From 92476902cf82f38160d37a25436f2fae6bdc6e4d Mon Sep 17 00:00:00 2001
From: Matt <matt@letsbe.solutions>
Date: Tue, 10 Feb 2026 13:55:52 +0100
Subject: [PATCH] Fix hardcoded ORIGIN in docker-compose.yml

- Change ORIGIN from hardcoded localhost to use environment variable
- Allows production deployment with correct domain for CSRF protection
- Maintains localhost default for local development

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 docker-compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 1ac5749..446abc1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -291,7 +291,7 @@ services:
       SUPABASE_SERVICE_ROLE_KEY: ${SERVICE_ROLE_KEY}
       SUPABASE_INTERNAL_URL: http://kong:8000
       NODE_ENV: production
-      ORIGIN: http://localhost:7453
+      ORIGIN: ${ORIGIN:-http://localhost:7453}
       # Body size limit for file uploads (50MB)
       BODY_SIZE_LIMIT: ${BODY_SIZE_LIMIT:-52428800}
     depends_on: