From b03c8d4bd430c125cf9d3ed7778ed644283dea19 Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Sun, 27 Sep 2026 23:08:21 +0000
Subject: [PATCH] Cloud container: Rudder accepts every host the container
 serves, not only the sign-in host

With two domains on one container, the engine answered the second one 403 "forbidden host", so Rudder
showed offline there. The allowed list now defaults to the hosts Coolify gives the container
(COOLIFY_FQDN), then the OIDC redirect host; always an explicit list, never a wildcard.
---
 deployment/cloud/README.md |  2 +-
 deployment/cloud/entry.sh  | 10 ++++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/deployment/cloud/README.md b/deployment/cloud/README.md
index 31a1ec61f..e70e43fdb 100644
--- a/deployment/cloud/README.md
+++ b/deployment/cloud/README.md
@@ -68,7 +68,7 @@ there. Only then does it swap the new build in.
 | `PUBLIC_API_BASE` | the public API URL written into the build's `runtime-config.js` (e.g. `https://<host>/api-prod`) |
 | `BUILD_MAX_OLD_SPACE_MB` | Node heap cap for a build (default `1536`) |
 | `RUDDER_ENGINE` | `1` runs Rudder's voice-to-text engine here, fed by the browser's microphone (about 1 GB more; its runtime and model, ~742 MB, are baked into the image at `/opt/rudder`, and `/data/rudder` wins when it holds a model). The site serves at once; Rudder shows "starting" until its engine is built, then the dev server restarts once to start it. Give the container at least 2 vCPUs, or transcription falls behind speech |
-| `RUDDER_ALLOW_HOST` | the public host the engine accepts (it refuses others); defaults to the host in `OIDC_REDIRECT_URL` |
+| `RUDDER_ALLOW_HOST` | every public host the engine accepts, comma-separated (it refuses others, so list each domain the container answers on); defaults to Coolify's `COOLIFY_FQDN`, else the host in `OIDC_REDIRECT_URL` |
 
 Mount a persistent volume at **`/data`** (PocketBase data and published builds). Memory measured on
 the running container: about 0.45 GB idle, up to about 1.5 GB more during a build, so give it
diff --git a/deployment/cloud/entry.sh b/deployment/cloud/entry.sh
index 91947174f..fb415af3a 100755
--- a/deployment/cloud/entry.sh
+++ b/deployment/cloud/entry.sh
@@ -52,11 +52,17 @@ if [ "${RUDDER_ENGINE:-0}" = 1 ]; then
     if ls /data/rudder/models/*.gguf >/dev/null 2>&1; then RUDDER_HOME=/data/rudder; else RUDDER_HOME=/opt/rudder; fi
   fi
   export RUDDER_HOME RUDDER_AUDIO=browser
-  # The engine refuses a non-loopback Host header, and Vite's proxy passes the public host through:
-  # allow the public host, defaulting to the one in OIDC_REDIRECT_URL.
+  # The engine refuses a non-loopback Host header, and Vite's proxy passes the public host through, so
+  # EVERY host the container answers on must be listed (an unlisted one leaves Rudder "offline" there).
+  # An explicit list, never a wildcard: RUDDER_ALLOW_HOST if set, else the hosts Coolify gives the
+  # container (COOLIFY_FQDN, comma-separated), else the host in OIDC_REDIRECT_URL.
+  if [ -z "${RUDDER_ALLOW_HOST:-}" ] && [ -n "${COOLIFY_FQDN:-}" ]; then
+    RUDDER_ALLOW_HOST=$(printf '%s' "$COOLIFY_FQDN" | sed -E 's#[a-z]+://##g; s#[/:][^,]*##g')
+  fi
   if [ -z "${RUDDER_ALLOW_HOST:-}" ] && [ -n "${OIDC_REDIRECT_URL:-}" ]; then
     RUDDER_ALLOW_HOST=$(printf '%s' "$OIDC_REDIRECT_URL" | sed -E 's#^[a-z]+://([^/:]+).*#\1#')
   fi
+  echo "[rudder] allowed hosts: ${RUDDER_ALLOW_HOST:-loopback only}"
   export RUDDER_ALLOW_HOST="${RUDDER_ALLOW_HOST:-}"
   # The state file is read by vite.cloud.config.mjs: running -> done | failed.
   echo running > /tmp/rudder-setup.state