fix: unify browser origin configuration

2026-08-26 02:37:14 +09:00
parent 8396d09891
commit 33db2ea7f4
7 changed files with 182 additions and 47 deletions
@@ -64,6 +64,14 @@ docker/workspace/.yoi/workspace-backend.local.toml

 The WebUI container serves static assets and proxies `/api` to the Backend Server. The Backend Server registers the Runtime container as a remote Runtime such as `docker-runtime`. The Runtime container runs `yoi-runtime` and owns Worker spawning/materialization for that runtime.

+`YOI_BROWSER_PUBLIC_URL` is the single browser-facing deployment setting used by the Server for WebAuthn, device-login URLs, cookie policy, and cookie-authenticated mutation origin checks. Compose defaults it to `http://localhost:8080`; deployments exposed through another host, port, or HTTPS endpoint must set the exact Nginx-facing origin, for example:
+
+```text
+YOI_BROWSER_PUBLIC_URL=https://yoi.example.com docker compose up
+```
+
+The value is an origin, not an API/backend URL, and must not include a path, query, or fragment.
+
 Container user and writable data directories matter: runtime/server images must be able to write their configured data directories and named volumes. The current local-image Compose setup avoids an image-level `User` override and sets data-directory permissions accordingly.

 ## Worker launch path