From 5aa6d7a2f0da046421a38cb5a968bf8b480cca65 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Fri, 22 May 2026 17:57:41 +0200
Subject: [PATCH] docs: document OAUTH_ALLOW_PRIVATE_ENDPOINTS in env/config
 examples

---
 .env.example | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.env.example b/.env.example
index c2f2b40c..99da0cb0 100644
--- a/.env.example
+++ b/.env.example
@@ -49,6 +49,11 @@ JMAP_SERVER_URL=https://your-jmap-server.com
 # OpenID Connect issuer URL for discovery
 # OAUTH_ISSUER_URL=https://your-idp.example.com
 
+# Allow OAuth discovery to resolve to private (RFC-1918 / loopback) addresses.
+# Off by default as an SSRF guard. Enable for split-DNS deployments where the
+# OAuth issuer's public hostname resolves to an internal IP from this server.
+# OAUTH_ALLOW_PRIVATE_ENDPOINTS=true
+
 # =============================================================================
 # Session & Security
 # =============================================================================