connect-src listed the https Supabase origin plus wss://*.supabase.co,
but never the wss variant of a self-hosted Supabase URL. Supabase
Realtime opens wss://<host>/realtime/v1/websocket, which CSP blocked;
WebKit throws synchronously on a CSP-blocked new WebSocket(), so Safari
unmounted the dashboard into the error boundary (Chromium only logs).
- next.config.ts: add supabaseWsUrl (NEXT_PUBLIC_SUPABASE_WS_URL, or
the Supabase URL with https to wss / http to ws) to connect-src
- Dockerfile: bake a __NEXT_PUBLIC_SUPABASE_WS_URL__ sentinel, since
the CSP is fixed at build time and only sed-substituted at runtime
- docker-entrypoint.sh: derive the wss origin from
NEXT_PUBLIC_SUPABASE_URL unless overridden, substitute the sentinel
- .env.docker.example: document the optional override
Hosted is unaffected: the wss form of *.supabase.co was already
allowlisted, so the added token is redundant there.
Fixes#893
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Add .env.docker.example as a template for Docker-based local
development, and add a negation pattern to .gitignore so the
example file is tracked while real .env* files stay ignored.
Signed-off-by: Fabian Mossberg <fabian@hejfaktura.se>
Co-authored-by: Jakob Wennberg <jakob.wennberg@gmail.com>
Jakob Wennberg