web: vite devサーバーのHost許可リストを設定

Coolifyの公開ドメイン(altdock.app.amania.jp)がvite 8のHostチェックで
403 Blocked requestになるため、VITE_ALLOWED_HOSTSで許可ホストを
環境変数から設定できるようにした。composeのデフォルトは
altdock.app.amania.jp、カンマ区切り複数対応、* で全許可。

.env.example

@@ -3,6 +3,9 @@ PORT=4000
 PUBLIC_BASE_URL=http://localhost:4000
 WEB_ORIGIN=http://localhost:3001
 NEXT_PUBLIC_AUTH_MODE=demo
+# Vite dev server Host allow-list (comma-separated, or * for any host).
+# On Coolify set this to your public domain, e.g. altdock.app.amania.jp
+VITE_ALLOWED_HOSTS=altdock.app.amania.jp
 
 # --- Storage (MinIO via docker compose) -------------------------------------
 # Leave DATABASE_URL empty to run with an in-memory store instead of Postgres.

docker-compose.yml

@@ -113,6 +113,8 @@ services:
     environment:
       NEXT_PUBLIC_API_BASE_URL: ${NEXT_PUBLIC_API_BASE_URL:-http://localhost:4000}
       NEXT_PUBLIC_AUTH_MODE: ${AUTH_MODE:-demo}
+      # Hosts allowed to reach the dev server (comma-separated, or * for any).
+      VITE_ALLOWED_HOSTS: ${VITE_ALLOWED_HOSTS:-altdock.app.amania.jp}
     ports:
       - "3001:3001"
     depends_on:

vite.config.ts

@@ -11,6 +11,19 @@ const { d1, r2 } = hostingConfig;
 // macOS Seatbelt blocks FSEvents, so Codex previews need polling for HMR.
 const isCodexSeatbeltSandbox = process.env.CODEX_SANDBOX === "seatbelt";
 
+// Vite 8 blocks unknown Host headers by default. In dev (incl. Coolify
+// proxying a public domain to the dev server) the public hosts must be
+// allow-listed. Accepts a comma-separated list, or "*"/"true" for any host.
+function parseAllowedHosts(raw: string | undefined): boolean | string[] | undefined {
+  if (!raw) return undefined;
+  const value = raw.trim();
+  if (!value || value === "*" || value === "true") return true;
+  return value
+    .split(",")
+    .map((host) => host.trim())
+    .filter(Boolean);
+}
+
 const localBindingConfig = {
   main: "./worker/index.ts",
   compatibility_flags: ["nodejs_compat"],
@@ -43,9 +56,17 @@ export default defineConfig(async () => {
   // Wrangler snapshots its log path while the Cloudflare plugin is imported.
   const { cloudflare } = await import("@cloudflare/vite-plugin");
 
+  const allowedHosts = parseAllowedHosts(process.env.VITE_ALLOWED_HOSTS);
+
   return {
-    server: isCodexSeatbeltSandbox
+    server:
+      isCodexSeatbeltSandbox || allowedHosts
+        ? {
+            ...(isCodexSeatbeltSandbox
               ? { watch: { useFsEvents: false, usePolling: true } }
+              : {}),
+            ...(allowedHosts ? { allowedHosts } : {}),
+          }
         : undefined,
     plugins: [
       vinext(),