docs(deploy): stop documenting API_ORIGIN as required

The swarm stack still hard-failed on an unset API_ORIGIN, and both the env
template and the README told the reader to pin it — the exact habit the derived
origin was meant to end. Make it an optional override everywhere, and say that
WEB_ORIGIN is now a list.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
2026-08-11 12:56:50 -07:00
co-authored by Claude Opus 5
parent 14c6183aa2
commit 683fd37b08
3 changed files with 29 additions and 7 deletions
+8 -1
View File
@@ -96,7 +96,14 @@ NEXT_PUBLIC_API_ORIGIN=http://localhost:3001
```
The API loads `DATABASE_URL`, `SESSION_SECRET`, `WEB_ORIGIN`, and optional
`PORT` (default `3001`). The web app only needs `NEXT_PUBLIC_API_ORIGIN`.
`PORT` (default `3001`). `WEB_ORIGIN` is comma-separated — list every origin the
app is reached under, or credentialed fetches from the missing ones fail CORS.
The web app needs no API URL of its own: the browser derives it from the page it
loaded (same host on port `3001` over plain HTTP, or the same-origin `/api` path
behind a TLS proxy). Set `NEXT_PUBLIC_API_ORIGIN` (dev) or `API_ORIGIN` (deploy,
read at request time) only to override that — for instance when running the API
on a non-default port.
### 3. Start MySQL