SLP_Software/slp-modular-cms
1
0
Fork 0
Code Issues Pull Requests Actions Projects Releases Wiki Activity

Fixes a wrong placeholder and explains the optional env fields

Browse Source 
AllowedConnectOrigins had a sentry-ingest-origin placeholder that
was simply incorrect - the Sentry tunnel exists precisely so that
exception is never needed. Both SecurityHeaders fields are Umami-only
now, with inline comments on when to set them versus leave them out,
and a note that MasterModule__MasterUrl degrades to a warning rather
than a startup failure when unset.
This commit is contained in:
Sluijsens
2026-07-28 23:17:52 +02:00
parent 97f18d00e5
commit 579e0ceaac
2 changed files with 39 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
aidlc-docs/features/gitea-deployment-workflow/operations/deployment/deployment-instructions.md
+28 -2
View File
@@ -110,10 +110,36 @@ ConnectionStrings__DefaultConnection=Server=127.0.0.1,1433;User ID=<user>;Passwo
JwtSettings__Secret=<secure-long-random-secret>
JwtSettings__Issuer=SlpModularCms
JwtSettings__Audience=SlpModularCmsPortal
# Optional — only meaningful if this instance manages slave CMS instances via the /cms page.
# MasterModuleOptions.MasterUrl is nullable and unvalidated at startup: if left unset, the Master
# module's background reconciliation just logs a warning and skips its work ("MasterUrl not
# configured; skipping integrity check") — it never crashes or blocks startup. Safe to leave out
# entirely if you don't plan to register any slave instances under this deployment; set it to this
# environment's own public URL (e.g. https://slpsoftware.nl) if you do.
MasterModule__MasterUrl=https://<this-environment-domain>
# Optional — empty/absent is a fully supported state: Sentry is simply skipped and console logging
# continues (see Observability section in README.md).
Observability__SentryDsn=<sentry-dsn-or-empty>
SecurityHeaders__AllowedScriptOrigins__0=<umami-script-origin>
SecurityHeaders__AllowedConnectOrigins__0=<sentry-ingest-origin>
# Optional — both only needed if this instance uses Umami analytics (VITE_UMAMI_SCRIPT_URL set for
# the frontend build). Leave both lines out entirely if you don't use Umami; there is no other
# origin either one needs by default.
#
# Set BOTH to the Umami script's origin (scheme + host only, no path — e.g. if
# VITE_UMAMI_SCRIPT_URL=https://analytics.slpsoftware.nl/script.js, use
# https://analytics.slpsoftware.nl for both lines below):
# - AllowedScriptOrigins: lets the browser load Umami's tracking script (CSP script-src)
# - AllowedConnectOrigins: lets that script send its analytics beacons back (CSP connect-src) —
# loading a script and letting it phone home are two separate CSP directives
#
# Sentry does NOT need an entry here, on either line: U4 built a same-origin tunnel
# (Program.cs -> MapSentryTunnel()) specifically so browser error reports never leave this origin,
# precisely to avoid needing a connect-src exception (and to dodge ad blockers, which commonly
# block direct requests to Sentry's own domains).
SecurityHeaders__AllowedScriptOrigins__0=<umami-script-origin-or-omit-this-line>
SecurityHeaders__AllowedConnectOrigins__0=<same-umami-script-origin-or-omit-this-line>
```
Use ports **5100** (test) and **5101** (production) unless something else on the Pi already
occupies them. `ASPNETCORE_ENVIRONMENT=Production` is used for **both** environments deliberately —