From 9f3995fb777af8ae373ba5a746030fd5a9677469 Mon Sep 17 00:00:00 2001
From: mohiit1502 <mohiit1502@gmail.com>
Date: Wed, 11 Mar 2026 01:58:49 +0530
Subject: [PATCH] fix: add nebula.armco.dev to CORS_ORIGINS in .env.production;
 document API URL source of truth

---
 .env.production | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.env.production b/.env.production
index 3871868..0a48eef 100644
--- a/.env.production
+++ b/.env.production
@@ -2,7 +2,10 @@
 # Backend
 API_HOST=0.0.0.0
 API_PORT=8081
-CORS_ORIGINS=https://nebula.stuffle.io
+# Frontend domains allowed to call this API — comma-separated, no trailing slashes.
+# The frontend API base URL is set in webapp/.env.production (VITE_API_URL).
+# This server must be reachable at https://nebula.armco.dev/api/v1
+CORS_ORIGINS=https://nebula.stuffle.io,https://nebula.armco.dev
 
 # Database — set via secrets manager / deploy env, not hardcoded here
 # DATABASE_URL=postgresql://...