feat: implement DASHBOARD_ORIGIN for invite and email links, enhancing self-hosted configuration and updating related documentation

This commit is contained in:
Rotimi Best
2026-03-11 17:00:44 +01:00
parent c5c65b96d7
commit fd11bdd4b0
14 changed files with 41 additions and 33 deletions
@@ -72,7 +72,7 @@ Docker self-hosting uses a single root `.env` file. Every `docker compose` comma
| `PRIVATE_SERVER_KEY` | Dashboard-to-API auth key (same in both) | Auto-generated |
| `PUBLIC_IS_SELFHOSTED` | Self-hosted mode flag | `true` |
| `PRIVATE_SERVER_URL` | Internal API URL for SSR (Docker network) | `http://api:3081` |
| `DASHBOARD_ORIGIN` | Dashboard URL for CSRF protection | `http://localhost:3082` |
| `DASHBOARD_ORIGIN` | Dashboard origin for invite links, email links, etc. | `http://localhost:3082` |
| `ALLOWED_EXTERNAL_DOMAINS` | CSP allowed domains (comma-separated) | — |
<Callout type="warn" title="CSP Domains">
@@ -191,6 +191,9 @@ AUTH_BEARER_TOKEN="some-key"
PRIVATE_SERVER_KEY="same-key-for-api-and-dashboard"
PUBLIC_IS_SELFHOSTED="true"
# Dashboard URL for invite/email links (e.g. https://app.yourdomain.com)
DASHBOARD_ORIGIN="https://app.yourdomain.com"
# Required for auth cookies when API and dashboard use different subdomains — set to your root domain, e.g. yourdomain.com
AUTH_COOKIE_DOMAIN="yourdomain.com"