From 10047158b4ff1fbf0df7174e8b12404e0cc10bde Mon Sep 17 00:00:00 2001 From: enoch85 Date: Tue, 4 Aug 2026 22:58:12 +0000 Subject: [PATCH] docs: document CORS_ALLOWED_ORIGINS and fix broken Security page links Add the CORS_ALLOWED_ORIGINS environment variable to the Installation env table (Maintainerr/Maintainerr#3407). The bundled UI is same-origin with the API and does not need it; it is only for a separate front end. The Security & Authentication page lives in the current docs (/next/security/), but API.md and Configuration.md linked to it with an absolute /security, which resolves to the site root where the page does not exist yet, so the build flagged both as broken. Switch them to version-relative links (./Security.md) so they resolve within whichever version is viewed. docusaurus build now reports no broken links. --- docs/API.md | 2 +- docs/Configuration.md | 2 +- docs/Installation.mdx | 17 +++++++++-------- 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/docs/API.md b/docs/API.md index 3ddbf16a9..21c88aa80 100644 --- a/docs/API.md +++ b/docs/API.md @@ -9,7 +9,7 @@ hide: --- :::danger -:fire: :fire: The API, and all of Maintainerr for that matter, does not have an authentication method. There are certain API calls, that if you make your instance public facing, will expose your entire settings configuration. This could include all of your service's API keys. Proceed with extreme caution if you choose to expose Maintainerr to the public. See the [Security & Authentication](/security) page for guidance on protecting your instance. :fire: :fire: +:fire: :fire: The API, and all of Maintainerr for that matter, does not have an authentication method. There are certain API calls, that if you make your instance public facing, will expose your entire settings configuration. This could include all of your service's API keys. Proceed with extreme caution if you choose to expose Maintainerr to the public. See the [Security & Authentication](./Security.md) page for guidance on protecting your instance. :fire: :fire: ::: diff --git a/docs/Configuration.md b/docs/Configuration.md index 153e18441..ef0b51809 100644 --- a/docs/Configuration.md +++ b/docs/Configuration.md @@ -18,7 +18,7 @@ All Base URL settings are to be entered without the leading slash. ::: :::info Exposing Maintainerr to the internet -Maintainerr has no built-in login, so anyone who can reach it can read the credentials you enter below. Running it locally or reaching it over a VPN is fine and needs nothing extra. Only if you plan to put it directly on the internet, add an authenticating reverse proxy in front first - see [Security & Authentication](/security). +Maintainerr has no built-in login, so anyone who can reach it can read the credentials you enter below. Running it locally or reaching it over a VPN is fine and needs nothing extra. Only if you plan to put it directly on the internet, add an authenticating reverse proxy in front first - see [Security & Authentication](./Security.md). ::: ## General diff --git a/docs/Installation.mdx b/docs/Installation.mdx index 2085c14bc..26088453f 100644 --- a/docs/Installation.mdx +++ b/docs/Installation.mdx @@ -293,14 +293,15 @@ services: A list of all available environment variables are below. No other env variables are officially supported by Maintainerr. These are added either into the compose file or your docker run command. -| Variable | Default Value | Description | -| ------------ | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | -| TZ | _host timezone_ | Controls date formatting in logs. | -| UI_HOSTNAME | 0.0.0.0 | The listen host of the web server. Can be set to :: for IPv6. | -| UI_PORT | 6246 | The listen port of the web server. | -| BASE_PATH | | If reverse proxying with a subfolder you'll want to set this. Must be in the format of `/subfolder`. | -| LOG_LEVEL | info | Overrides the persisted log level for the current container process only. Accepted values are `debug`, `verbose`, `info`, `warn`, `error`, and `fatal`. | -| GITHUB_TOKEN | | GitHub Personal Access Token for higher API rate limits | +| Variable | Default Value | Description | +| -------------------- | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| TZ | _host timezone_ | Controls date formatting in logs. | +| UI_HOSTNAME | 0.0.0.0 | The listen host of the web server. Can be set to :: for IPv6. | +| UI_PORT | 6246 | The listen port of the web server. | +| BASE_PATH | | If reverse proxying with a subfolder you'll want to set this. Must be in the format of `/subfolder`. | +| LOG_LEVEL | info | Overrides the persisted log level for the current container process only. Accepted values are `debug`, `verbose`, `info`, `warn`, `error`, and `fatal`. | +| GITHUB_TOKEN | | GitHub Personal Access Token for higher API rate limits | +| CORS_ALLOWED_ORIGINS | | Comma-separated list of origins allowed to call the API cross-origin, e.g. `https://maintainerr.example.com`. Same-origin access (the bundled UI, including via localhost) always works and never needs this; only set it if a separate front end on a different origin calls the API. | :::tip If `BASE_PATH` is set, remember to prefix health-check probe paths accordingly (for example `/maintainerr/api/health/ready`).