Document the per-binding scope of security and client-IP settings, and the loaddata-mode default

Disclaimer: AI-drafted, verified by me before filing. I answer follow-ups.

Is your feature request related to a problem? Please describe.

Three entries in the configuration reference describe a setting's scope or requirements in a way that does not match the code. In each case the setting is accepted and nothing indicates it is not doing what it says, so the misconfiguration is only visible by reading the source.

I deployed SFTPGo behind a reverse proxy believing it had security headers and correct client-IP resolution. It had neither.

1. security, client_ip_proxy_header and client_ip_header_depth are documented under "HTTP server"; they live in httpd.bindings[].

The reference lists them in the same section as templates_path and signing_passphrase, which are global. Set at the httpd level they are ignored: no CSP, no nosniff, no HSTS.

2. client_ip_proxy_header requires the peer to appear in proxy_allowed.

The reference documents the header without mentioning that requirement. Without it the header is discarded, so behind a proxy every request resolves to the proxy's own address and the per-IP rate limiters and defender stop distinguishing clients — one client's failed logins then count against all of them.

3. --loaddata-from does not state that loaddata-mode defaults to 1.

Mode 1 skips objects that already exist, so a data file kept under configuration management applies to a fresh database and is inert afterwards. --loaddata-mode documents its own values, but the default is not mentioned where --loaddata-from is introduced, which is where someone automating a deployment will read.

Describe the solution you'd like

State the per-binding scope in the reference for the settings in (1), note the proxy_allowed requirement alongside client_ip_proxy_header in (2), and mention the default mode where --loaddata-from is described in (3).

What are you using SFTPGo for?

Private user, home usecase (home backup/VPS)

Additional context

Checked against 2.7.5.