Skip to content

docs: document CORS_ALLOWED_ORIGINS and fix broken Security page links #137

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
enoch85 merged 1 commit into from
Aug 4, 2026
Merged

docs: document CORS_ALLOWED_ORIGINS and fix broken Security page links #137

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/API.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ hide:
---

:::danger
:fire: :fire: The API, and all of Maintainerr for that matter, does not have an authentication method. There are certain API calls, that if you make your instance public facing, will expose your entire settings configuration. This could include all of your service's API keys. Proceed with extreme caution if you choose to expose Maintainerr to the public. See the [Security & Authentication](/security) page for guidance on protecting your instance. :fire: :fire:
:fire: :fire: The API, and all of Maintainerr for that matter, does not have an authentication method. There are certain API calls, that if you make your instance public facing, will expose your entire settings configuration. This could include all of your service's API keys. Proceed with extreme caution if you choose to expose Maintainerr to the public. See the [Security & Authentication](./Security.md) page for guidance on protecting your instance. :fire: :fire:

:::

Expand Down
2 changes: 1 addition & 1 deletion docs/Configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ All Base URL settings are to be entered without the leading slash.
:::

:::info Exposing Maintainerr to the internet
Maintainerr has no built-in login, so anyone who can reach it can read the credentials you enter below. Running it locally or reaching it over a VPN is fine and needs nothing extra. Only if you plan to put it directly on the internet, add an authenticating reverse proxy in front first - see [Security & Authentication](/security).
Maintainerr has no built-in login, so anyone who can reach it can read the credentials you enter below. Running it locally or reaching it over a VPN is fine and needs nothing extra. Only if you plan to put it directly on the internet, add an authenticating reverse proxy in front first - see [Security & Authentication](./Security.md).
:::

## General
Expand Down
17 changes: 9 additions & 8 deletions docs/Installation.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,14 +293,15 @@ services:

A list of all available environment variables are below. No other env variables are officially supported by Maintainerr. These are added either into the compose file or your docker run command.

| Variable | Default Value | Description |
| ------------ | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| TZ | _host timezone_ | Controls date formatting in logs. |
| UI_HOSTNAME | 0.0.0.0 | The listen host of the web server. Can be set to :: for IPv6. |
| UI_PORT | 6246 | The listen port of the web server. |
| BASE_PATH | | If reverse proxying with a subfolder you'll want to set this. Must be in the format of `/subfolder`. |
| LOG_LEVEL | info | Overrides the persisted log level for the current container process only. Accepted values are `debug`, `verbose`, `info`, `warn`, `error`, and `fatal`. |
| GITHUB_TOKEN | | GitHub Personal Access Token for higher API rate limits |
| Variable | Default Value | Description |
| -------------------- | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| TZ | _host timezone_ | Controls date formatting in logs. |
| UI_HOSTNAME | 0.0.0.0 | The listen host of the web server. Can be set to :: for IPv6. |
| UI_PORT | 6246 | The listen port of the web server. |
| BASE_PATH | | If reverse proxying with a subfolder you'll want to set this. Must be in the format of `/subfolder`. |
| LOG_LEVEL | info | Overrides the persisted log level for the current container process only. Accepted values are `debug`, `verbose`, `info`, `warn`, `error`, and `fatal`. |
| GITHUB_TOKEN | | GitHub Personal Access Token for higher API rate limits |
| CORS_ALLOWED_ORIGINS | | Comma-separated list of origins allowed to call the API cross-origin, e.g. `https://maintainerr.example.com`. Same-origin access (the bundled UI, including via localhost) always works and never needs this; only set it if a separate front end on a different origin calls the API. |

:::tip
If `BASE_PATH` is set, remember to prefix health-check probe paths accordingly (for example `/maintainerr/api/health/ready`).
Expand Down