mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-07-28 08:56:13 +00:00
e17aff57a0
Opening the dev stack on a LAN address or a proxied hostname serves the SSR HTML but never hydrates: Next.js answers /_next/*, /__nextjs_font/*, and HMR with 403 for any host it was not started on. The page renders, so it looks up — but no client handler is attached, and the login form's onSubmit never fires. It reads as "login is broken" rather than as an asset problem, and the only clue is a warning in the dev-server log. Wire Next's allowedDevOrigins to a new DEER_FLOW_DEV_ALLOWED_ORIGINS env var. Unset by default, so the localhost-only default is unchanged; it is also dev-only, as Next ignores allowedDevOrigins in production builds. Entries are reduced to the bare host that allowedDevOrigins matches against, since an entry pasted from the address bar as "http://192.168.1.10:2026" would otherwise match nothing and leave the operator with the same 403 they were trying to fix. Reported in #54 and #203. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
32 lines
1.7 KiB
Plaintext
32 lines
1.7 KiB
Plaintext
# Since the ".env" file is gitignored, you can use the ".env.example" file to
|
|
# build a new ".env" file when you clone the repo. Keep this file up-to-date
|
|
# when you add new variables to `.env`.
|
|
|
|
# This file will be committed to version control, so make sure not to have any
|
|
# secrets in it. If you are cloning this repo, create a copy of this file named
|
|
# ".env" and populate it with your secrets.
|
|
|
|
# When adding additional environment variables, the schema in "/src/env.js"
|
|
# should be updated accordingly.
|
|
|
|
# Backend API URLs (optional)
|
|
# Leave these commented out to use the default nginx proxy (recommended for `make dev`).
|
|
# Only set these if you need to connect to the Gateway service directly.
|
|
# For split-origin browser access, also configure GATEWAY_CORS_ORIGINS.
|
|
# NEXT_PUBLIC_BACKEND_BASE_URL="http://localhost:8001"
|
|
# NEXT_PUBLIC_LANGGRAPH_BASE_URL="http://localhost:8001/api"
|
|
|
|
# Server-only Gateway wiring used by SSR (auth checks, /api/* rewrites).
|
|
# Defaults to localhost — only override for non-local deployments.
|
|
# DEER_FLOW_INTERNAL_GATEWAY_BASE_URL="http://localhost:8001"
|
|
# DEER_FLOW_TRUSTED_ORIGINS="http://localhost:3000,http://localhost:2026"
|
|
|
|
# Extra hosts allowed to load Next.js dev-server resources (`/_next/*`, fonts,
|
|
# HMR). Development only — production builds ignore it.
|
|
# Needed to open `pnpm dev` / `make docker-start` on anything other than
|
|
# localhost, such as a LAN address or a proxied hostname: without it Next.js
|
|
# answers those requests with 403, so the page renders server-side but never
|
|
# hydrates and no interaction (including the login form) works.
|
|
# Comma-separated; a full URL is reduced to its host.
|
|
# DEER_FLOW_DEV_ALLOWED_ORIGINS="192.168.1.10,*.local"
|