Answer only to the host names of Bindery

Without a login, a web page that the user visits could reach Bindery under a name of its own that points at the address of Bindery, and read and change everything. The "none" mode now answers only to addresses and to names of a private network. ALLOWED_HOSTS sets the names for each mode.
2026-10-02 23:37:33 +02:00
parent 2d9796d77c
commit 751b52da77
7 changed files with 113 additions and 0 deletions
@@ -21,6 +21,8 @@ services:
      # CWA_DB_PATH: /cwa-config/app.db
      # CALIBRE_DB_PATH: /calibre-library/metadata.db
      # URL_BASE: /bindery
+      # The host names that Bindery answers to. AUTH_METHOD=none needs this for a public name such as this one.
+      # ALLOWED_HOSTS: bindery.example.com
      # true only if clients reach Bindery through a reverse proxy alone. The login lockout then uses X-Forwarded-For.
      # TRUST_PROXY: "true"
      # For AUTH_METHOD=proxy: the address of the proxy. The default trusts each private address.