feat(local-mode): run as is, without sign-in or SMTP authentication, when no public URL is set #10

Merged

SebastienDenooz merged 1 commit from develop into main 2026-09-28 12:44:50 +00:00

Conversation 0 Commits 1 Files changed 60 +1098 -113

SebastienDenooz commented 2026-09-28 12:32:18 +00:00

Owner

Copy link

docker run -p 127.0.0.1:1125:1125 -p 127.0.0.1:3025:3000 alchemicstudiohq/trapbox
is enough on a developer's machine (docs/specifications-v1.md §4.6). While
TRAPBOX_PUBLIC_URL is unset (TRAPBOX_AUTH=none|required overrides it):

• the first start creates the local administrator (no password to
  change) and a "Local" environment, recreated if removed, and says so
  in the logs;
• requests without credentials act as the local administrator through
  one shared session, for local host names only (localhost, IP
  addresses, single-label names, TRAPBOX_LOCAL_HOSTS), which keeps DNS
  rebinding out; browser changes still need a same-origin request;
• SMTP authentication is optional: messages without it, or with
  unknown credentials, land in "Local"; credentials still route to
  their environment;
• the Mailpit-compatible API reads "Local" without a token;
• links, the HTML frame and its policies follow the address of each
  request, so any host port works; webhook links follow the last
  address a browser used.

The interface shows a "Local mode" badge and no sign-out, the sign-in
page explains a refused host, and the connection panel says where
messages without credentials go. Web setup and single sign-on are
refused without authentication. Deployments that set a public URL keep
full authentication.

`docker run -p 127.0.0.1:1125:1125 -p 127.0.0.1:3025:3000 alchemicstudiohq/trapbox` is enough on a developer's machine (docs/specifications-v1.md §4.6). While TRAPBOX_PUBLIC_URL is unset (TRAPBOX_AUTH=none|required overrides it): - the first start creates the local administrator (no password to change) and a "Local" environment, recreated if removed, and says so in the logs; - requests without credentials act as the local administrator through one shared session, for local host names only (localhost, IP addresses, single-label names, TRAPBOX_LOCAL_HOSTS), which keeps DNS rebinding out; browser changes still need a same-origin request; - SMTP authentication is optional: messages without it, or with unknown credentials, land in "Local"; credentials still route to their environment; - the Mailpit-compatible API reads "Local" without a token; - links, the HTML frame and its policies follow the address of each request, so any host port works; webhook links follow the last address a browser used. The interface shows a "Local mode" badge and no sign-out, the sign-in page explains a refused host, and the connection panel says where messages without credentials go. Web setup and single sign-on are refused without authentication. Deployments that set a public URL keep full authentication.

SebastienDenooz added 1 commit 2026-09-28 12:32:18 +00:00

feat(local-mode): run as is, without sign-in or SMTP authentication, when no public URL is set ... ab21ee599a

`docker run -p 127.0.0.1:1125:1125 -p 127.0.0.1:3025:3000 alchemicstudiohq/trapbox`
is enough on a developer's machine (docs/specifications-v1.md §4.6). While
TRAPBOX_PUBLIC_URL is unset (TRAPBOX_AUTH=none|required overrides it):

- the first start creates the local administrator (no password to
  change) and a "Local" environment, recreated if removed, and says so
  in the logs;
- requests without credentials act as the local administrator through
  one shared session, for local host names only (localhost, IP
  addresses, single-label names, TRAPBOX_LOCAL_HOSTS), which keeps DNS
  rebinding out; browser changes still need a same-origin request;
- SMTP authentication is optional: messages without it, or with
  unknown credentials, land in "Local"; credentials still route to
  their environment;
- the Mailpit-compatible API reads "Local" without a token;
- links, the HTML frame and its policies follow the address of each
  request, so any host port works; webhook links follow the last
  address a browser used.

The interface shows a "Local mode" badge and no sign-out, the sign-in
page explains a refused host, and the connection panel says where
messages without credentials go. Web setup and single sign-on are
refused without authentication. Deployments that set a public URL keep
full authentication.

SebastienDenooz merged commit ab21ee599a into main 2026-09-28 12:44:50 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

question

More information is needed

  

wontfix

This won't be fixed

  

ai::retry

retry

  

ai::retry_once

retry_once

  

ai::retry_until_green

retry_until_green

  

ai::validate_plan

validate_plan

  

status::blocked

blocked

  

status::done

done

  

status::functional_analysis

functional_analysis

  

status::in_ci

in_ci

  

status::in_development

in_development

  

status::in_review

in_review

  

status::technical_analysis

technical_analysis

  

status::waiting_info

waiting_info

  

status::waiting_validation

waiting_validation

  

type::analysis

analysis

  

type::bug

bug

  

type::question

question

  

type::task

task

No labels

bug

duplicate

enhancement

help wanted

invalid

question

wontfix

ai::retry

ai::retry_once

ai::retry_until_green

ai::validate_plan

status::blocked

status::done

status::functional_analysis

status::in_ci

status::in_development

status::in_review

status::technical_analysis

status::waiting_info

status::waiting_validation

type::analysis

type::bug

type::question

type::task

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Alchemic.Studio/Trapbox!10

No description provided.