arnaudne/Epicure
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: photo thumbnails always used localhost:9000 in production

Browse Source 
getPublicUrl() runs in the browser (called from client components rendering
recipe thumbnails), but read the plain STORAGE_PUBLIC_URL env var — never
inlined into the client bundle, so every browser fell back to the hardcoded
localhost:9000 default regardless of the real deployed storage domain,
tripping CSP img-src and mixed-content blocks in production. Added a
NEXT_PUBLIC_STORAGE_PUBLIC_URL build arg (Dockerfile, compose.prod.yml) wired
from the same STORAGE_PUBLIC_URL value, and getPublicUrl() now reads that.

Verified locally: building with a fake public storage domain set shows it
correctly inlined into the client JS chunk (previously only the localhost
fallback ever appeared there).
This commit is contained in:
Arnaud
2026-07-12 13:53:15 +02:00
parent b160fdc338
commit 8df292dfee
3 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+5
View File
@@ -44,6 +44,11 @@ ENV NEXT_PUBLIC_AUTHENTIK_ENABLED=$NEXT_PUBLIC_AUTHENTIK_ENABLED
# also needs to be a build arg, not just a runtime env var (unlike STORAGE_ENDPOINT).
ARG STORAGE_PUBLIC_URL
ENV STORAGE_PUBLIC_URL=$STORAGE_PUBLIC_URL
# lib/storage.ts's getPublicUrl() is called from client components to render photo
# <img> tags — a plain (non-NEXT_PUBLIC_) env var is never inlined into the browser
# bundle, so it must be duplicated under a NEXT_PUBLIC_ name to reach the client.
ARG NEXT_PUBLIC_STORAGE_PUBLIC_URL
ENV NEXT_PUBLIC_STORAGE_PUBLIC_URL=$NEXT_PUBLIC_STORAGE_PUBLIC_URL
RUN pnpm --filter web build
# ---- runtime ----