Mention in docs and messages, that the env in docker-compose must not be quoted

Fixed issue #1453

docs/configuration.md

@@ -265,10 +265,16 @@ See the [information providers]({% link usage/information_provider_system.md %})
   should be accessible. If accessed via a hostname not matching the regex, an error page will be shown instead. By default this
   is empty, meaning Part-DB accepts requests for any host name, which is not recommended for production use.
 
-  For example, if Part-DB should only be reachable under `part-db.example.invalid`, set:
+  For example, if Part-DB should only be reachable under `part-db.example.invalid`, set the following in your
+  `.env.local` file (the value must be wrapped in single quotes here):
   ```
   TRUSTED_HOSTS='^(part-db\.example\.invalid)$'
   ```
+  If you set `TRUSTED_HOSTS` as an environment variable in your `docker-compose.yaml` instead, the value must
+  **not** be quoted:
+  ```
+  TRUSTED_HOSTS=^(part-db\.example\.invalid)$
+  ```
   You can specify multiple host names separated by `|`, e.g. `^(localhost|part-db\.example\.invalid)$`.
   Part-DB displays a warning on the homepage (visible to administrators only) as long as this value is not set.
 * `DEMO_MODE` (env only): Set Part-DB into demo mode, which forbids users to change their passwords and settings. Used for the demo

docs/installation/installation_docker.md

@@ -87,6 +87,7 @@ services:
 
       # To prevent HTTP Host header attacks, set this to a regex matching all host names Part-DB should be reachable under.
       # By default (unset) Part-DB accepts requests for any host name, which is not recommended for production use.
+      # IMPORTANT: Unlike in .env files, the value here must NOT be wrapped in quotes.
       # - TRUSTED_HOSTS=^(part-db\.example\.invalid)$
 
       # If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here:
@@ -101,7 +102,8 @@ services:
 openssl rand -hex 32
 ```
 6. Uncomment and set the `TRUSTED_HOSTS` variable to a regex matching the host name(s) Part-DB should be reachable under
-   (e.g. `^(part-db\.example\.invalid)$`), to prevent HTTP Host header attacks. See [Configuration]({% link configuration.md %})
+   (e.g. `^(part-db\.example\.invalid)$`), to prevent HTTP Host header attacks. Note that, unlike in `.env` files, the
+   value must **not** be quoted in `docker-compose.yaml`. See [Configuration]({% link configuration.md %})
    for more information.
 7. Inside the folder, run
 
@@ -181,6 +183,7 @@ services:
 
       # To prevent HTTP Host header attacks, set this to a regex matching all host names Part-DB should be reachable under.
       # By default (unset) Part-DB accepts requests for any host name, which is not recommended for production use.
+      # IMPORTANT: Unlike in .env files, the value here must NOT be wrapped in quotes.
       # - TRUSTED_HOSTS=^(part-db\.example\.invalid)$
 
       # If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here:

docs/installation/reverse-proxy.md

@@ -24,12 +24,18 @@ the reverse proxy).
 
 You should also set the `TRUSTED_HOSTS` environment variable to a regex matching the host name(s) Part-DB is reachable
 under via the reverse proxy, to prevent `HTTP Host header attacks`. For example, if Part-DB is reachable via
-`part-db.example.invalid`, set:
+`part-db.example.invalid`, set the following in your `.env.local` file (the value must be wrapped in single quotes here):
 
 ```
 TRUSTED_HOSTS='^(part-db\.example\.invalid)$'
 ```
 
+If you set `TRUSTED_HOSTS` in your `docker-compose.yaml` instead, the value must **not** be quoted:
+
+```
+TRUSTED_HOSTS=^(part-db\.example\.invalid)$
+```
+
 See the [configuration options](../configuration.md) page for more information about `TRUSTED_HOSTS`.
 
 ## Part-DB in a subpath via reverse proxy