From 90c9eb8b5c51494ef97689a947d2a490a9bf026d Mon Sep 17 00:00:00 2001
From: Nils Pukropp <nils@narl.io>
Date: Sun, 15 Feb 2026 21:38:31 +0100
Subject: [PATCH] updated allowed host urls

---
 .env.example                     | 15 ++++++++++++++-
 .gitignore                       |  1 +
 backend/holy_backend/settings.py | 11 +++++------
 frontend/src/api.ts              |  2 +-
 4 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/.env.example b/.env.example
index 2fdf59a..e298348 100644
--- a/.env.example
+++ b/.env.example
@@ -1,4 +1,17 @@
-# Example SMTP Configuration for Holy Flavors
+# --- App Hosting ---
+# A comma-separated list of domains that can access the backend API.
+# Example: CORS_ALLOWED_ORIGINS=http://localhost:5173,https://holy.narl.io
+CORS_ALLOWED_ORIGINS=http://localhost:5173,http://127.0.0.1:5173
+
+# A comma-separated list of hostnames that the Django backend will serve.
+# Example: ALLOWED_HOSTS=localhost,backend,api.holy.narl.io
+ALLOWED_HOSTS=localhost,127.0.0.1,backend
+
+# Set to "false" in production
+DEBUG=true
+
+
+# --- SMTP Configuration ---
 # Rename this file to .env and fill in your details to enable email sending.
 
 # --- Required for SMTP ---
diff --git a/.gitignore b/.gitignore
index b6a7fb0..a56d4de 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,4 @@ Thumbs.db
 .env
 .env.*
 !.env.example
+frontend/.env*
diff --git a/backend/holy_backend/settings.py b/backend/holy_backend/settings.py
index d0fba1d..252def2 100644
--- a/backend/holy_backend/settings.py
+++ b/backend/holy_backend/settings.py
@@ -24,9 +24,10 @@ BASE_DIR = Path(__file__).resolve().parent.parent
 SECRET_KEY = 'django-insecure-zos99ue2a89!4jrv4g@_b4nn4z!5o*@8k!5cr9!u$j%_@xb=l8'
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = True
+DEBUG = os.environ.get('DEBUG', 'true').lower() == 'true'
 
-ALLOWED_HOSTS = []
+ALLOWED_HOSTS_STRING = os.environ.get('ALLOWED_HOSTS', 'localhost,127.0.0.1,backend')
+ALLOWED_HOSTS = [host.strip() for host in ALLOWED_HOSTS_STRING.split(',')]
 
 
 # Application definition
@@ -143,10 +144,8 @@ REST_FRAMEWORK = {
 }
 
 # CORS
-CORS_ALLOWED_ORIGINS = [
-    "http://localhost:5173",
-    "http://127.0.0.1:5173",
-]
+CORS_ALLOWED_ORIGINS_STRING = os.environ.get('CORS_ALLOWED_ORIGINS', 'http://localhost:5173,http://127.0.0.1:5173')
+CORS_ALLOWED_ORIGINS = [origin.strip() for origin in CORS_ALLOWED_ORIGINS_STRING.split(',')]
 
 import os
 # ... (near top of file)
diff --git a/frontend/src/api.ts b/frontend/src/api.ts
index 42db3bc..8fc3df2 100644
--- a/frontend/src/api.ts
+++ b/frontend/src/api.ts
@@ -1,7 +1,7 @@
 import axios from 'axios';
 
 const api = axios.create({
-  baseURL: 'http://backend:8000/api/',
+  baseURL: import.meta.env.VITE_API_URL || 'http://localhost:8000/api/',
 });
 
 api.interceptors.request.use((config) => {