<?php
function clientIp(array $trustedProxies = []): ?string
{
    $remoteAddr = $_SERVER['REMOTE_ADDR'] ?? null;

    if (!is_string($remoteAddr) || filter_var($remoteAddr, FILTER_VALIDATE_IP) === false) {
        return null;
    }

    $trusted = array_fill_keys($trustedProxies, true);
    if (!isset($trusted[$remoteAddr])) {
        return $remoteAddr;
    }

    $forwardedFor = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? '';
    if (!is_string($forwardedFor) || $forwardedFor === '') {
        return $remoteAddr;
    }

    $chain = array_map('trim', explode(',', $forwardedFor));
    for ($index = count($chain) - 1; $index >= 0; $index--) {
        $candidate = $chain[$index];

        if ($candidate === '' || filter_var($candidate, FILTER_VALIDATE_IP) === false) {
            continue;
        }

        if (!isset($trusted[$candidate])) {
            return $candidate;
        }
    }

    return $remoteAddr;
}