From 7b7244211405d2661bde06317cc669cba12265c9 Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Sat, 15 Mar 2025 16:29:02 -0700
Subject: [PATCH] Update index.md
---
docs/installation/index.md | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/docs/installation/index.md b/docs/installation/index.md
index 3aaa4144..d1f95dbe 100644
--- a/docs/installation/index.md
+++ b/docs/installation/index.md
@@ -29,10 +29,12 @@ You have a few options for deploying homepage, depending on your needs. We offer
### `HOMEPAGE_ALLOWED_HOSTS`
-As of v1.0 there is one required environment variable to access homepage via a URL other than `localhost`, HOMEPAGE_ALLOWED_HOSTS. This is a comma separated (no spaces) list of allowed hosts (sometimes with the port) that can host your homepage install. See the [docker](docker.md) and [source](source.md) installation pages for more information.
+As of v1.0 there is one required environment variable to access homepage via a URL other than `localhost`, HOMEPAGE_ALLOWED_HOSTS. The setting helps prevent certain kinds of attacks when retrieving data from the homepage API proxy.
-`localhost:3000` and `127.0.0.1:3000` are always allowed, but you can add a domain or IP address to this list to allow that host such as `HOMEPAGE_ALLOWED_HOSTS=gethomepage.dev,192.168.1.2:1234`, etc.
+The value is a comma-separated (no spaces) list of allowed hosts (sometimes with the port) that can host your homepage install. See the [docker](docker.md), [kubernetes](k8s.md) and [source](source.md) installation pages for more information about where / how to set the variable.
-If you are seeing errors about host validation, check the homepage logs and ensure that the host as listed in the logs is in the `HOMEPAGE_ALLOWED_HOSTS` list.
+`localhost:3000` and `127.0.0.1:3000` are always included, but you can add a domain or IP address to this list to allow that host such as `HOMEPAGE_ALLOWED_HOSTS=gethomepage.dev,192.168.1.2:1234`, etc.
+
+If you are seeing errors about host validation, check the homepage logs and ensure that the host exactly as output in the logs is in the `HOMEPAGE_ALLOWED_HOSTS` list.
This can be disabled by setting `HOMEPAGE_ALLOWED_HOSTS` to `*` but this is not recommended.