From fc9898c59b9322d0db0958f6213cff13691bd128 Mon Sep 17 00:00:00 2001
From: Paul Nothaft <paul@MacStudio-von-Paul.local>
Date: Sun, 4 Jan 2026 23:35:28 +0100
Subject: [PATCH] fix: Make CORS origins configurable via environment variable

Add CORS_ORIGINS environment variable to allow configuring allowed
origins in production. Defaults to the Traefik domain.
---
 backend/src/app.js          | 11 +++++------
 backend/src/config/index.js |  3 +++
 docker-compose.prod.yml     |  2 ++
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/backend/src/app.js b/backend/src/app.js
index 677c8d6..d5f0539 100644
--- a/backend/src/app.js
+++ b/backend/src/app.js
@@ -55,15 +55,14 @@ const corsOptions = {
   origin: function (origin, callback) {
     // Allow requests with no origin (mobile apps, Postman, etc)
     if (!origin) return callback(null, true);
-    
-    // In production, you might want to whitelist specific origins
-    if (config.app.env === 'production') {
-      const allowedOrigins = ['https://your-domain.com'];
-      if (allowedOrigins.indexOf(origin) === -1) {
+
+    // In production, check against configured allowed origins
+    if (config.app.env === 'production' && config.cors.origins.length > 0) {
+      if (config.cors.origins.indexOf(origin) === -1) {
         return callback(new Error('Not allowed by CORS'));
       }
     }
-    
+
     callback(null, true);
   },
   credentials: true,
diff --git a/backend/src/config/index.js b/backend/src/config/index.js
index 2519157..8d20ad2 100644
--- a/backend/src/config/index.js
+++ b/backend/src/config/index.js
@@ -44,6 +44,9 @@ const config = {
     port: parseInt(process.env.REDIS_PORT || '6379', 10),
     password: process.env.REDIS_PASSWORD,
   },
+  cors: {
+    origins: process.env.CORS_ORIGINS ? process.env.CORS_ORIGINS.split(',').map(o => o.trim()) : [],
+  },
 };
 
 // Validate required configuration
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 2a98438..719cdc4 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -42,6 +42,8 @@ services:
       - REPORT_SENDER=${REPORT_SENDER:-}
       - REPORT_RECIPIENT=${REPORT_RECIPIENT:-}
       - REPORT_SCHEDULE=${REPORT_SCHEDULE:-0 0 * * 1}
+      # CORS configuration
+      - CORS_ORIGINS=${CORS_ORIGINS:-https://minio-webui.local.nothaft.cloud}
     volumes:
       - /mnt/DockerMount/minio-webui/logs:/app/logs
       - /mnt/DockerMount/minio-webui/mc-config:/home/nodejs/.mc