Release v2.36.0 (#375)

* docs: improve autostart guide with user systemd service for full Electron UI (#345)

* Update autostart.md

Improve autostart documentation: add user systemd service for full Electron UI with logging and environment variables

* Update autostart.md

docs: address PR feedback — clarify display server and disable logging by default

* Update autostart.md

docs: verified the environment inherited by systemd --user, ensured DISPLAY=:0 and WAYLAND_DISPLAY=wayland-0 is set up automatically

* Update autostart.md

docs: updated Troubleshooting section

* clarify systemd service behavior + minor changes

- Add platform note: Clarify guide is for Raspberry Pi OS Desktop
- Fix typo: WAYLAND_DIAPLAY → WAYLAND_DISPLAY
- Fix misleading comment: System services start on boot, not after user login
- Remove trailing whitespace and newline

---------

Co-authored-by: Kristjan ESPERANTO <35647502+KristjanESPERANTO@users.noreply.github.com>

* style: set carbon ads background color to inherit (#350)

* location of default modules changed  (#353)

see MagicMirrorOrg/MagicMirror#4019

* move custom.css from css to config (#354)

* update variables in config

* add secrets.md

* fix typo

* add missing "

* node_modules/vitepress/types/default-theme.d.ts

* apply Prettier formatting

* handle cspell issues

* add weatherapi options to weather module configuration (#359)

* docs(compliments): clarify remoteFile path resolution and limitations (#360)

* docs: correct loaded() - server-side only, not a client-side hook (#361)

Document that loaded() belongs to node_helper, not Module.
Add async/Promise support to the start() docs as the correct
way to handle asynchronous module initialization.

* docs: clarify that public folder requires node_helper.js (#362)

* docs: explain physical concept and hardware scope on landing page (#365)

Add a short paragraph to index.md that explains what a MagicMirror
physically is, clarifies that this documentation covers the software
side only, and points newcomers to the community showcase for
hardware build inspiration.

Closes MagicMirrorOrg/MagicMirror#3282

* add weather templates (#366)

* weather: add themes example

* calendar: align showEnd and dateEndFormat defaults (#368)

* fix failing tests

* documentation for secrets and cors (#374)

---------

Co-authored-by: Github Actions <actions@github.com>
Co-authored-by: Станислав <52878917+vectorman115@users.noreply.github.com>
Co-authored-by: Kristjan ESPERANTO <35647502+KristjanESPERANTO@users.noreply.github.com>
Co-authored-by: veeck <gitkraken@veeck.de>
Co-authored-by: sam detweiler <sdetweil@gmail.com>
Co-authored-by: Andrés Vanegas Jiménez <142350+angeldeejay@users.noreply.github.com>

Author: 7 people

.vitepress/config.mts

@@ -78,6 +78,7 @@ export default defineConfig({
             link: "/configuration/autostart",
           },
           { text: "Raspberry Specific", link: "/configuration/raspberry" },
+          { text: "Cors Proxy", link: "/configuration/cors" },
         ],
       },
       {

configuration/cors.md

@@ -0,0 +1,61 @@
+# Cors Proxy
+
+MagicMirror² contains an internal cors proxy which is useful for some modules.
+
+Since MagicMirror² versions greater `v2.35.0` the cors proxy is disabled by
+default due to security reasons.
+
+## What is a cors proxy?
+
+There are some good articles online, e.g.
+[What are CORS proxies, and when are they safe?](https://httptoolkit.com/blog/cors-proxies/).
+
+## Why do we need a cors proxy for MagicMirror²?
+
+We ran into cors problems with some modules which make api requests to external
+websites from inside the browser.
+
+Examples are
+
+- some news url's when using the default newsfeed module
+- 3rd-party modules (e.g. weather api's)
+- ...
+
+To get such url's working we can use the internal cors proxy. Instead using the
+original url `https://example.com` in the module configuration we use
+`/cors?url=https://example.com`. With this the request doesn't go directly from
+the browser to the external url but to the MagicMirror² Server which makes the
+call to the external url and sends the answer back to the browser.
+
+## Setup cors proxy
+
+You have to enable the cors proxy in `config.js`.
+
+::: warning NOTE
+
+We offer no guarantee that the use of the cors proxy is safe in all setups. We
+investigated in security and protecting against misuse, but use at your own
+risk.
+
+:::
+
+You can us 2 setup variants.
+
+### Cors allow all
+
+This opens cors to all url's. You should only use this if your MagicMirror² is
+not reachable from outside your network:
+
+```js
+  cors: "allowAll",
+```
+
+### Cors allow whitelist
+
+This is the safest variant. You have to list all domains which are allowed to
+make cors requests:
+
+```js
+  cors: "allowWhitelist",
+  corsDomainWhitelist: ["example.com", "api.mapbox.com"],
+```

configuration/secrets.md

@@ -51,7 +51,7 @@ including all secrets, and send it somewhere else.
 
 ## Using secrets in server-side modules
 
-You have to add a new parameter in `config.js`:
+You have to add new parameters in `config.js`:
 
 ```js
 let config = {
@@ -126,6 +126,8 @@ Example:
 let config = {
   ...
   hideConfigSecrets: true,
+  cors: "allowWhitelist",
+  corsDomainWhitelist: ["api.mapbox.com"],
   ...
   modules: [
     {
@@ -152,3 +154,15 @@ acts as a proxy here:
 `mapUrl: "/cors?url=https://api.mapbox.com/styles/v1/${SECRET_MAPBOX_ID}/tiles/{z}/{x}/{y}?access_token=${SECRET_MAPBOX_TOKEN}"`
 
 Behind the scenes the server substitutes the variables before fetching the data.
+
+::: warning NOTE
+
+You must whitelist every domain you use as cors url. Therefore, in the example
+above, we need to set
+
+```js
+  cors: "allowWhitelist",
+  corsDomainWhitelist: ["api.mapbox.com"],
+```
+
+:::