groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-07-27 03:31:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

Mention in docs and messages, that the env in docker-compose must not be quoted

Browse source 
Fixed issue #1453
This commit is contained in:
Jan Böhmer 2026-07-22 00:29:09 +02:00
parent 9d438d7d97
commit 3de2c91d93
8 changed files with 61 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

1
.env
View file

@ -8,6 +8,7 @@ APP_SECRET=a03498528f5a5fc089273ec9ae5b2849
# Change this and uncomment the following line to set the trusted hosts for your Part-DB installation, aka under which
# domain names it is reachable. This is makes things more secure, because it can prevent certain header attacks.
# You have to escape dots in the domain name with a backslash
# IMPORTANT: In .env files (like this one), the value must be wrapped in single quotes as shown below.
#TRUSTED_HOSTS='^(your-domain\.invalid)$'
# You can also allow multiple domain names, e.g. for testing or development purposes, with an | between the domain names.

8
docs/configuration.md
View file

@ -265,10 +265,16 @@ See the [information providers]({% link usage/information_provider_system.md %})
should be accessible. If accessed via a hostname not matching the regex, an error page will be shown instead. By default this
is empty, meaning Part-DB accepts requests for any host name, which is not recommended for production use.
For example, if Part-DB should only be reachable under `part-db.example.invalid`, set:
For example, if Part-DB should only be reachable under `part-db.example.invalid`, set the following in your
`.env.local` file (the value must be wrapped in single quotes here):
```
TRUSTED_HOSTS='^(part-db\.example\.invalid)$'
```
If you set `TRUSTED_HOSTS` as an environment variable in your `docker-compose.yaml` instead, the value must
**not** be quoted:
```
TRUSTED_HOSTS=^(part-db\.example\.invalid)$
```
You can specify multiple host names separated by `|`, e.g. `^(localhost|part-db\.example\.invalid)$`.
Part-DB displays a warning on the homepage (visible to administrators only) as long as this value is not set.
* `DEMO_MODE` (env only): Set Part-DB into demo mode, which forbids users to change their passwords and settings. Used for the demo

5
docs/installation/installation_docker.md
View file

@ -87,6 +87,7 @@ services:
# To prevent HTTP Host header attacks, set this to a regex matching all host names Part-DB should be reachable under.
# By default (unset) Part-DB accepts requests for any host name, which is not recommended for production use.
# IMPORTANT: Unlike in .env files, the value here must NOT be wrapped in quotes.
# - TRUSTED_HOSTS=^(part-db\.example\.invalid)$
# If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here:
@ -101,7 +102,8 @@ services:
openssl rand -hex 32
```
6. Uncomment and set the `TRUSTED_HOSTS` variable to a regex matching the host name(s) Part-DB should be reachable under
(e.g. `^(part-db\.example\.invalid)$`), to prevent HTTP Host header attacks. See [Configuration]({% link configuration.md %})
(e.g. `^(part-db\.example\.invalid)$`), to prevent HTTP Host header attacks. Note that, unlike in `.env` files, the
value must **not** be quoted in `docker-compose.yaml`. See [Configuration]({% link configuration.md %})
for more information.
7. Inside the folder, run
@ -181,6 +183,7 @@ services:
# To prevent HTTP Host header attacks, set this to a regex matching all host names Part-DB should be reachable under.
# By default (unset) Part-DB accepts requests for any host name, which is not recommended for production use.
# IMPORTANT: Unlike in .env files, the value here must NOT be wrapped in quotes.
# - TRUSTED_HOSTS=^(part-db\.example\.invalid)$
# If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here:

8
docs/installation/reverse-proxy.md
View file

@ -24,12 +24,18 @@ the reverse proxy).
You should also set the `TRUSTED_HOSTS` environment variable to a regex matching the host name(s) Part-DB is reachable
under via the reverse proxy, to prevent `HTTP Host header attacks`. For example, if Part-DB is reachable via
`part-db.example.invalid`, set:
`part-db.example.invalid`, set the following in your `.env.local` file (the value must be wrapped in single quotes here):
```
TRUSTED_HOSTS='^(part-db\.example\.invalid)$'
```
If you set `TRUSTED_HOSTS` in your `docker-compose.yaml` instead, the value must **not** be quoted:
```
TRUSTED_HOSTS=^(part-db\.example\.invalid)$
```
See the [configuration options](../configuration.md) page for more information about `TRUSTED_HOSTS`.
## Part-DB in a subpath via reverse proxy

10
templates/bundles/TwigBundle/Exception/error400.html.twig
View file

@ -23,12 +23,16 @@
<p>Try following things:</p>
<ul>
<li>Ensure that you are using the correct URL to access Part-DB.</li>
<li>Set the <code>TRUSTED_HOSTS</code> environment variable in your <code>.env.local</code> file (or your docker-compose environment) to a regular expression matching all host names Part-DB should be reachable under, e.g.
<li>Set the <code>TRUSTED_HOSTS</code> environment variable to a regular expression matching all host names Part-DB should be reachable under. Note that the required quoting differs depending on where you set it:
<ul>
{% if seen_host %}
<code>TRUSTED_HOSTS='^({{ seen_host|replace({'.': '\\.'}) }})$'</code> (if <code>{{ seen_host }}</code> is a host name you trust)
<li>In your <code>.env.local</code> file, the value must be wrapped in single quotes: <code>TRUSTED_HOSTS='^({{ seen_host|replace({'.': '\\.'}) }})$'</code> (if <code>{{ seen_host }}</code> is a host name you trust)</li>
<li>In <code>docker-compose.yaml</code>, the value must NOT be quoted: <code>TRUSTED_HOSTS=^({{ seen_host|replace({'.': '\\.'}) }})$</code> (if <code>{{ seen_host }}</code> is a host name you trust)</li>
{% else %}
<code>TRUSTED_HOSTS='^(localhost|example\.com)$'</code>
<li>In your <code>.env.local</code> file, the value must be wrapped in single quotes: <code>TRUSTED_HOSTS='^(localhost|example\.com)$'</code></li>
<li>In <code>docker-compose.yaml</code>, the value must NOT be quoted: <code>TRUSTED_HOSTS=^(localhost|example\.com)$</code></li>
{% endif %}
</ul>
</li>
<li>If Part-DB is running behind a reverse proxy, also make sure that <code>TRUSTED_PROXIES</code> is configured correctly, so the original host name is forwarded properly.</li>
<li>Run <kbd>php bin/console cache:clear</kbd> after changing the configuration.</li>

9
templates/homepage.html.twig
View file

@ -98,9 +98,12 @@
{% if trusted_hosts_unconfigured and is_granted('@system.server_infos') %}
<div class="alert alert-warning" role="alert">
<h5><i class="fa-solid fa-triangle-exclamation fa-fw"></i> {% trans %}system.trusted_hosts.unconfigured.title{% endtrans %}</h5>
<p class="mb-1">{% trans %}system.trusted_hosts.unconfigured.message{% endtrans %}</p>
<p class="mb-0">{% trans %}system.trusted_hosts.unconfigured.suggestion{% endtrans %}
<br><code>TRUSTED_HOSTS='^({{ app.request.host|replace({'.': '\\.'}) }})$'</code></p>
<p class="mb-1">{% trans %}system.trusted_hosts.unconfigured.message{% endtrans %}
{% trans %}system.trusted_hosts.unconfigured.suggestion{% endtrans %}</p>
<p class="mb-0">{% trans %}system.trusted_hosts.unconfigured.env_example{% endtrans %}
<code>TRUSTED_HOSTS='^({{ app.request.host|replace({'.': '\\.'}) }})$'</code></p>
<p class="mb-0">{% trans %}system.trusted_hosts.unconfigured.docker_example{% endtrans %}
<code>TRUSTED_HOSTS=^({{ app.request.host|replace({'.': '\\.'}) }})$</code></p>
<small>{% trans %}update_manager.new_version_available.only_administrators_can_see{% endtrans %}</small>
</div>
{% endif %}

14
translations/messages.de.xlf
View file

@ -13710,7 +13710,19 @@ Buerklin-API-Authentication-Server:
<unit id="qZ_kgWT" name="system.trusted_hosts.unconfigured.suggestion">
<segment state="translated">
<source>system.trusted_hosts.unconfigured.suggestion</source>
<target>Legen Sie einen regulären Ausdruck fest, der alle Hostnamen abdeckt, unter denen Part-DB erreichbar sein soll, z. B. basierend auf dem Hostnamen, den Sie für den Zugriff auf diese Seite verwendet haben. Dies ist möglich in Ihrer Datei &lt;code&gt;.env.local&lt;/code&gt; oder &lt;code&gt;docker-compose.yaml&lt;/code&gt;:</target>
<target>Legen Sie einen regulären Ausdruck fest, der alle Hostnamen abdeckt, unter denen Part-DB erreichbar sein soll, z. B. basierend auf dem Hostnamen, den Sie für den Zugriff auf diese Seite verwendet haben. Beachten Sie, dass die erforderliche Anführungszeichen-Schreibweise davon abhängt, wo Sie den Wert setzen:</target>
</segment>
</unit>
<unit id="ie4thSr" name="system.trusted_hosts.unconfigured.env_example">
<segment state="translated">
<source>system.trusted_hosts.unconfigured.env_example</source>
<target>In Ihrer Datei &lt;code&gt;.env.local&lt;/code&gt; muss der Wert in einfache Anführungszeichen eingeschlossen werden:</target>
</segment>
</unit>
<unit id="ni3hSTN" name="system.trusted_hosts.unconfigured.docker_example">
<segment state="translated">
<source>system.trusted_hosts.unconfigured.docker_example</source>
<target>In &lt;code&gt;docker-compose.yaml&lt;/code&gt; darf der Wert NICHT in Anführungszeichen stehen:</target>
</segment>
</unit>
<unit id="cEwxoSj" name="info_providers.provider_key">

14
translations/messages.en.xlf
View file

@ -13712,7 +13712,19 @@ Buerklin-API Authentication server:
<unit id="qZ_kgWT" name="system.trusted_hosts.unconfigured.suggestion">
<segment state="translated">
<source>system.trusted_hosts.unconfigured.suggestion</source>
<target>Set it to a regular expression matching all host names Part-DB should be reachable under in your &lt;code&gt;.env.local&lt;/code&gt; or &lt;code&gt;docker-compose.yaml&lt;/code&gt; file, e.g. based on the host name you used to access this page:</target>
<target>Set it to a regular expression matching all host names Part-DB should be reachable under, e.g. based on the host name you used to access this page. Note that the required quoting differs depending on where you set it:</target>
</segment>
</unit>
<unit id="ie4thSr" name="system.trusted_hosts.unconfigured.env_example">
<segment state="translated">
<source>system.trusted_hosts.unconfigured.env_example</source>
<target>In your &lt;code&gt;.env.local&lt;/code&gt; file, the value must be wrapped in single quotes:</target>
</segment>
</unit>
<unit id="ni3hSTN" name="system.trusted_hosts.unconfigured.docker_example">
<segment state="translated">
<source>system.trusted_hosts.unconfigured.docker_example</source>
<target>In &lt;code&gt;docker-compose.yaml&lt;/code&gt;, the value must NOT be quoted:</target>
</segment>
</unit>
<unit id="cEwxoSj" name="info_providers.provider_key">