groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-07-27 11:41:36 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Added documentation about the TRUSTED_HOSTS env and add it to installation guides

Browse source
This commit is contained in:
Jan Böhmer 2026-07-19 21:40:26 +02:00
parent 43ac8c23c7
commit 9fb69bfc03
4 changed files with 45 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/installation/installation_guide-debian.md
View file

@ -145,6 +145,16 @@ A full list of configuration options can be found [here](../configuration.md).
> ```
> or edit the file with a text editor and add a new value for `APP_SECRET` (you can generate a random value with `openssl rand -hex 32`).
{: .important }
> **Set `TRUSTED_HOSTS` before going live.** By default Part-DB accepts requests for any host name, which makes it
> vulnerable to `HTTP Host header attacks`. Edit your `.env.local` with a text editor and set `TRUSTED_HOSTS` to a
> regex matching all host names Part-DB should be reachable under, e.g. if Part-DB should only be reachable via
> `part-db.example.invalid`:
> ```
> TRUSTED_HOSTS='^(part-db\.example\.invalid)$'
> ```
> See the [configuration options](../configuration.md) page for more information about `TRUSTED_HOSTS`.
Please check that the configured base currency matches your mainly used currency, as
this can not be changed after creating price information.