From 08660426d7e7727ee14615cb3682fb904010c14d Mon Sep 17 00:00:00 2001
From: alexz <me@alexzaw.dev>
Date: Fri, 21 Aug 2026 10:11:24 -0700
Subject: [PATCH] mergedrop: pin CORS_ORIGINS to app origin (was wildcard)

---
 apps/mergedrop/config.json         | 4 ++--
 apps/mergedrop/docker-compose.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/apps/mergedrop/config.json b/apps/mergedrop/config.json
index 8f5b7cb..9351ec9 100644
--- a/apps/mergedrop/config.json
+++ b/apps/mergedrop/config.json
@@ -7,7 +7,7 @@
   "port": 8765,
   "id_name": "mergedrop",
   "description": "Self-hosted drag-and-drop video merger. Drop clips, reorder, and build a single MP4 with ffmpeg.",
-  "tipi_version": 4,
+  "tipi_version": 5,
   "version": "1.0.2",
   "dynamic_config": true,
   "supported_architectures": ["amd64"],
@@ -39,5 +39,5 @@
       "env_variable": "MERGEDROP_OUTPUT_MAX_AGE_HOURS"
     }
   ],
-  "updated_at": 1787293276649
+  "updated_at": 1787332264747
 }
diff --git a/apps/mergedrop/docker-compose.json b/apps/mergedrop/docker-compose.json
index 9833ddf..79b293f 100644
--- a/apps/mergedrop/docker-compose.json
+++ b/apps/mergedrop/docker-compose.json
@@ -16,7 +16,7 @@
         { "key": "MERGEDROP_MAX_FILES", "value": "${MERGEDROP_MAX_FILES}" },
         { "key": "MERGEDROP_MAX_FILE_SIZE", "value": "${MERGEDROP_MAX_FILE_SIZE}" },
         { "key": "MERGEDROP_OUTPUT_MAX_AGE_HOURS", "value": "${MERGEDROP_OUTPUT_MAX_AGE_HOURS}" },
-        { "key": "CORS_ORIGINS", "value": "*" },
+        { "key": "CORS_ORIGINS", "value": "${APP_PROTOCOL}://${APP_DOMAIN}" },
         { "key": "MONGO_URL", "value": "mongodb://mergedrop-db:27017" },
         { "key": "DB_NAME", "value": "mergedrop" }
       ],