From c64528a1d35435fe5cc329b6c0aefb2b66cb54c0 Mon Sep 17 00:00:00 2001 From: Mieszko Makuch Date: Wed, 29 Jul 2026 10:47:02 +0200 Subject: [PATCH] cors: full-origin ALLOW_DOMAIN (no SCHEME key in 1.27) + Authorization in allowed headers --- deploy/ctao-demo-gitea.container | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/deploy/ctao-demo-gitea.container b/deploy/ctao-demo-gitea.container index 03e476c..afaea50 100644 --- a/deploy/ctao-demo-gitea.container +++ b/deploy/ctao-demo-gitea.container @@ -42,10 +42,13 @@ Environment=GITEA__repository__DEFAULT_PRIVATE=public # Push-created repos have their OWN default (true = private) — learned the hard way: Environment=GITEA__repository__DEFAULT_PUSH_CREATE_PRIVATE=false # Sveltia is served from the portal vhost and calls the Gitea API cross-origin -# — CORS locked to exactly that origin. +# — CORS locked to exactly that origin. ALLOW_DOMAIN takes FULL origins with +# scheme (verified in the 1.27 config cheat sheet; a SCHEME key no longer +# exists). Authorization must be listed in HEADERS — the default set +# (Content-Type,User-Agent) would block Sveltia's authenticated API calls. Environment=GITEA__cors__ENABLED=true -Environment=GITEA__cors__SCHEME=https -Environment=GITEA__cors__ALLOW_DOMAIN=astro.isl-dev.grid.cyfronet.pl +Environment=GITEA__cors__ALLOW_DOMAIN=https://astro.isl-dev.grid.cyfronet.pl +Environment=GITEA__cors__HEADERS=Authorization,Content-Type,User-Agent Environment=GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS [Service]