diff --git a/docker-compose.yml b/docker-compose.yml
index 0219e96..829880f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,21 +7,15 @@ services:
     restart: unless-stopped
 
     environment:
-      # Your domain, e.g. timelog.example.com — Caddy fetches a certificate for it.
-      # Set to :80 instead if you terminate TLS on an upstream reverse proxy.
       SITE_ADDRESS: ${SITE_ADDRESS:?set SITE_ADDRESS in .env}
-      # Used by Let's Encrypt for expiry warnings. Required: Caddy fails to parse
-      # its config with an empty value, so this is checked here rather than
-      # crash-looping the container.
       ACME_EMAIL: ${ACME_EMAIL:?set ACME_EMAIL in .env}
+      TRUST_PROXY: ${TRUST_PROXY:?set TRUST_PROXY in .env}
 
     ports:
-      - ${LISTEN_IP:?0.0.0.0}:80:80 # required: the ACME HTTP challenge and the HTTPS redirect
+      - ${LISTEN_IP:?0.0.0.0}:80:80
       - ${LISTEN_IP:?0.0.0.0}:443:443
-      - ${LISTEN_IP:?0.0.0.0}:443:443/udp # HTTP/3
+      - ${LISTEN_IP:?0.0.0.0}:443:443/udp
 
     volumes:
-      # Certificates live here. Without this volume Caddy re-issues on every
-      # recreate and will hit the Let's Encrypt rate limit within a few restarts.
       - ./caddy/data:/data
       - ./caddy/config:/config
\ No newline at end of file