Build [v1.9.18]

config/Caddyfile

@@ -1,10 +1,8 @@
 # TFM aInventory - Caddy Patched IP Configuration
-# Version 1.9.16 - The Open Gateway (Valid Permission check)
+# Version 1.9.17 - The Dynamic Shield (Production Polish)
 {
     admin off
     # Global TLS options for self-signed certificates
-    
-    # Global TLS options for self-signed certificates
     local_certs
     skip_install_trust
     

config/backend.env.example

@@ -5,21 +5,21 @@
 # ============================================================
 
 # --- AI API Keys ---
-# Google Gemini API Key (required for AI label OCR onboarding)
+# Google Gemini API Key (Required for AI label OCR onboarding)
+# You can also set this in the root 'inventory.env' for Docker convenience.
 GEMINI_API_KEY=your_gemini_api_key_here
 
 # --- Security ---
 # JWT secret key — generate a strong random value for production:
 #   python3 -c "import secrets; print(secrets.token_urlsafe(64))"
-# If not set, an ephemeral key is generated per-run (tokens invalidated on restart).
 JWT_SECRET_KEY=change-me-generate-a-secure-random-value
 
-# --- CORS ---
-# Comma-separated list of allowed frontend origins
-# Example for LAN deployment:
-#   ALLOWED_ORIGINS=http://192.168.84.113:8907,https://192.168.84.113:8909
-ALLOWED_ORIGINS=http://localhost:8907,https://localhost:8909
+# --- CORS & External Access ---
+# The system automatically allows localhost and the local LAN IP.
+# Use EXTRA_ALLOWED_ORIGINS for Tailscale, VPNs, or FQDNs.
+# Example: EXTRA_ALLOWED_ORIGINS=100.78.182.27,inventory.my-domain.com
+EXTRA_ALLOWED_ORIGINS=
 
-# --- Data Paths (overridden by start_server.sh / docker-compose) ---
-# DATA_DIR=/absolute/path/to/data
-# LOGS_DIR=/absolute/path/to/logs
+# --- Data Paths (usually managed by startup scripts) ---
+# DATA_DIR=/app/data
+# LOGS_DIR=/app/logs