Trusted Host Patterns Limit: Site Works Locally but Fails in Production When Host Header Differs

When developing a Drupal site locally, the trusted host validation is often bypassed, allowing the site to load without explicit entries in $settings['trusted_host_patterns']. In production, however, Drupal enforces the pattern list, and any request whose Host header does not match an allowed pattern results in a 403/503 response. This discrepancy becomes pronounced when the production environment sits behind a load balancer or SSL terminator that may alter or forward the Host header, requiring the pattern list to include the exact hostname seen by Drupal.

The goal is to define a trusted_host_patterns configuration that satisfies both the permissive local development environment and the strict production requirements without compromising security or requiring frequent manual updates.

What pattern array should be used when the site is accessed via a load balancer that preserves the original Host header? Should separate settings.php files be maintained for each environment, or can a single array safely contain both localhost and production hostnames? Is it acceptable to rely on the default permissive behavior for local development, or must explicit patterns be added to avoid unexpected failures when the code is promoted?