From 2a6a67b8d4f9cfbda2c61c1f035e9f00c646908c Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 16 May 2026 12:52:09 +0300
Subject: [PATCH] nixos/oauth2-proxy: fix warning condition

---
 nixos/modules/services/security/oauth2-proxy.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/security/oauth2-proxy.nix b/nixos/modules/services/security/oauth2-proxy.nix
index 756857524f14..d0a5051c7b76 100644
--- a/nixos/modules/services/security/oauth2-proxy.nix
+++ b/nixos/modules/services/security/oauth2-proxy.nix
@@ -629,7 +629,7 @@ in
       }
     ];
 
-    warnings = lib.mkIf (cfg.reverseProxy -> cfg.trustedProxyIP == [ ]) [
+    warnings = lib.mkIf (cfg.reverseProxy && cfg.trustedProxyIP == [ ]) [
       ''
         When config.services.oauth2-proxy.reverseProxy is enabled, configure config.services.oauth2-proxy.trustedProxyIP to the IPs or CIDR range(s) of the reverse proxies that are allowed to send X-Forwarded-* headers.
         If you leave it unset, OAuth2 Proxy currently trusts all source IPs for backwards compatibility, which means a client that can reach OAuth2 Proxy directly may be able to spoof forwarded headers.