Public URL, Proxy and CORS
Public URL
The public URL is the address people reach the instance at, such as https://ops.acme-field.example. TotalBase builds every link that leaves it from it: invitations, password resets, email verification, sign-in provider callbacks, embed links.
It's the Public URL setting in Settings › General › General, or, while that's empty, the TOTALBASE_PUBLIC_URL environment variable. TotalBase never takes it from the request's Host header, which a caller controls: a forged header can't make a reset email point elsewhere.
Changing it changes every link sent from then on. Links already sent keep their old address, and sign-in providers need the new callback registered.
Behind a reverse proxy
TLS usually ends at a proxy in front of TotalBase. TotalBase then sees every request coming from the proxy. Trust reverse proxy headers, in Settings › Security › Network, makes it read the real client IP from X-Forwarded-For, for the audit log, sessions and the rate limit. It applies after a restart.
X-Forwarded-For and pass for another IP.A Caddy example:
ops.acme-field.example {
reverse_proxy 127.0.0.1:3050
}
Let the proxy pass request bodies up to the maximum file size, or uploads fail at the proxy.
CORS
A page on another site, such as Acme's customer portal at https://portal.acme-field.example, can call TotalBase's API from the browser only if that site is listed in Allowed origins, in Settings › Security › Network. The list starts empty: no other site may. There's no "every site" setting.
CORS only concerns browsers. Servers, scripts, apps and agents call the API with a token whatever the list says.
Dashboard embeds use their own list, Sites that may embed: see Settings › Features › Dashboards.