From 545a84b1375526e7b40dc3fe7cf1beb8bdab44f6 Mon Sep 17 00:00:00 2001
From: kitos <kitos@aegis.local>
Date: Wed, 22 Jul 2026 16:19:27 +0200
Subject: [PATCH] fix(config): require PLATFORM_URL explicitly, no hardcoded
 domain default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous fix defaulted PLATFORM_URL to this deployment's own domain
directly in docker-compose.prod.yml — any other deployment of this repo
would silently inherit it if they forgot to set their own. Now there is
no default at all: the compose file requires the env var to be set, and
the backend refuses to start in production if PLATFORM_URL still equals
the dev value, mirroring the existing SECRET_KEY enforcement.
---
 .env.example            |  5 +++--
 backend/app/config.py   | 11 +++++++++++
 docker-compose.prod.yml |  5 +++--
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/.env.example b/.env.example
index d62acca..b259c64 100644
--- a/.env.example
+++ b/.env.example
@@ -41,8 +41,9 @@ FRONTEND_PORT=80
 
 # ── Emails ────────────────────────────────────────────────────────────────────
 # Base URL used to build links in outbound emails (set-password, etc).
-# Must match your real public frontend URL — the app falls back to
-# http://localhost:5173 (dev default) if this is not set.
+# REQUIRED in production — must be THIS deployment's real public frontend
+# URL. There is no safe default (it's unique per deployment); the backend
+# refuses to start without it when AEGIS_ENV=production.
 PLATFORM_URL=https://your-domain.com
 
 # ── Environment flag ─────────────────────────────────────────────────────────
diff --git a/backend/app/config.py b/backend/app/config.py
index 500410b..4561504 100644
--- a/backend/app/config.py
+++ b/backend/app/config.py
@@ -211,3 +211,14 @@ if _is_production:
                 f"Set a strong value via the {name} environment variable "
                 f"before running in production."
             )
+
+    # PLATFORM_URL has no safe production default — it's baked into every
+    # emailed link (set-password, notifications). Falling back silently to
+    # the dev value (or to some other deployment's hardcoded domain) would
+    # ship broken/wrong links without anyone noticing.
+    if settings.PLATFORM_URL == "http://localhost:5173":
+        raise RuntimeError(
+            "CRITICAL: PLATFORM_URL is not configured. Set it to this "
+            "deployment's real public frontend URL via the PLATFORM_URL "
+            "environment variable before running in production."
+        )
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index e90e0c0..24dc8db 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -91,8 +91,9 @@ services:
       REDIS_CACHE_DB: ${REDIS_CACHE_DB:-2}
       CORS_ORIGINS: ${CORS_ORIGINS:-}
       # Base URL used to build links in outbound emails (set-password, etc).
-      # Must be the real public frontend URL, not the dev default.
-      PLATFORM_URL: ${PLATFORM_URL:-http://aegis.undiamagico.es}
+      # No default on purpose — every deployment has a different domain;
+      # the backend refuses to start in production without this set.
+      PLATFORM_URL: ${PLATFORM_URL:?Set PLATFORM_URL in your .env file to this deployment's real public frontend URL}
       AEGIS_ENV: ${AEGIS_ENV:-production}
       SECURE_COOKIES: ${SECURE_COOKIES:-false}
       ADMIN_USERNAME: ${ADMIN_USERNAME:-admin}