proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-NginX-Proxy true;

            # This is necessary to pass the correct IP to be hashed
            real_ip_header X-Real-IP;

            proxy_connect_timeout 300;
            

            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-NginX-Proxy true;

            # This is necessary to pass the correct IP to be hashed
            real_ip_header X-Real-IP;

            proxy_connect_timeout 300;
            

    // Private helper methods

    private int getMaxChannelsFromConfig(Configuration config) {
        // In a real implementation, this would read from configuration
        return 4; // Default to 4 channels
    }

    private LoadBalancingStrategy getLoadBalancingStrategyFromConfig(Configuration config) {
        // In a real implementation, this would read from configuration
        return LoadBalancingStrategy.ROUND_ROBIN;
    }

        // Default constructor
    }

    private static final Logger log = LoggerFactory.getLogger(DisniRdmaProvider.class);

    // DiSNI components - these would be actual DiSNI objects in a real implementation
    private Object endpointGroup; // RdmaActiveEndpointGroup<DisniRdmaEndpoint>
    private Object endpoint; // RdmaActiveEndpoint
    private boolean initialized = false;

    @Override

        // 127.0.0.1 is configured as a trusted proxy by default
        final MockletHttpServletRequest request = getMockRequest();
        request.setRemoteAddr("127.0.0.1");
        request.addHeader("X-Real-IP", "203.0.113.75");
        assertEquals("203.0.113.75", rateLimitHelper.getClientIp(request));
    }

    @Test
    public void test_getClientIp_xForwardedForPriority_trustedProxy() {

			UpdatedAt: lastUpdate,
		})
		if err != nil {
			replLogOnceIf(
				ctx,
				fmt.Errorf("Unable to heal IAM policy %s from peer site %s -> site %s : %w", policy, latestPeerName, peerName, err),
				fmt.Sprintf("heal-policy-%s", policy))
		}
	}
	return nil
}

// heal user policy mappings present on this site to peers, provided current cluster has the most recent update.

    }

    /**
     * Integration test that would require a real cluster environment.
     * Disabled by default - enable with -Dwitness.integration.test=true
     */
    @Test
    void testWitnessEnvironmentConfiguration() throws Exception {
        // Test simulating real witness environment scenarios
        // This test validates integration patterns without requiring real cluster

        // Simulate witness service discovery

    SmbTransport transport;

    // static helper that returns the mocked transport. The real class
    // performs several other operations, but for the purpose of the test
    // we intercept the factory call.
    private MockedStatic<SmbTransport> smbtStatic;

    @BeforeEach
    void setUp() throws Exception {
        // Create a real NtlmPasswordAuthentication instance

docker-compose -f docker-compose-site2.yaml up -d

./mc ready site1/
./mc ready site2/

for i in $(seq 1 10); do
	# mc admin heal -r --remove when used against a LB endpoint
	# behaves flaky, let this run 10 times before giving up
	./mc admin heal -r --remove --json site1/ 2>&1 >/dev/null
	./mc admin heal -r --remove --json site2/ 2>&1 >/dev/null
done

        if (cause instanceof ClSQLException) {
            return ((ClSQLException) cause).getSql();
        }
        return "";
    }

    /**
     * Returns the real message.
     *
     * @param cause the underlying exception
     * @return the real message
     */
    protected static String getRealMessage(final SQLException cause) {
        final StringBuilder buf = new StringBuilder(256);