From 683fd37b081e733686639277b400f1f846fa2fa9 Mon Sep 17 00:00:00 2001 From: Ricardo Mancinas Date: Tue, 11 Aug 2026 12:56:50 -0700 Subject: [PATCH] docs(deploy): stop documenting API_ORIGIN as required MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The swarm stack still hard-failed on an unset API_ORIGIN, and both the env template and the README told the reader to pin it — the exact habit the derived origin was meant to end. Make it an optional override everywhere, and say that WEB_ORIGIN is now a list. Co-Authored-By: Claude Opus 5 --- README.md | 9 ++++++++- deploy/jorgecuadros-app.env.example | 19 +++++++++++++++---- deploy/jorgecuadros-app.stack.yml | 8 ++++++-- 3 files changed, 29 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 77826db..e2db77e 100644 --- a/README.md +++ b/README.md @@ -96,7 +96,14 @@ NEXT_PUBLIC_API_ORIGIN=http://localhost:3001 ``` The API loads `DATABASE_URL`, `SESSION_SECRET`, `WEB_ORIGIN`, and optional -`PORT` (default `3001`). The web app only needs `NEXT_PUBLIC_API_ORIGIN`. +`PORT` (default `3001`). `WEB_ORIGIN` is comma-separated — list every origin the +app is reached under, or credentialed fetches from the missing ones fail CORS. + +The web app needs no API URL of its own: the browser derives it from the page it +loaded (same host on port `3001` over plain HTTP, or the same-origin `/api` path +behind a TLS proxy). Set `NEXT_PUBLIC_API_ORIGIN` (dev) or `API_ORIGIN` (deploy, +read at request time) only to override that — for instance when running the API +on a non-default port. ### 3. Start MySQL diff --git a/deploy/jorgecuadros-app.env.example b/deploy/jorgecuadros-app.env.example index 1ca4064..dd318c9 100644 --- a/deploy/jorgecuadros-app.env.example +++ b/deploy/jorgecuadros-app.env.example @@ -8,10 +8,21 @@ APP_TAG=latest # --- Public URLs (what the end user's BROWSER hits) --------------------------- -# API_ORIGIN is injected into the web app at runtime and used for browser fetches -# + document download links, so it must be browser-reachable (not swarm-internal). -# WEB_ORIGIN is the web app's own public origin; the API allows it via CORS. -API_ORIGIN=http://192.168.4.212:3001 +# API_ORIGIN is OPTIONAL and normally left unset. The browser derives the API +# origin from the page it loaded (apps/web/src/lib/api.ts): same host on port +# 3001 over plain HTTP, or the same-origin /api path when the page is served +# over https by a TLS-terminating proxy that maps /api to the API. That is what +# lets the same deployment move — tailnet, office LAN, demo domain — untouched. +# Set it only when the API genuinely lives on a different host than the web app; +# it is used for browser fetches AND document download links, so it must be +# browser-reachable (never a swarm-internal name). +#API_ORIGIN=http://192.168.4.212:3001 +# +# WEB_ORIGIN is the list of public origins the web app is reached under; the API +# allows them via CORS. COMMA-SEPARATED — one deployment is reachable under +# several origins (LAN IP, tailnet name, demo domain) and a credentialed fetch +# from an origin missing here gets no CORS headers and fails. A same-origin +# setup (web + API behind one proxy) never hits CORS at all. WEB_ORIGIN=http://192.168.4.212:3000 # Published ports on the swarm host. diff --git a/deploy/jorgecuadros-app.stack.yml b/deploy/jorgecuadros-app.stack.yml index 2068dd5..aecd0ce 100644 --- a/deploy/jorgecuadros-app.stack.yml +++ b/deploy/jorgecuadros-app.stack.yml @@ -92,8 +92,12 @@ services: labels: io.jorgecuadros.role: "web" environment: - # Public API URL the browser calls (injected at runtime, see layout.tsx). - API_ORIGIN: ${API_ORIGIN:?API_ORIGIN must be set} + # OPTIONAL override of the API URL the browser calls (injected at runtime, + # see layout.tsx). Leave it unset: the browser then derives the origin + # from the page it loaded — same host on port 3001 over plain HTTP, or + # /api behind a TLS-terminating proxy. Set it only when the API really + # lives on a different host than the web app. + API_ORIGIN: ${API_ORIGIN:-} ports: - target: 3000 published: ${WEB_PORT:-3000}