ctao/portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cors: full-origin ALLOW_DOMAIN (no SCHEME key in 1.27) + Authorization in allowed headers

Browse Source
This commit is contained in:
ctao
2026-07-29 10:47:02 +02:00
parent 746b015e85
commit c64528a1d3
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/ctao-demo-gitea.container
+6 -3
View File
@@ -42,10 +42,13 @@ Environment=GITEA__repository__DEFAULT_PRIVATE=public
# Push-created repos have their OWN default (true = private) — learned the hard way:
Environment=GITEA__repository__DEFAULT_PUSH_CREATE_PRIVATE=false
# Sveltia is served from the portal vhost and calls the Gitea API cross-origin
# — CORS locked to exactly that origin.
# — CORS locked to exactly that origin. ALLOW_DOMAIN takes FULL origins with
# scheme (verified in the 1.27 config cheat sheet; a SCHEME key no longer
# exists). Authorization must be listed in HEADERS — the default set
# (Content-Type,User-Agent) would block Sveltia's authenticated API calls.
Environment=GITEA__cors__ENABLED=true
Environment=GITEA__cors__SCHEME=https
Environment=GITEA__cors__ALLOW_DOMAIN=astro.isl-dev.grid.cyfronet.pl
Environment=GITEA__cors__ALLOW_DOMAIN=https://astro.isl-dev.grid.cyfronet.pl
Environment=GITEA__cors__HEADERS=Authorization,Content-Type,User-Agent
Environment=GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
[Service]