yaml; then
+            echo "Appending HTTP proxy config..."
+            cat >> /config/configuration.yaml <<'HTTPEOF'
+
+        # Trust reverse proxy (Istio ingress gateway) for X-Forwarded-For
+        http:
+          use_x_forwarded_for: true
+          trusted_proxies:
+            - 10.0.0.0/8
+            - 172.16.0.0/12
+        HTTPEOF
+          else
+            echo "HTTP proxy config already present"
+          fi
+        fi
     volumeMounts:
       - name: config
         mountPath: /config