groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-07-27 19:51:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

Mention in docs and messages, that the env in docker-compose must not be quoted

Browse source 
Fixed issue #1453
This commit is contained in:
Jan Böhmer 2026-07-22 00:29:09 +02:00
parent 9d438d7d97
commit 3de2c91d93
8 changed files with 61 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/installation/installation_docker.md
View file

@ -87,6 +87,7 @@ services:
# To prevent HTTP Host header attacks, set this to a regex matching all host names Part-DB should be reachable under.
# By default (unset) Part-DB accepts requests for any host name, which is not recommended for production use.
# IMPORTANT: Unlike in .env files, the value here must NOT be wrapped in quotes.
# - TRUSTED_HOSTS=^(part-db\.example\.invalid)$
# If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here:
@ -101,7 +102,8 @@ services:
openssl rand -hex 32
```
6. Uncomment and set the `TRUSTED_HOSTS` variable to a regex matching the host name(s) Part-DB should be reachable under
(e.g. `^(part-db\.example\.invalid)$`), to prevent HTTP Host header attacks. See [Configuration]({% link configuration.md %})
(e.g. `^(part-db\.example\.invalid)$`), to prevent HTTP Host header attacks. Note that, unlike in `.env` files, the
value must **not** be quoted in `docker-compose.yaml`. See [Configuration]({% link configuration.md %})
for more information.
7. Inside the folder, run
@ -181,6 +183,7 @@ services:
# To prevent HTTP Host header attacks, set this to a regex matching all host names Part-DB should be reachable under.
# By default (unset) Part-DB accepts requests for any host name, which is not recommended for production use.
# IMPORTANT: Unlike in .env files, the value here must NOT be wrapped in quotes.
# - TRUSTED_HOSTS=^(part-db\.example\.invalid)$
# If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here:

8
docs/installation/reverse-proxy.md
View file

@ -24,12 +24,18 @@ the reverse proxy).
You should also set the `TRUSTED_HOSTS` environment variable to a regex matching the host name(s) Part-DB is reachable
under via the reverse proxy, to prevent `HTTP Host header attacks`. For example, if Part-DB is reachable via
`part-db.example.invalid`, set:
`part-db.example.invalid`, set the following in your `.env.local` file (the value must be wrapped in single quotes here):
```
TRUSTED_HOSTS='^(part-db\.example\.invalid)$'
```
If you set `TRUSTED_HOSTS` in your `docker-compose.yaml` instead, the value must **not** be quoted:
```
TRUSTED_HOSTS=^(part-db\.example\.invalid)$
```
See the [configuration options](../configuration.md) page for more information about `TRUSTED_HOSTS`.
## Part-DB in a subpath via reverse proxy