README.md

@@ -400,10 +400,9 @@ the bucket is. See [Rate Limiting](#rate-limiting).
 
 The remedy is to set `TRUSTED_PROXIES` to your reverse proxy's
 address, which restores per-client buckets. webhooker logs a warning
-at startup whenever `TRUSTED_PROXIES` is empty, in every environment —
-the warning does not depend on `WEBHOOKER_ENVIRONMENT`, because an
-operator who never configured the deployment is precisely the one at
-risk. The warning is informational when nothing proxies to the
+at startup whenever `TRUSTED_PROXIES` is empty, in every environment,
+because behind a proxy every client shares one bucket in `dev` and
+`prod` alike. The warning is informational when nothing proxies to the
 process: with no proxy in front, the peer address is the client's own
 and the buckets are already per-client. See
 [Rate Limiting](#rate-limiting) for what each limit shares.
@@ -639,7 +638,6 @@ decision:
 docker run -d \
   -p 127.0.0.1:8080:8080 \
   -v /path/to/data:/var/lib/webhooker \
-  -e WEBHOOKER_ENVIRONMENT=prod \
   -e BIND_ADDRESS=0.0.0.0 \
   webhooker:latest
 ```
@@ -856,7 +854,6 @@ sent — `$scheme` above does.
 With that block, webhooker's environment is:
 
 ```sh
-WEBHOOKER_ENVIRONMENT=prod
 BIND_ADDRESS=127.0.0.1   # the default; stated here to be explicit
 TRUSTED_PROXIES=127.0.0.1
 ```

internal/config/config.go

@@ -774,10 +774,8 @@ func (c *Config) warnEgressAllowlist(log *slog.Logger) {
 // everyone else's wrong passwords, and the receiver's limits become
 // service-wide ceilings.
 //
-// The warning is deliberately not gated on WEBHOOKER_ENVIRONMENT: an
-// operator who never configured the deployment is exactly the case it
-// exists to catch, so the exposure it announces is independent of the
-// environment setting.
+// The warning is deliberately not gated on WEBHOOKER_ENVIRONMENT:
+// behind a proxy every client shares one bucket in dev and prod alike.
 //
 // The default of trusting nobody is deliberate — trusting forwarded
 // headers from arbitrary peers lets any client choose its own bucket —

internal/config/config_test.go

@@ -849,9 +849,8 @@ func TestEgressAllowlistWarning(t *testing.T) {
 // rate-limit bucket between every client, which turns the receiver
 // limits into service-wide ceilings and collapses login failure
 // counting. It must fire whenever TRUSTED_PROXIES is empty, in any
-// environment: the warning does not depend on WEBHOOKER_ENVIRONMENT,
-// since an operator who never configured the deployment is exactly the
-// one it exists to catch. It stays quiet once proxies are named.
+// environment, because behind a proxy every client shares one bucket
+// in dev and prod alike. It stays quiet once proxies are named.
 func TestSharedRateLimitBucketWarning(t *testing.T) {
 	tests := []struct {
 		name           string
@@ -871,9 +870,6 @@ func TestSharedRateLimitBucketWarning(t *testing.T) {
 			expectWarning:  false,
 		},
 		{
-			// An internet-exposed deployment whose operator set
-			// WEBHOOKER_ENVIRONMENT=dev has exactly the exposure
-			// the warning announces.
 			name:          "dev without trusted proxies warns",
 			environment:   config.EnvironmentDev,
 			expectWarning: true,