[gitnexus serve] Ignoring ${PUBLIC_ORIGIN_ENV}=${raw} — not

Error message

[gitnexus serve] Ignoring ${PUBLIC_ORIGIN_ENV}=${raw} — not a single reachable origin, so it admits nothing. Set it to one host, optionally with a scheme and a port.

What it means

logOriginPolicy validates the PUBLIC_ORIGIN_ENV value with createPublicOriginMatcher. A value that is not exactly one reachable origin (multiple hosts, a wildcard, or unparseable text) constructs no matcher, so it admits nothing beyond loopback for browser write routes, and this warning fires stating the value was ignored. The design prefers diagnosing a misconfigured value over an absent one.

Source

Thrown at gitnexus/src/server/middleware.ts:274

  );
}

/**
 * Report at startup what {@link createWriteOriginGuard} will admit, so an
 * operator can see it without reproducing a 403. A wildcard bind always warns —
 * gating that on {@link PUBLIC_ORIGIN_ENV} being constructible would diagnose a
 * misconfigured value worse than an absent one.
 */
export function logOriginPolicy(boundHost?: string): void {
  const raw = process.env[PUBLIC_ORIGIN_ENV]?.trim();
  const publicOrigin = createPublicOriginMatcher(raw);
  if (publicOrigin) {
    logger.info(
      { [PUBLIC_ORIGIN_ENV]: raw, hostname: publicOrigin.hostname },
      `[gitnexus serve] Browser write routes also accept origins on ${publicOrigin.hostname}.`,
    );
  } else if (raw) {
    logger.warn(
      { [PUBLIC_ORIGIN_ENV]: raw },
      `[gitnexus serve] Ignoring ${PUBLIC_ORIGIN_ENV}=${raw} — not a single reachable origin, ` +
        `so it admits nothing. Set it to one host, optionally with a scheme and a port.`,
    );
  }

  if (!boundHost || normalizeBoundHost(boundHost) !== undefined) return;
  const admitted = publicOrigin
    ? `accept loopback origins (localhost/127.0.0.1/[::1]) and ${publicOrigin.hostname} via ` +
      `${PUBLIC_ORIGIN_ENV}.`
    : `accept only loopback origins (localhost/127.0.0.1/[::1]). To admit writes from a specific ` +
      `LAN address, bind --host <that-address> instead of a wildcard; to admit them from a ` +
      `public origin, set ${PUBLIC_ORIGIN_ENV} to it.`;
  logger.warn(
    { host: boundHost },
    `[gitnexus serve] Bound to a wildcard address (${boundHost}); browser write routes ${admitted}`,
  );
}

View on GitHub (pinned to aac7515d2a)

Solutions

Set the value to exactly one host, optionally with a scheme and a port: GITNEXUS_PUBLIC_ORIGIN=gitnexus.example.com or https://app.example.com:3000
For LAN write access, bind --host <specific-lan-address> instead of a wildcard
Unset the variable entirely if only loopback origins need write access

Example fix

# before
export GITNEXUS_PUBLIC_ORIGIN='https://a.example.com, https://b.example.com'   # ignored, admits nothing

# after
export GITNEXUS_PUBLIC_ORIGIN='https://a.example.com'   # single origin admitted

Defensive patterns

Strategy: validation

Validate before calling

const raw = process.env.GITNEXUS_PUBLIC_ORIGIN?.trim();
const matcher = raw ? createPublicOriginMatcher(raw) : undefined;
if (raw && !matcher) {
  // the value will be ignored and write routes stay loopback-only
  throw new Error('GITNEXUS_PUBLIC_ORIGIN must be exactly one host [+scheme +port]');
}

Prevention

One origin per env var — no wildcards, no comma lists
Validate the value with URL parsing in deploy scripts before starting serve
If browser write CORS fails from your LAN host, check for this startup warning first

When it happens

Trigger: Starting gitnexus serve with GITNEXUS_PUBLIC_ORIGIN set to two origins, a wildcard like '*', or unparseable text: the browser-write CORS policy silently stays loopback-only despite the env var being set, and the warning is emitted at startup.

Common situations: Trying to allowlist several frontends with one env var; assuming glob or regex syntax; stray quotes or whitespace in the value; browser writes from the LAN then failing CORS even though the operator believes the origin was configured.

Related errors

AI-assisted analysis of abhigyanpatwari/GitNexus@aac7515d2a (2026-08-20). Data as JSON: /api/errors/c5eece1c0ec22a7b. Report an issue: GitHub.