# Proposal

## Why

Object URLs are absolute and built from `APP_BASE_URL`, whose default is
`http://localhost:8080`. On a server reached by any other address the browser is told to
fetch thumbnails and originals from `localhost`, so no photo or preview loads. This was
observed on a deployment served from `http://192.168.77.82:8080/` with the default
config: pages, login and album lists work (relative `/api/...`), but every image URL
points at the client's own machine.

## What Changes

- Emit same-origin object URLs: the signer returns a path-only URL
  (`/api/objects/<key>?e=...&s=...`) instead of an absolute one.
- Remove the base URL from the signer (`Signer`/`NewSigner`) since it is no longer
  needed; verification is unchanged (it uses the key and query only).
- **BREAKING** (config): remove `APP_BASE_URL` / `Server.BaseURL`, which after this has
  no remaining use (SSE and API calls are already relative). Update `.env.example` and
  the README.

## Capabilities

### New Capabilities

<!-- none -->

### Modified Capabilities

- `storage-backends`: add a requirement that issued object URLs are host-independent
  (same-origin), so the app works behind any host or reverse proxy without calibrated
  base-URL configuration.

## Impact

- Backend: `backend/internal/storage/signer.go`, `storage.go`
  (`Open`/`NewSigner` call), `backend/internal/config/config.go` (`Server.BaseURL`).
- Docs/config: `.env.example`, `README.md`.
- Tests: signer/fs/objects/app/e2e call sites of `NewSigner` / `Server.BaseURL`.
- Frontend: unchanged; relative URLs resolve against the page origin. The `sameOrigin`
  helper in `PanoViewer` becomes a no-op but harmless.