Proposal

Why

Object URLs are absolute and built from APP_BASE_URL, whose default is http://localhost:8080. On a server reached by any other address the browser is told to fetch thumbnails and originals from localhost, so no photo or preview loads. This was observed on a deployment served from http://192.168.77.82:8080/ with the default config: pages, login and album lists work (relative /api/...), but every image URL points at the client's own machine.

What Changes

Emit same-origin object URLs: the signer returns a path-only URL (/api/objects/<key>?e=...&s=...) instead of an absolute one.
Remove the base URL from the signer (Signer/NewSigner) since it is no longer needed; verification is unchanged (it uses the key and query only).
BREAKING (config): remove APP_BASE_URL / Server.BaseURL, which after this has no remaining use (SSE and API calls are already relative). Update .env.example and the README.

Capabilities

New Capabilities

Modified Capabilities

storage-backends: add a requirement that issued object URLs are host-independent (same-origin), so the app works behind any host or reverse proxy without calibrated base-URL configuration.

Impact

Backend: backend/internal/storage/signer.go, storage.go (Open/NewSigner call), backend/internal/config/config.go (Server.BaseURL).
Docs/config: .env.example, README.md.
Tests: signer/fs/objects/app/e2e call sites of NewSigner / Server.BaseURL.
Frontend: unchanged; relative URLs resolve against the page origin. The sameOrigin helper in PanoViewer becomes a no-op but harmless.

1.6 KiB Raw Permalink Blame History