From 631a8461b7925e941fe75e430a1c08d0c6ce7ec4 Mon Sep 17 00:00:00 2001 From: Nick Scheifler Date: Sat, 25 Jul 2026 15:04:02 -0500 Subject: [PATCH] fix(deploy): add Tauri webview origins to the compose BUZZ_CORS_ORIGINS default A relay deployed from deploy/compose blocks the desktop app at CORS preflight: the template allowlists only the public domain, but the desktop webview runs from tauri://localhost (macOS/Linux) or http://tauri.localhost (Windows). "Join an existing community" then fails with WebKit's generic "Load failed" while curl/NIP-11 succeed. Ship the webview origins in the template default, tell operators to keep them, and document the requirement in deploy/compose/README.md. Fixes #2872 --- deploy/compose/.env.example | 5 ++++- deploy/compose/README.md | 5 +++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/deploy/compose/.env.example b/deploy/compose/.env.example index cebe879da0..aeb5db0587 100644 --- a/deploy/compose/.env.example +++ b/deploy/compose/.env.example @@ -10,7 +10,10 @@ BUZZ_DOMAIN=buzz.example.com RELAY_URL=wss://buzz.example.com BUZZ_MEDIA_BASE_URL=https://buzz.example.com/media BUZZ_MEDIA_SERVER_DOMAIN=buzz.example.com -BUZZ_CORS_ORIGINS=https://buzz.example.com +# CORS allowlist for the relay HTTP API, comma-separated exact origins. Replace the domain, +# but keep the tauri entries — the desktop app webview (tauri://localhost on macOS/Linux, +# http://tauri.localhost on Windows) cannot reach the relay HTTP API without them. +BUZZ_CORS_ORIGINS=https://buzz.example.com,tauri://localhost,http://tauri.localhost # Production defaults. Closed relay mode requires RELAY_OWNER_PUBKEY and a stable relay key. BUZZ_REQUIRE_AUTH_TOKEN=true diff --git a/deploy/compose/README.md b/deploy/compose/README.md index 0de524fb5b..9451c566b5 100644 --- a/deploy/compose/README.md +++ b/deploy/compose/README.md @@ -28,6 +28,11 @@ keypair. - Requires Docker Compose v2.24.4 or newer; the TLS override uses Compose's `!reset` tag to remove the direct relay port when Caddy terminates HTTPS. - Default `BUZZ_IMAGE` tracks `ghcr.io/block/buzz:main` for early testing. Pin it to `ghcr.io/block/buzz:sha-<7>` or a semver release tag for production once available. +- `BUZZ_CORS_ORIGINS` must keep the desktop webview origins (`tauri://localhost` + for macOS/Linux, `http://tauri.localhost` for Windows) alongside your public + domain. The relay treats the list as exact origins with no permissive + fallback, so without the tauri entries desktop flows that use the HTTP API + (joining a community, invites, moderation) fail with a generic "Load failed". - Keep `BUZZ_RELAY_PRIVATE_KEY`, `BUZZ_GIT_HOOK_HMAC_SECRET`, database/Redis, and S3 secrets stable across restarts. - `RELAY_OWNER_PUBKEY` is intentionally not prefixed with `BUZZ_`; it must be a