fix: Make CORS origins configurable via environment variable

Add CORS_ORIGINS environment variable to allow configuring allowed
origins in production. Defaults to the Traefik domain.

backend/src/app.js

@@ -55,15 +55,14 @@ const corsOptions = {
   origin: function (origin, callback) {
     // Allow requests with no origin (mobile apps, Postman, etc)
     if (!origin) return callback(null, true);
-    
-    // In production, you might want to whitelist specific origins
-    if (config.app.env === 'production') {
-      const allowedOrigins = ['https://your-domain.com'];
-      if (allowedOrigins.indexOf(origin) === -1) {
+
+    // In production, check against configured allowed origins
+    if (config.app.env === 'production' && config.cors.origins.length > 0) {
+      if (config.cors.origins.indexOf(origin) === -1) {
         return callback(new Error('Not allowed by CORS'));
       }
     }
-    
+
     callback(null, true);
   },
   credentials: true,

backend/src/config/index.js

@@ -44,6 +44,9 @@ const config = {
     port: parseInt(process.env.REDIS_PORT || '6379', 10),
     password: process.env.REDIS_PASSWORD,
   },
+  cors: {
+    origins: process.env.CORS_ORIGINS ? process.env.CORS_ORIGINS.split(',').map(o => o.trim()) : [],
+  },
 };
 
 // Validate required configuration

docker-compose.prod.yml

@@ -42,6 +42,8 @@ services:
       - REPORT_SENDER=${REPORT_SENDER:-}
       - REPORT_RECIPIENT=${REPORT_RECIPIENT:-}
       - REPORT_SCHEDULE=${REPORT_SCHEDULE:-0 0 * * 1}
+      # CORS configuration
+      - CORS_ORIGINS=${CORS_ORIGINS:-https://minio-webui.local.nothaft.cloud}
     volumes:
       - /mnt/DockerMount/minio-webui/logs:/app/logs
       - /mnt/DockerMount/minio-webui/mc-config:/home/nodejs/.mc