config: env-driven CORS, ports, log level, timezone

The CORS allowed-origins list, host port mappings, log level, container
timezone, and worker concurrency are now all driven by environment
variables with sane defaults. Same-origin access through the nginx
proxy keeps working with no config; direct cross-origin backend
access can be locked down via ALLOWED_ORIGINS.

- backend/config: ALLOWED_ORIGINS env (comma-separated, "*" for any)
  exposed via settings.cors_origins. LOG_LEVEL too.
- backend/main: build the CORS middleware from settings.cors_origins,
  auto-disable allow_credentials when origins is wildcard (CORS spec
  forbids credentials + "*").
- docker-compose: parameterize FRONTEND_PORT, BACKEND_PORT, REDIS_PORT,
  CELERYD_CONCURRENCY, LOG_LEVEL, and TZ via ${VAR:-default} so each
  has a working fallback if the .env entry is missing.
- .env.example: new template documenting every knob with examples.
- .env: pruned to only the values that diverge from .env.example;
  removed dead VITE_API_URL.
- README: configuration knobs table + "accessing from another machine"
  section explaining the same-origin proxy story.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/config.py

@@ -70,7 +70,29 @@ class Settings(BaseSettings):
     # API settings
     api_host: str = Field(default="0.0.0.0", env="API_HOST")
     api_port: int = Field(default=8000, env="API_PORT")
-    
+
+    # CORS — comma-separated list of allowed origins, or "*" for any.
+    # Same-origin requests (the normal case behind nginx / vite proxy)
+    # never trip CORS, so this is only for direct browser access from
+    # other origins (LAN IP, reverse proxy, dev tools).
+    allowed_origins: str = Field(default="*", env="ALLOWED_ORIGINS")
+
+    # Logging — accepts standard python levels (DEBUG, INFO, WARNING,
+    # ERROR, CRITICAL). Bumped from INFO when chasing a problem.
+    log_level: str = Field(default="INFO", env="LOG_LEVEL")
+
+    @property
+    def cors_origins(self) -> list[str]:
+        """Parse the ALLOWED_ORIGINS env var into a list. Accepts:
+          - "*" → wildcard (single-element list ["*"])
+          - "http://a.com,http://b.com" → split + strip
+        Empty entries are dropped.
+        """
+        raw = (self.allowed_origins or "").strip()
+        if not raw or raw == "*":
+            return ["*"]
+        return [o.strip() for o in raw.split(",") if o.strip()]
+
     # App configuration from YAML
     _config: Optional[MulitaConfig] = None
     

backend/app/main.py

@@ -64,14 +64,18 @@ app = FastAPI(
 
 # Configure CORS. The frontend normally talks to the backend through the
 # nginx (prod) or vite (dev) proxy, so requests are same-origin and never
-# trip CORS. The wildcard here is a fallback for the rare case where a
-# user / script hits the backend directly from a browser at some other
-# origin (LAN IP, reverse proxy under a different host, etc.). This is a
-# single-user homelab tool, so a permissive CORS policy is fine.
+# trip CORS. ALLOWED_ORIGINS in .env controls the fallback for direct
+# browser access from other origins (LAN IP, reverse proxy under a
+# different host). Defaults to "*" since this is a single-user homelab
+# tool; lock it down by setting e.g. ALLOWED_ORIGINS=https://photos.your.tld
+# in production deployments.
+_origins = settings.cors_origins
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
-    allow_credentials=False,
+    allow_origins=_origins,
+    # Wildcard origins can't be combined with credentials per the CORS
+    # spec, so credentials get auto-disabled in that case.
+    allow_credentials=_origins != ["*"],
     allow_methods=["*"],
     allow_headers=["*"],
 )