Why
Browsers send an Origin header on /api/auth/login even when Nginx proxies /api on the same host. If PMS_PORT is not 5173 but PMS_CORS_ALLOWED_ORIGINS still lists http://localhost:5173, sign-in returns 403.
bootstrap.sh now rewrites placeholder CORS / PMS_PUBLIC_BASE_URL when the port is custom. Other scripts (manual .env edits, status-only recreates, copied env files) can still drift.
Suggested change
Pick one small follow-up:
- Add a
scripts/sync-public-url.sh helper and call it from bootstrap / upgrade, or
- Fail
bootstrap.sh / compose config when PMS_PUBLIC_BASE_URL host:port does not match PMS_PORT.
Keep the default example as http://localhost:5173,http://127.0.0.1:5173.
Acceptance
Changing only PMS_PORT in a copied .env either auto-fixes CORS or prints a clear error before compose up.
Why
Browsers send an
Originheader on/api/auth/logineven when Nginx proxies/apion the same host. IfPMS_PORTis not5173butPMS_CORS_ALLOWED_ORIGINSstill listshttp://localhost:5173, sign-in returns 403.bootstrap.shnow rewrites placeholder CORS /PMS_PUBLIC_BASE_URLwhen the port is custom. Other scripts (manual.envedits, status-only recreates, copied env files) can still drift.Suggested change
Pick one small follow-up:
scripts/sync-public-url.shhelper and call it from bootstrap / upgrade, orbootstrap.sh/compose configwhenPMS_PUBLIC_BASE_URLhost:port does not matchPMS_PORT.Keep the default example as
http://localhost:5173,http://127.0.0.1:5173.Acceptance
Changing only
PMS_PORTin a copied.enveither auto-fixes CORS or prints a clear error beforecompose up.