fix: trust Dokploy's Traefik proxy via LOADBALANCER_IPS

Zulip 12 rejects requests forwarded by an untrusted reverse proxy with
a 500 "Proxy-Misconfiguration: Incorrect reverse proxy IPs set in
Zulip" error page. TRUST_GATEWAY_IP=True only whitelists the
container's default-route gateway IP, but Dokploy's Traefik connects
from its own container IP on the (dynamically-subnetted) compose
network, so it was never trusted.

Replace TRUST_GATEWAY_IP with LOADBALANCER_IPS covering the RFC1918
ranges, which Zulip feeds into nginx set_real_ip_from / its trusted
proxy list, so Traefik is trusted regardless of which Docker subnet it
connects from.

Also align meta.json version with the shipped image tag (12.1-0).

Note: the zulip-server image ships a HEALTHCHECK (/health, 300s start
period) and first boot runs full migrations, so Traefik only exposes
the router once the container turns healthy — expect several minutes
of 404 on the domain right after the first deploy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

blueprints/zulip/docker-compose.yml

@@ -86,7 +86,7 @@ services:
       SETTING_RABBITMQ_HOST: rabbitmq
       SETTING_REDIS_HOST: redis
       CONFIG_application_server__http_only: "true"
-      TRUST_GATEWAY_IP: ${ZULIP_TRUST_GATEWAY_IP}
+      LOADBALANCER_IPS: ${ZULIP_LOADBALANCER_IPS}
     volumes:
       - zulipData:/data
     ulimits:

blueprints/zulip/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "zulip",
   "name": "Zulip",
-  "version": "12.0-1",
+  "version": "12.1-0",
   "description": "Open-source threaded team chat designed to keep team communication organized and productive.",
   "logo": "zulip.svg",
   "links": {

blueprints/zulip/template.toml

@@ -11,7 +11,7 @@ env = [
   "ZULIP_RABBITMQ_PASSWORD=${password:32}",
   "ZULIP_REDIS_PASSWORD=${password:32}",
   "ZULIP_SECRET_KEY=${password:64}",
-  "ZULIP_TRUST_GATEWAY_IP=True",
+  "ZULIP_LOADBALANCER_IPS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16",
 ]
 mounts = []