updated allowed host urls

.env.example

@@ -1,4 +1,17 @@
-# Example SMTP Configuration for Holy Flavors
+# --- App Hosting ---
+# A comma-separated list of domains that can access the backend API.
+# Example: CORS_ALLOWED_ORIGINS=http://localhost:5173,https://holy.narl.io
+CORS_ALLOWED_ORIGINS=http://localhost:5173,http://127.0.0.1:5173
+
+# A comma-separated list of hostnames that the Django backend will serve.
+# Example: ALLOWED_HOSTS=localhost,backend,api.holy.narl.io
+ALLOWED_HOSTS=localhost,127.0.0.1,backend
+
+# Set to "false" in production
+DEBUG=true
+
+
+# --- SMTP Configuration ---
 # Rename this file to .env and fill in your details to enable email sending.
 
 # --- Required for SMTP ---

.gitignore

@@ -38,3 +38,4 @@ Thumbs.db
 .env
 .env.*
 !.env.example
+frontend/.env*

backend/holy_backend/settings.py

@@ -24,9 +24,10 @@ BASE_DIR = Path(__file__).resolve().parent.parent
 SECRET_KEY = 'django-insecure-zos99ue2a89!4jrv4g@_b4nn4z!5o*@8k!5cr9!u$j%_@xb=l8'
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = True
+DEBUG = os.environ.get('DEBUG', 'true').lower() == 'true'
 
-ALLOWED_HOSTS = []
+ALLOWED_HOSTS_STRING = os.environ.get('ALLOWED_HOSTS', 'localhost,127.0.0.1,backend')
+ALLOWED_HOSTS = [host.strip() for host in ALLOWED_HOSTS_STRING.split(',')]
 
 
 # Application definition
@@ -143,10 +144,8 @@ REST_FRAMEWORK = {
 }
 
 # CORS
-CORS_ALLOWED_ORIGINS = [
-    "http://localhost:5173",
-    "http://127.0.0.1:5173",
-]
+CORS_ALLOWED_ORIGINS_STRING = os.environ.get('CORS_ALLOWED_ORIGINS', 'http://localhost:5173,http://127.0.0.1:5173')
+CORS_ALLOWED_ORIGINS = [origin.strip() for origin in CORS_ALLOWED_ORIGINS_STRING.split(',')]
 
 import os
 # ... (near top of file)

frontend/src/api.ts

@@ -1,7 +1,7 @@
 import axios from 'axios';
 
 const api = axios.create({
-  baseURL: 'http://backend:8000/api/',
+  baseURL: import.meta.env.VITE_API_URL || 'http://localhost:8000/api/',
 });
 
 api.interceptors.request.use((config) => {