fix: config error.

Author: PttCodingMan

.env.example

@@ -40,9 +40,14 @@ AI_RATE_LIMIT_PER_HOUR=20
 
 # ── OIDC / OAuth SSO (optional) ──
 # Public URL the browser can reach — used to build OIDC redirect_uri.
-# Dev with Vite proxy: http://localhost:5173   Docker: http://localhost:3000
-# (compose overrides this automatically)            Prod: https://wiki.example.com
+#   Non-docker dev (Vite proxy): set PUBLIC_BASE_URL=http://localhost:5173
+#   Plain `make dev-backend`:    leave as http://localhost:8000
+#   Docker:                      ignore this — compose hardcodes
+#                                http://localhost:3000. Override the docker
+#                                value with PUBLIC_BASE_URL_DOCKER below.
+#   Prod behind your domain:     set PUBLIC_BASE_URL_DOCKER=https://wiki.example.com
 PUBLIC_BASE_URL=http://localhost:8000
+# PUBLIC_BASE_URL_DOCKER=https://wiki.example.com
 
 OIDC_ENABLED=false
 # Comma-separated. Only providers listed here AND with a client_id+secret below are offered.

backend/Dockerfile

@@ -18,5 +18,5 @@ COPY VERSION /app/VERSION
 
 EXPOSE 8000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
-  CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8000/api/health',timeout=3).status==200 else 1)" || exit 1
+  CMD python -c "__import__('urllib.request',fromlist=['request']).urlopen('http://localhost:8000/api/health',timeout=3).read()" || exit 1
 CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

docker-compose.yml

@@ -13,14 +13,28 @@ services:
     # mounted /app/data volume and treats the frontend nginx (port 3000) as
     # the public ingress — OIDC redirect_uri must round-trip through nginx.
     # TRUST_PROXY=true because nginx is the only reachable peer.
+    #
+    # PUBLIC_BASE_URL: hardcode the docker-correct value rather than
+    # `${PUBLIC_BASE_URL:-...}`, because the shipped .env.example sets the
+    # dev value (localhost:8000) and `:-default` only fires when unset, not
+    # when set-to-something. To override for prod, set PUBLIC_BASE_URL_DOCKER
+    # in your .env (e.g., https://wiki.example.com).
     environment:
       DATA_DIR: /app/data
       DB_PATH: /app/data/just-wiki.db
       MEDIA_DIR: /app/data/media
-      PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:3000}
+      PUBLIC_BASE_URL: ${PUBLIC_BASE_URL_DOCKER:-http://localhost:3000}
       TRUST_PROXY: "true"
+    # Block-style list: docker-compose's flow-sequence parser whitespace-
+    # splits long quoted strings into separate argv tokens. Each arg on its
+    # own line dodges that. The Python expression must stay single-statement
+    # for the same reason — `;` would be split too if it ever reverts.
     healthcheck:
-      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8000/api/health',timeout=3).status==200 else 1)"]
+      test:
+        - CMD
+        - python
+        - -c
+        - "__import__('urllib.request',fromlist=['request']).urlopen('http://localhost:8000/api/health',timeout=3).read()"
       interval: 30s
       timeout: 5s
       start_period: 15s