Jakob Wennberg
15e5dc1a01
connect-src listed the https Supabase origin plus wss://*.supabase.co, but never the wss variant of a self-hosted Supabase URL. Supabase Realtime opens wss://<host>/realtime/v1/websocket, which CSP blocked; WebKit throws synchronously on a CSP-blocked new WebSocket(), so Safari unmounted the dashboard into the error boundary (Chromium only logs). - next.config.ts: add supabaseWsUrl (NEXT_PUBLIC_SUPABASE_WS_URL, or the Supabase URL with https to wss / http to ws) to connect-src - Dockerfile: bake a __NEXT_PUBLIC_SUPABASE_WS_URL__ sentinel, since the CSP is fixed at build time and only sed-substituted at runtime - docker-entrypoint.sh: derive the wss origin from NEXT_PUBLIC_SUPABASE_URL unless overridden, substitute the sentinel - .env.docker.example: document the optional override Hosted is unaffected: the wss form of *.supabase.co was already allowlisted, so the added token is redundant there. Fixes #893 Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
14 lines
612 B
Bash
14 lines
612 B
Bash
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
|
|
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
|
|
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
|
|
NEXT_PUBLIC_APP_URL=https://your-domain.com
|
|
CRON_SECRET=generate-a-random-secret
|
|
|
|
# Self-hosted (Docker) flag: disables application-side MFA enforcement.
|
|
NEXT_PUBLIC_SELF_HOSTED=true
|
|
|
|
# Optional: WebSocket origin allowed for Supabase Realtime in the CSP.
|
|
# Defaults to NEXT_PUBLIC_SUPABASE_URL with https:// replaced by wss://
|
|
# (http:// by ws://). Set only if Realtime is served from another origin.
|
|
# NEXT_PUBLIC_SUPABASE_WS_URL=wss://your-project.supabase.co
|