feat: swap Redis for Dragonfly, fix remote installs, self-hosted email-only auth

- Replace redis:7-alpine with Dragonfly (Redis-protocol compatible; go-redis
  client unchanged) in root, infra, and backend-dev compose files. Bounded
  defaults --proactor_threads/--maxmemory so it boots on small VPSs.
- Frontend now defaults to same-origin API calls; nginx proxies /api/* to the
  backend (WebSocket-aware, docker DNS resolver for upstream re-resolution).
  Removes the baked localhost:8082 that broke installs reached by IP/domain.
- /auth/bootstrap returns configured OAuth providers; the UI hides
  GitHub/Google buttons unless real credentials exist. Self-hosted stays
  email/password only - OAuth reserved for a future managed offering.
- Sidecar ignores PLACEHOLDER_* OAuth credentials and trusts same-host
  origins dynamically (Origin host == request Host) so remote installs pass
  origin checks without config; cross-origin requests still rejected.
- install.sh writes ENVIRONMENT=production; COOKIE_SECURE=false in
  production is now a startup warning instead of fatal (plain-HTTP installs).
- Bootstrap failure surfaces an error notice instead of silently rendering
  the sign-in page.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/README_BACKEND.md

@@ -5,7 +5,7 @@
 ### Prerequisites
 - Go 1.21+
 - PostgreSQL 12+
-- Redis (optional)
+- Dragonfly (Redis-compatible cache)
 
 ### Environment Variables
 

app/backend/auth/src/auth.js

@@ -46,10 +46,15 @@ const database = new PostgresDialect({
   pool,
 });
 
-const githubClientId = env.GITHUB_CLIENT_ID?.trim() || '';
-const githubClientSecret = env.GITHUB_CLIENT_SECRET?.trim() || '';
-const googleClientId = env.GOOGLE_CLIENT_ID?.trim() || '';
-const googleClientSecret = env.GOOGLE_CLIENT_SECRET?.trim() || '';
+const realCredential = (value) => {
+  const trimmed = (value || '').trim();
+  return trimmed && !trimmed.startsWith('PLACEHOLDER_') ? trimmed : '';
+};
+
+const githubClientId = realCredential(env.GITHUB_CLIENT_ID);
+const githubClientSecret = realCredential(env.GITHUB_CLIENT_SECRET);
+const googleClientId = realCredential(env.GOOGLE_CLIENT_ID);
+const googleClientSecret = realCredential(env.GOOGLE_CLIENT_SECRET);
 
 const socialProviders = {};
 if (githubClientId && githubClientSecret) {
@@ -67,7 +72,7 @@ if (googleClientId && googleClientSecret) {
   };
 }
 
-const trustedOrigins = [
+const staticTrustedOrigins = [
   ...splitCsv(env.BETTER_AUTH_TRUSTED_ORIGINS),
   env.FRONTEND_URL,
   env.BACKEND_URL,
@@ -86,12 +91,33 @@ const trustedOrigins = [
   .map((origin) => (origin || '').trim())
   .filter(Boolean);
 
+// Self-hosted installs are reached over arbitrary hosts/IPs, so the static
+// list above cannot cover them. Trust an Origin only when it matches the
+// request's own Host header - that is genuine same-origin traffic (browsers
+// cannot forge either header cross-origin). Do NOT consult x-forwarded-host
+// here: clients can set it freely.
+const resolveTrustedOrigins = (request) => {
+  const origins = new Set(staticTrustedOrigins);
+  const host = request?.headers?.get('host');
+  const origin = request?.headers?.get('origin');
+  if (host && origin) {
+    try {
+      if (new URL(origin).host === host) {
+        origins.add(origin);
+      }
+    } catch {
+      // malformed Origin header - leave untrusted
+    }
+  }
+  return [...origins];
+};
+
 export const auth = betterAuth({
   appName: env.BETTER_AUTH_APP_NAME || 'Containr',
   baseURL: env.BETTER_AUTH_URL || defaultBackendURL,
   basePath: '/api/auth',
   secret: env.BETTER_AUTH_SECRET || 'PLACEHOLDER_BETTER_AUTH_SECRET_CHANGE_ME_32CHARS_MIN',
-  trustedOrigins,
+  trustedOrigins: resolveTrustedOrigins,
   database,
   user: {
     modelName: 'auth_users',

app/backend/cmd/server/main.go

@@ -89,6 +89,9 @@ func main() {
 	// Setup Gin router
 	if cfg.IsProduction() {
 		gin.SetMode(gin.ReleaseMode)
+		if !cfg.CookieSecure {
+			log.Println("Warning: COOKIE_SECURE=false in production - session cookies are sent over plain HTTP. Enable TLS and set COOKIE_SECURE=true.")
+		}
 	}
 
 	router := gin.New()

app/backend/docker-compose.yml

@@ -14,15 +14,15 @@ services:
       retries: 10
     restart: unless-stopped
 
-  redis:
-    image: redis:7-alpine
+  dragonfly:
+    image: docker.dragonflydb.io/dragonflydb/dragonfly:latest
     env_file:
       - ../../.env.prod
-    command: ["sh", "-c", "redis-server --requirepass \"$$REDIS_PASSWORD\""]
+    command: ["sh", "-c", "exec dragonfly --requirepass \"$${REDIS_PASSWORD}\" --proactor_threads=1 --maxmemory=256mb --dir=/data"]
     ports:
       - "6379:6379"
     volumes:
-      - backend_redis_data:/data
+      - backend_dragonfly_data:/data
     healthcheck:
       test: ["CMD-SHELL", "redis-cli -a \"$${REDIS_PASSWORD}\" ping | grep PONG"]
       interval: 10s
@@ -41,7 +41,7 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
-      redis:
+      dragonfly:
         condition: service_healthy
     restart: unless-stopped
     healthcheck:
@@ -52,4 +52,4 @@ services:
 
 volumes:
   backend_postgres_data:
-  backend_redis_data:
+  backend_dragonfly_data:

app/backend/internal/api/auth.go

@@ -120,13 +120,31 @@ func handleAuthBootstrap(c *gin.Context) {
 		mode = "register"
 	}
 
+	providers := []string{}
+	for _, provider := range []string{"GITHUB", "GOOGLE"} {
+		if oauthProviderConfigured(provider) {
+			providers = append(providers, strings.ToLower(provider))
+		}
+	}
+
 	c.JSON(http.StatusOK, gin.H{
 		"has_users":  count > 0,
 		"user_count": count,
 		"mode":       mode,
+		"providers":  providers,
 	})
 }
 
+// oauthProviderConfigured reports whether an OAuth provider has real
+// credentials. Placeholder values from .env.example do not count, so
+// self-hosted installs default to email/password only.
+func oauthProviderConfigured(provider string) bool {
+	id := strings.TrimSpace(os.Getenv(provider + "_CLIENT_ID"))
+	secret := strings.TrimSpace(os.Getenv(provider + "_CLIENT_SECRET"))
+	return id != "" && secret != "" &&
+		!strings.HasPrefix(id, "PLACEHOLDER_") && !strings.HasPrefix(secret, "PLACEHOLDER_")
+}
+
 type betterAuthLoginUser struct {
 	ID    string `json:"id"`
 	Email string `json:"email"`

app/backend/internal/config/config.go

@@ -215,9 +215,8 @@ func (c *Config) Validate() error {
 			return fmt.Errorf("SEED_DATA_ON_START must be false in production")
 		}
 
-		if !c.CookieSecure {
-			return fmt.Errorf("COOKIE_SECURE must be true in production")
-		}
+		// COOKIE_SECURE=false is legal for plain-HTTP self-hosted installs and is
+		// reported as a startup warning in main.go rather than a fatal error.
 
 		if c.BetterAuthEnabled {
 			if len(strings.TrimSpace(c.BetterAuthSecret)) < 32 ||

app/backend/internal/config/config_test.go

@@ -108,7 +108,7 @@ func TestValidateAllowsWildcardCorsWithoutCredentialsInProduction(t *testing.T)
 	}
 }
 
-func TestValidateRejectsInsecureCookieInProduction(t *testing.T) {
+func TestValidateAllowsInsecureCookieInProduction(t *testing.T) {
 	t.Setenv("ENVIRONMENT", "production")
 	cfg := Config{
 		JWTSecret:       "this-is-a-very-strong-production-secret-123",
@@ -120,9 +120,10 @@ func TestValidateRejectsInsecureCookieInProduction(t *testing.T) {
 		CORSCredentials: true,
 	}
 
-	err := cfg.Validate()
-	if err == nil || !strings.Contains(err.Error(), "COOKIE_SECURE must be true") {
-		t.Fatalf("expected COOKIE_SECURE validation error, got %v", err)
+	// Plain-HTTP self-hosted installs are a supported production deployment;
+	// insecure cookies are allowed and surfaced as a startup warning.
+	if err := cfg.Validate(); err != nil {
+		t.Fatalf("expected production config with insecure cookies to validate, got %v", err)
 	}
 }
 

app/frontend/Dockerfile

@@ -13,9 +13,10 @@ RUN npm ci
 # Copy source code
 COPY . .
 
-# Build-time API URL injection for Vite
-ARG VITE_API_URL=http://localhost:8082
-ARG VITE_AUTH_URL=http://localhost:8082/api/auth
+# Build-time API URL injection for Vite. Empty = same-origin via the nginx
+# /api/ proxy, which keeps the published image usable from any host.
+ARG VITE_API_URL=
+ARG VITE_AUTH_URL=
 ENV VITE_API_URL=${VITE_API_URL}
 ENV VITE_AUTH_URL=${VITE_AUTH_URL}
 

app/frontend/nginx.conf

@@ -21,6 +21,12 @@ http {
     keepalive_timeout 65;
     types_hash_max_size 2048;
 
+    # WebSocket upgrade support
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
     # Gzip compression
     gzip on;
     gzip_vary on;
@@ -51,6 +57,22 @@ http {
         add_header Referrer-Policy "no-referrer-when-downgrade" always;
         add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
 
+        # Same-origin API proxy - keeps the published image host-agnostic
+        location /api/ {
+            resolver 127.0.0.11 valid=10s;
+            set $backend_upstream http://backend:8080;
+            proxy_pass $backend_upstream;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_read_timeout 3600s;
+            proxy_send_timeout 3600s;
+        }
+
         # Handle React Router
         location / {
             try_files $uri $uri/ /index.html;

app/frontend/src/features/auth/pages.tsx

@@ -114,6 +114,7 @@ export function SignInPage() {
     queryKey: ['auth-bootstrap'],
     queryFn: getAuthBootstrap,
   });
+  const providers = bootstrapQuery.data?.providers ?? [];
   const [email, setEmail] = useState('');
   const [password, setPassword] = useState('');
   const [error, setError] = useState<string | null>(null);
@@ -168,10 +169,14 @@ export function SignInPage() {
 
   return (
     <AuthLayout>
-      <AuthCard title="Sign In" subtitle="Use email/password, GitHub, or Google.">
+      <AuthCard
+        title="Sign In"
+        subtitle={providers.length > 0 ? 'Use email/password or a connected provider.' : 'Use your email and password.'}
+      >
         {error ? <AuthErrorNotice message={error} /> : null}
         {info ? <AuthInfoNotice message={info} /> : null}
         {bootstrapQuery.isLoading ? <AuthInfoNotice message="Checking platform access mode..." /> : null}
+        {bootstrapQuery.isError ? <AuthErrorNotice message="Cannot reach the Containr API - check that the backend container is running." /> : null}
 
         <form className="space-y-3" onSubmit={submitEmailPassword}>
           <label className="block text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">
@@ -211,30 +216,38 @@ export function SignInPage() {
           </button>
         </form>
 
-        <div className="my-5 flex items-center gap-3">
-          <div className="h-px flex-1 bg-[var(--border-subtle)]" />
-          <span className="text-[11px] uppercase tracking-wider text-[var(--text-muted)]">or continue with</span>
-          <div className="h-px flex-1 bg-[var(--border-subtle)]" />
-        </div>
+        {providers.length > 0 ? (
+          <>
+            <div className="my-5 flex items-center gap-3">
+              <div className="h-px flex-1 bg-[var(--border-subtle)]" />
+              <span className="text-[11px] uppercase tracking-wider text-[var(--text-muted)]">or continue with</span>
+              <div className="h-px flex-1 bg-[var(--border-subtle)]" />
+            </div>
 
-        <div className="grid gap-2 sm:grid-cols-2">
-          <button
-            type="button"
-            onClick={() => void signInWithGitHubProvider()}
-            className="inline-flex h-10 items-center justify-center gap-2 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] text-sm font-medium text-[var(--text-primary)] transition-colors hover:border-[var(--border-default)]"
-          >
-            <Github size={15} />
-            GitHub
-          </button>
-          <button
-            type="button"
-            onClick={() => void signInWithGoogleProvider()}
-            className="inline-flex h-10 items-center justify-center gap-2 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] text-sm font-medium text-[var(--text-primary)] transition-colors hover:border-[var(--border-default)]"
-          >
-            <GoogleMark />
-            Google
-          </button>
-        </div>
+            <div className="grid gap-2 sm:grid-cols-2">
+              {providers.includes('github') ? (
+                <button
+                  type="button"
+                  onClick={() => void signInWithGitHubProvider()}
+                  className="inline-flex h-10 items-center justify-center gap-2 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] text-sm font-medium text-[var(--text-primary)] transition-colors hover:border-[var(--border-default)]"
+                >
+                  <Github size={15} />
+                  GitHub
+                </button>
+              ) : null}
+              {providers.includes('google') ? (
+                <button
+                  type="button"
+                  onClick={() => void signInWithGoogleProvider()}
+                  className="inline-flex h-10 items-center justify-center gap-2 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] text-sm font-medium text-[var(--text-primary)] transition-colors hover:border-[var(--border-default)]"
+                >
+                  <GoogleMark />
+                  Google
+                </button>
+              ) : null}
+            </div>
+          </>
+        ) : null}
 
         <div className="mt-5 flex items-center justify-between text-xs text-[var(--text-secondary)]">
           <span>Need access?</span>
@@ -292,6 +305,7 @@ export function SignUpPage() {
       <AuthCard title="Create Account" subtitle="Create first platform owner account. Registration closes after bootstrap.">
         {error ? <AuthErrorNotice message={error} /> : null}
         {bootstrapQuery.isLoading ? <AuthInfoNotice message="Checking platform bootstrap state..." /> : null}
+        {bootstrapQuery.isError ? <AuthErrorNotice message="Cannot reach the Containr API - check that the backend container is running." /> : null}
 
         <form className="space-y-3" onSubmit={submitSignUp}>
           <label className="block text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">

app/frontend/src/lib/api-client.ts

@@ -348,7 +348,8 @@ type ProjectsResponse200 = paths['/projects']['get']['responses'][200]['content'
 
 type JsonLike = Record<string, unknown>;
 
-const rawBase = (import.meta.env.VITE_API_URL as string | undefined) ?? 'http://localhost:8082';
+const configuredBase = ((import.meta.env.VITE_API_URL as string | undefined) ?? '').trim();
+const rawBase = configuredBase || window.location.origin;
 const normalizedBase = rawBase.replace(/\/$/, '');
 const API_ROOT = normalizedBase.replace(/\/api\/v1$/, '').replace(/\/api$/, '');
 const API_BASE = /\/api\/v1$/.test(normalizedBase) ? normalizedBase : `${normalizedBase}/api/v1`;

app/frontend/src/lib/auth-client.ts

@@ -20,6 +20,7 @@ export type AuthBootstrap = {
   hasUsers: boolean;
   userCount: number;
   mode: 'register' | 'login';
+  providers: string[];
 };
 
 export class AuthError extends Error {
@@ -32,15 +33,16 @@ export class AuthError extends Error {
   }
 }
 
-const rawAuthBase = (import.meta.env.VITE_AUTH_URL as string | undefined) ?? 'http://localhost:8082/api/auth';
-const AUTH_BASE = rawAuthBase.replace(/\/$/, '');
+const configuredAuthBase = ((import.meta.env.VITE_AUTH_URL as string | undefined) ?? '').trim();
+const AUTH_BASE = (configuredAuthBase || `${window.location.origin}/api/auth`).replace(/\/$/, '');
 
 export function getAuthBaseUrl(): string {
   return AUTH_BASE;
 }
 
 export async function getAuthBootstrap(): Promise<AuthBootstrap> {
-  const apiBase = ((import.meta.env.VITE_API_URL as string | undefined) ?? 'http://localhost:8082').replace(/\/$/, '');
+  const configuredApiBase = ((import.meta.env.VITE_API_URL as string | undefined) ?? '').trim();
+  const apiBase = (configuredApiBase || window.location.origin).replace(/\/$/, '');
   const normalizedApiBase = /\/api\/v1$/.test(apiBase) ? apiBase : `${apiBase}/api/v1`;
   const response = await fetch(`${normalizedApiBase}/auth/bootstrap`, {
     method: 'GET',
@@ -56,10 +58,15 @@ export async function getAuthBootstrap(): Promise<AuthBootstrap> {
     throw new AuthError(message, response.status);
   }
 
+  const providers = Array.isArray(payload?.providers)
+    ? payload.providers.filter((provider): provider is string => typeof provider === 'string')
+    : [];
+
   return {
     hasUsers: Boolean(payload?.has_users),
     userCount: typeof payload?.user_count === 'number' ? payload.user_count : 0,
     mode: payload?.mode === 'register' ? 'register' : 'login',
+    providers,
   };
 }
 

app/frontend/vite.config.ts

@@ -6,6 +6,16 @@ import path from 'path'
 // https://vite.dev/config/
 export default defineConfig({
   plugins: [react()],
+  server: {
+    proxy: {
+      // Same-origin API path for dev - matches the nginx proxy in the shipped image
+      '/api': {
+        target: 'http://localhost:8082',
+        changeOrigin: true,
+        ws: true,
+      },
+    },
+  },
   test: {
     globals: true,
     environment: 'happy-dom',