docs(self-hosting): document docker webapp URL mismatch troubleshooting

[jeevan6996]

Summary

• clarify that custom-domain self-hosted Docker setups must use matching build-time values for NEXT_PUBLIC_WEBAPP_URL
• add explicit troubleshooting guidance for WEBAPP_URL/ALLOWED_HOSTNAMES mismatch and OAuth redirect loops
• document expected ALLOWED_HOSTNAMES format and a quick BUILT_NEXT_PUBLIC_WEBAPP_URL verification command

Why

Issue #28712 reports OAuth loops caused by hostname mismatch even when runtime env vars look correct. The missing piece is usually image build-time values, not runtime-only config.

Fixes #28712

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/self-hosting/docker.mdx">

<violation number="1" location="docs/self-hosting/docker.mdx:153">
P2: New troubleshooting guidance conflicts with existing `NEXTAUTH_URL` guidance in the same doc, creating ambiguous OAuth/auth-loop configuration.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[cubic-dev-ai]

P2: New troubleshooting guidance conflicts with existing NEXTAUTH_URL guidance in the same doc, creating ambiguous OAuth/auth-loop configuration.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/self-hosting/docker.mdx, line 153:

<comment>New troubleshooting guidance conflicts with existing `NEXTAUTH_URL` guidance in the same doc, creating ambiguous OAuth/auth-loop configuration.</comment>

<file context>
@@ -140,3 +144,19 @@ docker-calcom-1  | @calcom/web:start:   url: 'http://testing.localhost:3000/api/
+If OAuth loops and logs show messages like `Match of WEBAPP_URL with ALLOWED_HOSTNAMES failed`, verify all of the following:
+
+1. `ALLOWED_HOSTNAMES` is comma-separated without JSON or extra quotes (for example, `ALLOWED_HOSTNAMES=cal.example.com,www.cal.example.com`).
+2. `NEXT_PUBLIC_WEBAPP_URL` and `NEXTAUTH_URL` are set to your public domain.
+3. Your image was built with the same public domain values.
+
</file context>

[jeevan6996]

Thanks! This docs PR is ready for full CI. Could a maintainer please add the run-ci label (external contributor trust gate) so all checks can run? I will address any feedback quickly.