t.Run("case=remote-matches-cidr", func(t *testing.T) {
        c.MustSet(context.Background(), config.KeyTLSAllowTerminationFrom, []string{"126.0.0.1/24", "127.0.0.1/24"})

        res := httptest.NewRecorder()
        RejectInsecureRequests(r, c.TLS(context.Background(), config.PublicInterface))(res, &http.Request{