diff --git a/main.go b/main.go
index 69d83c32..742d1551 100644
--- a/main.go
+++ b/main.go
@@ -172,7 +172,7 @@ func main() {
 
 	// Initialize HTTP server
 	server := gin.New()
-	if err := configureTrustedProxies(server); err != nil {
+	if err := middleware.ConfigureTrustedProxies(server); err != nil {
 		common.FatalLog("failed to configure trusted proxies: " + err.Error())
 		return
 	}
diff --git a/trusted_proxies.go b/middleware/trusted_proxies.go
similarity index 94%
rename from trusted_proxies.go
rename to middleware/trusted_proxies.go
index f4b338a6..bab8b646 100644
--- a/trusted_proxies.go
+++ b/middleware/trusted_proxies.go
@@ -1,4 +1,4 @@
-package main
+package middleware
 
 import (
 	"errors"
@@ -19,7 +19,7 @@ var defaultTrustedProxyCIDRs = []string{
 	"fc00::/7",
 }
 
-func configureTrustedProxies(engine *gin.Engine) error {
+func ConfigureTrustedProxies(engine *gin.Engine) error {
 	rawTrustedProxies := strings.TrimSpace(os.Getenv("TRUSTED_PROXIES"))
 	if rawTrustedProxies == "" {
 		log.Print("WARNING: TRUSTED_PROXIES is unset or blank; trusting loopback, RFC 1918, and IPv6 ULA proxy addresses for compatibility. Set TRUSTED_PROXIES=none to trust no proxies, or configure explicit proxy IPs/CIDRs to replace these defaults.")
diff --git a/trusted_proxies_test.go b/middleware/trusted_proxies_test.go
similarity index 92%
rename from trusted_proxies_test.go
rename to middleware/trusted_proxies_test.go
index 642b566e..a041d351 100644
--- a/trusted_proxies_test.go
+++ b/middleware/trusted_proxies_test.go
@@ -1,4 +1,4 @@
-package main
+package middleware
 
 import (
 	"net/http"
@@ -33,7 +33,7 @@ func TestConfigureTrustedProxiesDefaultsToLoopbackAndPrivateNetworks(t *testing.
 	gin.SetMode(gin.TestMode)
 	t.Setenv("TRUSTED_PROXIES", "")
 	router := newClientIPRouter()
-	require.NoError(t, configureTrustedProxies(router))
+	require.NoError(t, ConfigureTrustedProxies(router))
 
 	testCases := []struct {
 		name       string
@@ -59,7 +59,7 @@ func TestConfigureTrustedProxiesDefaultRejectsPublicPeerHeaders(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 	t.Setenv("TRUSTED_PROXIES", " \t ")
 	router := newClientIPRouter()
-	require.NoError(t, configureTrustedProxies(router))
+	require.NoError(t, ConfigureTrustedProxies(router))
 
 	clientIP := requestClientIP(router, "198.51.100.10:12345", "203.0.113.10")
 	assert.Equal(t, "198.51.100.10", clientIP, "a public peer must not make a spoofed X-Forwarded-For authoritative")
@@ -69,7 +69,7 @@ func TestConfigureTrustedProxiesDefaultStopsAtPublicClientInForwardedChain(t *te
 	gin.SetMode(gin.TestMode)
 	t.Setenv("TRUSTED_PROXIES", "")
 	router := newClientIPRouter()
-	require.NoError(t, configureTrustedProxies(router))
+	require.NoError(t, ConfigureTrustedProxies(router))
 
 	clientIP := requestClientIP(router, "172.20.0.2:12345", "192.0.2.99, 203.0.113.10")
 	assert.Equal(t, "203.0.113.10", clientIP, "the first public hop from the trusted proxy must win over a client-supplied prefix")
@@ -79,7 +79,7 @@ func TestConfigureTrustedProxiesNoneDisablesForwardedHeaders(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 	t.Setenv("TRUSTED_PROXIES", " NoNe ")
 	router := newClientIPRouter()
-	require.NoError(t, configureTrustedProxies(router))
+	require.NoError(t, ConfigureTrustedProxies(router))
 
 	clientIP := requestClientIP(router, "127.0.0.1:12345", "203.0.113.10")
 	assert.Equal(t, "127.0.0.1", clientIP)
@@ -89,7 +89,7 @@ func TestConfigureTrustedProxiesAcceptsTrimmedIPsAndCIDRs(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 	t.Setenv("TRUSTED_PROXIES", " 192.0.2.0/24, 198.51.100.30 ")
 	router := newClientIPRouter()
-	require.NoError(t, configureTrustedProxies(router))
+	require.NoError(t, ConfigureTrustedProxies(router))
 
 	trustedClientIP := requestClientIP(router, "192.0.2.10:12345", "203.0.113.20")
 	assert.Equal(t, "203.0.113.20", trustedClientIP)
@@ -121,7 +121,7 @@ func TestConfigureTrustedProxiesRejectsInvalidConfiguration(t *testing.T) {
 		t.Run(testCase.name, func(t *testing.T) {
 			t.Setenv("TRUSTED_PROXIES", testCase.value)
 			router := newClientIPRouter()
-			assert.Error(t, configureTrustedProxies(router))
+			assert.Error(t, ConfigureTrustedProxies(router))
 		})
 	}
 }