docs: document OAUTH_ALLOW_PRIVATE_ENDPOINTS in env/config examples

2026-05-22 17:57:41 +02:00
parent c46de636e0
commit 5aa6d7a2f0
1 changed files with 5 additions and 0 deletions
@@ -49,6 +49,11 @@ JMAP_SERVER_URL=https://your-jmap-server.com
 # OpenID Connect issuer URL for discovery
 # OAUTH_ISSUER_URL=https://your-idp.example.com

+# Allow OAuth discovery to resolve to private (RFC-1918 / loopback) addresses.
+# Off by default as an SSRF guard. Enable for split-DNS deployments where the
+# OAuth issuer's public hostname resolves to an internal IP from this server.
+# OAUTH_ALLOW_PRIVATE_ENDPOINTS=true
+
 # =============================================================================
 # Session & Security
 # =============================================================================