-
Notifications
You must be signed in to change notification settings - Fork 15
Public Web Address
FreeITSM sends links to people who are not looking at FreeITSM: a confirmation email to a requester, a work item pushed into Jira, a webhook posted into Slack. Those links have to carry the site's full address, and this page is about the one setting that supplies it.
Set at Tickets β Settings β Email Templates, at the top of the screen.
Every link inside FreeITSM is a path β /tickets/?id=409 β and that is correct, because the browser already knows which site it is on. A link sent somewhere else has no such luck: the reader's mail client resolves it against nothing at all, or against their own webmail host, and it fails.
The obvious answer is to read the site's address off the current request. It works, right up until the moment it matters:
Most automatic email is sent when nobody is using FreeITSM. The mail collector runs on a schedule, notices a new message, opens a ticket and sends the acknowledgement β all with no browser involved. There is no request to read an address from, so a link built that way comes out with no site name in it.
That is why the configured address comes first and is not merely a fallback. Unattended is the normal case for outbound mail, not the exception.
The whole address people use to reach FreeITSM, including the folder if it is in one:
| Your installation | What to enter |
|---|---|
https://itsm.example.com/ |
https://itsm.example.com |
https://example.com/freeitsm/ |
https://example.com/freeitsm |
| Reached over plain HTTP |
http://β¦ β type the scheme and it is kept |
A bare itsm.example.com is accepted and assumed to be https://. A trailing slash, and anything after the host such as ?id=4 pasted from your address bar, is trimmed.
The folder is the part people leave off, and it is the part that breaks things: without it every link points at a page that does not exist on that host.
A merge code, usable anywhere the others are β in email templates and in canned responses:
Hi [requester_first_name],
Thanks β we've logged this as [ticket_reference] and someone will be in touch.
You can track it here: [ticket_url]
It resolves to the requester's own view of their ticket in the self-service portal. Somebody who is not signed in lands on the portal login page with the ticket remembered, so they arrive where they meant to.
It points at the portal rather than the analyst view on purpose: everything built from this data is addressed to the requester, and an analyst link would send them to a sign-in page they have no account for.
Nothing breaks while you are sitting there β a link built during a request picks the address up from the request, and looks perfectly correct. That is exactly what makes this worth warning about: the sample link an administrator sees while setting up is not the link that gets sent at three in the morning.
So the templates screen watches for the one combination that is genuinely wrong β a template that uses [ticket_url], on an installation where nothing has been configured β and says so:
Links in these emails will be broken.
[ticket_url]is used in 2 template(s), but no public web address is set.
The message can be dismissed, because it is not always a fault: an installation whose templates are only ever sent by an analyst pressing something, on a single host with no reverse proxy, gets a working link from the request every time. A warning that cannot be silenced when it does not apply is one people stop reading, and it takes the ones that matter with it. Setting the address clears it for everyone regardless of what was dismissed.
The warning does not appear if the screen could not load the setting β an administrator who has configured this correctly should never be told they have not, and a failed request looks identical to an empty one unless you are careful to tell them apart.
The same address builds the link FreeITSM puts into a Jira issue or Azure DevOps work item when a ticket is escalated. That link is the entire reason for putting one there β somebody has to be able to click back.
This is where a long-standing fault was fixed. Web chat has always had its own address setting for webhook URLs, which stores the origin only (https://example.com) because the webhook builder adds the folder itself. The tracker links assumed the opposite shape and appended their path directly, so an installation in a folder produced https://example.com/tickets/?id=409 β the folder missing, the link dead. Both shapes are now reconciled in one place: the folder is added when it is not already there, and never twice.
| Setting | Shape | Set at |
|---|---|---|
| Public web address | Whole root, folder included | Tickets β Settings β Email Templates |
| Messaging public base URL | Origin only | Tickets β Settings β Messaging |
The general one wins where both are set. If you only ever configured the messaging one, it is still used and the folder is added for you, so nothing needs re-entering.
| File | Role |
|---|---|
includes/public_url.php |
publicBaseUrl(), publicAbsoluteUrl(), publicBaseUrlSetting(). The one home β anything building an outbound link should call it |
includes/template_email.php |
buildTicketMergeData() β where [ticket_url] is produced |
includes/reply_templates.php |
The merge codes offered for canned responses |
includes/integrations/integrations.php |
integrationsAbsoluteUrl() β kept as a name, now delegates |
api/tickets/get_public_base_url.php |
Reads the setting, and separately reports whether anything is configured |
publicBaseUrlSetting() and publicBaseUrl() answer different questions and the difference is load-bearing: the second always returns something, which is what makes it safe to build a link with and useless for deciding whether to warn. Only the first can tell you nothing was configured.
includes/csat.php and includes/self_service_email.php still build their own addresses. They only ever run in request context, so they are not wrong today; folding them in is a separate job.
- Limiting replies to particular senders β the other half of discussion #80
- Email signatures β request 3 from the same discussion
- Email Send Log β every email FreeITSM tries to send, and what happened to it
- Issue Trackers β the Jira and Azure DevOps links this same address builds
-
Self-Service Portal β where
[ticket_url]sends people
FreeITSM β an open-source IT Service Management platform Β· github.com/edmozley/freeitsm Β· MIT licence
- Installation
- β° Scheduled tasks (cron jobs)
- Architecture
- AI Providers
- Internationalisation (i18n)
- Timezones & Time Handling
- Theming & Dark Mode
- β¨οΈ Command palette (βK)
- π Searching inside tickets
- π Attached documents
- MobileβFriendly
-
Security
- Layer 1 β which modules you can enter
- β³ π§© Module Access Control
- β³ π οΈ Module Access β Developer Guide
- Layer 2 β what you can administer
- β³ π Roles & Permissions
- β³ π οΈ Roles β Developer Guide
- β³ π€ Why capabilities are constants
- Layer 3 β the System module
- β³ π Admin Access Control
- Hardening
- β³ π Security review response 2026-08
- β³ π‘οΈ Security hardening 2026-08
- β³ π οΈ Security hardening 2026-08 β Developer Guide
- β³ π‘οΈ Round three β plain English
- β³ π οΈ Round three β Developer Guide
- Single Sign-On (SSO)
- ποΈ LDAP & Active Directory
- Browser Extension
- API Reference
-
π REST API β how it works
- β³ π« REST API: Tickets
- β³ π» REST API: Assets
- β³ π΄ REST API: Problems
- β³ π REST API: Changes
- β³ π REST API: Knowledge
- β³ β REST API: Tasks
- β³ ποΈ REST API: CMDB
- β³ π REST API: Contracts
- β³ ποΈ REST API: Calendar
- β³ πΏ REST API: Software
- β³ π¦ REST API: Service Status
- β³ βοΈ REST API: Morning Checks
- β³ π REST API: Forms
- β³ βοΈ REST API: Workflow
- β³ πΊοΈ REST API: Network Mapper
- β³ π§ Using the API docs page
- β³ π OpenAPI specification
- β³ β OpenAPI: kept correct
- β³ π οΈ Maintaining the catalogue
- Watchtower
-
Tickets
- β³ Mailbox Authentication
- β³ π€ Email send log
- β³ Basic IMAP mailboxes
- β³ Email rendering & images
- β³ SLA Management
- β³ WhatsApp channel
- β³ π¬ Web chat channel
- β³ π£ Slack channel
- β³ π Linking tickets
- β³ ποΈ Canned responses
- β³ βοΈ Limiting replies to particular senders
- β³ βοΈ Email signatures
- β³ π The public web address
- β³ π’ Ticket numbering
- β³ π Raising a ticket for someone else
- β³ π Merging tickets
- β³ β Splitting tickets
- β³ β Selecting several tickets
- β³ π οΈ Snoozing tickets β Developer Guide
- β³ π₯ Collision detection
- β³ β±οΈ Time tracking
- Problem Management
- Tasks
- Assets
- Knowledge
- Change Management
- Calendar
- Morning Checks
- Reporting
- Software
- Forms
- Contracts
- Service Status
- π Notifications
- π¨ War Room
- Self-Service Portal
- LMS
- Process Mapper
- CMDB
- Network Mapper
- Workflows
- Issue trackers (Jira, Azure DevOps)
- System
-
Overview
- β³ π Progress tracker
- β³ Concepts & vocabulary
- β³ Email routing & mailboxes
- β³ Settings: global vs per-company
- β³ Users & self-service
- β³ Staff cross-company access
- β³ Worked examples
- β³ Pitfalls & gotchas
- β³ Scope: what it's for
- β³ π οΈ Developer Guide (make a module multi-company)
- β³ ποΈ Case study: CMDB (a linked graph)
- β³ π§ͺ Test harness (prove it's isolated)