server

The server block lives in the ROOT settings.json — the file next to the binary that also holds site, cache, access_log and soe. Everything content-related lives in each site’s own settings.json (see Sites & domains).

key	default	description
host, port	—	bind address; the bootstrap writes `0.0.0.0:8080`
max_body_size	65536	POST body limit in bytes; larger requests get 413
trusted_proxies	[]	IPs or CIDR subnets of reverse proxies whose `X-Real-IP` / `X-Forwarded-Proto` headers are honored
default	—	which `site` entry answers requests with an unknown or missing Host header (direct-IP hits, health checks)
tls_port	—	the HTTPS port once a site declares tls (see the tls article)

Exposed directly to the internet (IP headers are ignored):

"server": {
  "host": "0.0.0.0",
  "port": 80,
  "max_body_size": 65536,
  "trusted_proxies": [],
  "default": "example.com"
}

Behind nginx on the same host (listens on localhost only, trusts the proxy for X-Real-IP):

"server": {
  "host": "127.0.0.1",
  "port": 8080,
  "max_body_size": 65536,
  "trusted_proxies": ["127.0.0.1"],
  "default": "example.com"
}

The client IP (rate limits, the request log) is resolved in one of two deployment modes:

Exposed directly — keep trusted_proxies empty: all IP headers are ignored, the TCP connection address is used.
Behind a reverse proxy — list the proxy address (e.g. ["127.0.0.1"]) and make the proxy overwrite X-Real-IP, so a client-supplied value can never get through:

proxy	config line
nginx	`proxy_set_header X-Real-IP $remote_addr;`
Apache	`RequestHeader set X-Real-IP "expr=%{REMOTE_ADDR}"`
Caddy	`header_up X-Real-IP {remote_host}`
HAProxy	`http-request set-header X-Real-IP %[src]`

Full nginx site block (proxy on the same host, TLS terminated at nginx). The upstream block with keepalive matters: without it nginx opens a new TCP connection to the app for every request, which caps throughput several times below what the engine can serve:

upstream cms_up {
    server 127.0.0.1:8080;
    keepalive 64;
}

server {
    listen 443 ssl;
    server_name example.com;
    # ssl_certificate ...;

    location / {
        proxy_pass http://cms_up;
        proxy_http_version 1.1;
        proxy_pass_header  Server;
        proxy_set_header Connection        "";
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Also forward X-Forwarded-Proto so the app knows http vs https (Secure cookies, correct redirects and log scheme). Use $remote_addr, never $http_x_real_ip — the latter forwards the client's own header, a spoofing hole. cms tune proxy writes the matching settings.json automatically.