[GH-ISSUE #63] Not working on different base_domain #34

Open
opened 2026-02-27 15:54:41 +03:00 by kerem · 7 comments
Owner

Originally created by @CrazyWolf13 on GitHub (Aug 4, 2025).
Original GitHub issue: https://github.com/RayLabsHQ/gitea-mirror/issues/63

Originally assigned to: @arunavo4 on GitHub.

Hi

I run gitea-mirror like I do with all my services through nginxproxymanager via a dns record, that points the subdomain to nginxproxymanager which reverse-proxies giteamirror to gitea-mirror.mydomain.tld.

This is a pretty standart system, sometimes it requires websockets to be activated in nginxproxymanager, which I did for gitea-mirror.

No matter what I do, the pages don't show content and I can't even sing in:

Image
Originally created by @CrazyWolf13 on GitHub (Aug 4, 2025). Original GitHub issue: https://github.com/RayLabsHQ/gitea-mirror/issues/63 Originally assigned to: @arunavo4 on GitHub. Hi I run gitea-mirror like I do with all my services through nginxproxymanager via a dns record, that points the subdomain to nginxproxymanager which reverse-proxies giteamirror to gitea-mirror.mydomain.tld. This is a pretty standart system, sometimes it requires websockets to be activated in nginxproxymanager, which I did for gitea-mirror. No matter what I do, the pages don't show content and I can't even sing in: <img width="1580" height="1097" alt="Image" src="https://github.com/user-attachments/assets/1931cfe7-5487-4a78-8796-cb11cd1c6f88" />
Author
Owner

@arunavo4 commented on GitHub (Aug 5, 2025):

@CrazyWolf13 please check your ENV variables are properly set

BETTER_AUTH_URL=https://gitea-mirror.mydomain.tld
BETTER_AUTH_TRUSTED_ORIGINS=https://gitea-mirror.mydomain.tld

<!-- gh-comment-id:3153109625 --> @arunavo4 commented on GitHub (Aug 5, 2025): @CrazyWolf13 please check your ENV variables are properly set BETTER_AUTH_URL=https://gitea-mirror.mydomain.tld BETTER_AUTH_TRUSTED_ORIGINS=https://gitea-mirror.mydomain.tld
Author
Owner

@CrazyWolf13 commented on GitHub (Aug 27, 2025):

@arunavo4 Thanks!
Apologies, that totally slipped by.

Is there any way to add two urls?
So I can manage gitea mirror directly via IP and remote via domain, something like this:

BETTER_AUTH_URL=http://10.10.20.45:4321,https://gitea-mirror.mydomain.tld

Also what is the trusted origin for, I see no mention in the enviroment docs: https://github.com/RayLabsHQ/gitea-mirror/blob/main/docs/ENVIRONMENT_VARIABLES.md

<!-- gh-comment-id:3229129510 --> @CrazyWolf13 commented on GitHub (Aug 27, 2025): @arunavo4 Thanks! Apologies, that totally slipped by. Is there any way to add two urls? So I can manage gitea mirror directly via IP and remote via domain, something like this: ```bash BETTER_AUTH_URL=http://10.10.20.45:4321,https://gitea-mirror.mydomain.tld ``` Also what is the trusted origin for, I see no mention in the enviroment docs: https://github.com/RayLabsHQ/gitea-mirror/blob/main/docs/ENVIRONMENT_VARIABLES.md
Author
Owner

@arunavo4 commented on GitHub (Aug 28, 2025):

@CrazyWolf13 Yes! Use BETTER_AUTH_TRUSTED_ORIGINS to specify additional access URLs:
BETTER_AUTH_URL=https://gitea-mirror.mydomain.tld
BETTER_AUTH_TRUSTED_ORIGINS=http://10.10.20.45:4321,http://192.168.1.100:4321

It specifies URLs allowed to make authentication requests, enabling:

  • Multiple access points (local IP + domain)
  • SSO/OIDC provider integration
  • Reverse proxy support
  • Cross-origin authentication

Will update docs soon. Links to better-auth docs https://www.better-auth.com/docs/reference/options#trustedorigins

<!-- gh-comment-id:3231013510 --> @arunavo4 commented on GitHub (Aug 28, 2025): @CrazyWolf13 Yes! Use BETTER_AUTH_TRUSTED_ORIGINS to specify additional access URLs: BETTER_AUTH_URL=https://gitea-mirror.mydomain.tld BETTER_AUTH_TRUSTED_ORIGINS=http://10.10.20.45:4321,http://192.168.1.100:4321 It specifies URLs allowed to make authentication requests, enabling: - Multiple access points (local IP + domain) - SSO/OIDC provider integration - Reverse proxy support - Cross-origin authentication Will update docs soon. Links to `better-auth` docs https://www.better-auth.com/docs/reference/options#trustedorigins
Author
Owner

@CrazyWolf13 commented on GitHub (Aug 29, 2025):

Hi @arunavo4

Thanks a lot, I tried the following:

BETTER_AUTH_URL=https://gitea-mirror.mydomain.tld
BETTER_AUTH_TRUSTED_ORIGINS=https://gitea-mirror.mydomain.tld,http://10.10.20.45:4321

and also this:

BETTER_AUTH_URL=https://gitea-mirror.mydomain.tld
BETTER_AUTH_TRUSTED_ORIGINS=http://10.10.20.45:4321

Though both without success when using the IP:

Image
<!-- gh-comment-id:3236990139 --> @CrazyWolf13 commented on GitHub (Aug 29, 2025): Hi @arunavo4 Thanks a lot, I tried the following: ```bash BETTER_AUTH_URL=https://gitea-mirror.mydomain.tld BETTER_AUTH_TRUSTED_ORIGINS=https://gitea-mirror.mydomain.tld,http://10.10.20.45:4321 ``` and also this: ```bash BETTER_AUTH_URL=https://gitea-mirror.mydomain.tld BETTER_AUTH_TRUSTED_ORIGINS=http://10.10.20.45:4321 ``` Though both without success when using the IP: <img width="487" height="109" alt="Image" src="https://github.com/user-attachments/assets/bd240a3e-0fac-480c-8bc8-0adde4b75998" />
Author
Owner

@arunavo4 commented on GitHub (Aug 29, 2025):

Hey I think I found the issue, the client side is using window to get url and that's causing an issue when authenticating will fix it

<!-- gh-comment-id:3237225950 --> @arunavo4 commented on GitHub (Aug 29, 2025): Hey I think I found the issue, the client side is using window to get url and that's causing an issue when authenticating will fix it
Author
Owner

@arunavo4 commented on GitHub (Aug 29, 2025):

@CrazyWolf13 Iin v3.5.0 add a new variable PUBLIC_BETTER_AUTH_URL which makes sure that the client side calls the serverside using the valid url and not window.location.origin

PUBLIC_BETTER_AUTH_URL=https://gitea-mirror.mydomain.tld
BETTER_AUTH_URL=https://gitea-mirror.mydomain.tld
BETTER_AUTH_TRUSTED_ORIGINS=https://gitea-mirror.mydomain.tld,http://10.10.20.45:4321
<!-- gh-comment-id:3237499763 --> @arunavo4 commented on GitHub (Aug 29, 2025): @CrazyWolf13 Iin v3.5.0 add a new variable `PUBLIC_BETTER_AUTH_URL` which makes sure that the client side calls the serverside using the valid url and not `window.location.origin` ``` PUBLIC_BETTER_AUTH_URL=https://gitea-mirror.mydomain.tld BETTER_AUTH_URL=https://gitea-mirror.mydomain.tld BETTER_AUTH_TRUSTED_ORIGINS=https://gitea-mirror.mydomain.tld,http://10.10.20.45:4321 ```
Author
Owner

@CrazyWolf13 commented on GitHub (Aug 30, 2025):

@arunavo4 While the error for the invalid origin is gone, I'm stuck in a sign-in loop using the direct-ip, e.g. after seemingly successful login it redirects to login again, this over and over, trying to access "/" also redirects to login.

Using Public_Better_Auth_URL to access works without issues only when using the ip:port there are issues,

<!-- gh-comment-id:3239171043 --> @CrazyWolf13 commented on GitHub (Aug 30, 2025): @arunavo4 While the error for the invalid origin is gone, I'm stuck in a sign-in loop using the direct-ip, e.g. after seemingly successful login it redirects to login again, this over and over, trying to access "/" also redirects to login. Using Public_Better_Auth_URL to access works without issues only when using the ip:port there are issues,
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/gitea-mirror#34
No description provided.