HOMEPAGE_ALLOWED_HOSTS env parameter

[corasaniti]

Description

Please I don't understand what I have to insert in the environment parameter for docker run
HOMEPAGE_ALLOWED_HOSTS
If I want to allow all hosts to access my homepage?
Thanks in advance

homepage version

1.0

Installation method

Docker

Configuration

No response

Container Logs

No response

Browser Logs

No response

Troubleshooting

.

[shamoon]

Search, read the release notes, read the manual, look at the logs, etc.

[corasaniti]

@shamoon
The documentation is not clear I can't understand the value I have to use
https://gethomepage.dev/installation/docker/

Thanks again

[corasaniti]

@shamoon
I put my local Raspberry IP (192.168.2.185) I have mapped 3033 external porto to 3000 inside container
-e HOMEPAGE_ALLOWED_HOSTS=192.168.2.185
This is log

[2025-03-14T19:25:15.419Z] error: Host validation failed for: 192.168.2.185:3033. Hint: Set the HOMEPAGE_ALLOWED_HOSTS environment variable to allow requests from this host.
[2025-03-14T19:25:15.424Z] error: Host validation failed for: 192.168.2.185:3033. Hint: Set the HOMEPAGE_ALLOWED_HOSTS environment variable to allow requests from this host.
[2025-03-14T19:25:15.428Z] error: Host validation failed for: 192.168.2.185:3033. Hint: Set the HOMEPAGE_ALLOWED_HOSTS environment variable to allow requests from this host.
[2025-03-14T19:25:15.433Z] error: Host validation failed for: 192.168.2.185:3033. Hint: Set the HOMEPAGE_ALLOWED_HOSTS environment variable to allow requests from this host.
[2025-03-14T19:25:15.455Z] error: Host validation failed for: 192.168.2.185:3033. Hint: Set the HOMEPAGE_ALLOWED_HOSTS environment variable to allow requests from this host.

Thanks again

[shamoon]

HOMEPAGE_ALLOWED_HOSTS=192.168.2.185:3033

[buffaloexpatbill]

I just upgraded and got this working. It seems like the intent of the new environment variable can be ambiguous based on the name of the variable and the current documentation.

The variable appears to be for the host names or IPs that when in the address bar should be allowed to display your homepage.
In my case, I am only using within my LAN and haven't yet set up a subdomain.domain to have reverse proxied to the IP:port address.
So I just needed

HOMEPAGE_ALLOWED_HOSTS=192.168.1.141:3000

If/when I configure reverse proxy (which would definitely happen if i made it externally accessible), then I would need to add a comma and the subdomain.domain that I will use to reach homepage.

[Husky17]

I just got this working again too. I'm using docker-compose with portainer and a reverse proxy for internal use. Below is the relevant snip for what worked for me. The 10.1.1.10 is my docker machine and reverse proxy host and the 8071 is the external port for the container. So that 10.1.1.10:8071 is what I would use to load homepage without using the domain name. The home.skyenet.home didn't work by itself until I put the IP address and port. Also, another thing I had wrong was that I put a space after the comma. I deleted that and then it worked. All set again.

environment:
HOMEPAGE_ALLOWED_HOSTS: 10.1.1.10:8071,home.skyenet.home
ports:
'- 8071:3000

[corasaniti]

@shamoon
Thanks!!! But now from outside I can't reach my homepage in the Tailscale network?
Thanks

[shamoon]

What do the logs show when you try?

[corasaniti]

I see this in log container when I try access from my Tailscale network

[2025-03-14T20:03:19.519Z] error: Host validation failed for: X.X.X.X:3033. Hint: Set the HOMEPAGE_ALLOWED_HOSTS environment variable to allow requests from this host.
[2025-03-14T20:03:19.523Z] error: Host validation failed for: X.X.X.X:3033. Hint: Set the HOMEPAGE_ALLOWED_HOSTS environment variable to allow requests from this host.
[2025-03-14T20:03:19.527Z] error: Host validation failed for: X.X.X.X:3033. Hint: Set the HOMEPAGE_ALLOWED_HOSTS environment variable to allow requests from this host.
[2025-03-14T20:03:19.531Z] error: Host validation failed for: X.X.X.X:3033. Hint: Set the HOMEPAGE_ALLOWED_HOSTS environment variable to allow requests from this host.
[2025-03-14T20:03:19.597Z] error: Host validation failed for: X.X.X.X:3033. Hint: Set the HOMEPAGE_ALLOWED_HOSTS environment variable to allow requests from this host.

where X.X.X.X is my IP in Tailcale Network, so I have to add this IP/port (X.X.X.X:3033) in HOMEPAGE_ALLOWED_HOSTS env as shown below

HOMEPAGE ALLOWED_HOSTS=192.168.2.185:3000,X.X.X.X:3033

[corasaniti]

@shamoon
It worked, I am able to access my Homepage, from the local network and from my Tailscale network.
Thanks for the support

[rursache]

why is this needed now? not only it broke my install but now i have to make these changes. homepage worked just fine until now. it should have defaulted to "all" or something.

[Arrmm]

I would also like to know why and what the intent is for this new environment variable.

[sxg024]

Yeah I'm having similar problems. I don't understand the purpose of this new parameter. I have homepage on a raspberry pi which I move around and connect to different networks. I can't predict all IP and subnets that homepage is going to be accessed at to list them all.
I've read release notes and guide.
There has gotta be a way to disable this. I don't think everyone needs this security feature.
I reverted back to V0.10.9.

[gw17252009]

i reverted to v0.19.9 too. why "fix" something when its not broken. Until they give an "all" option i wont be using latest image tag.

[timelordx]

You can use HOMEPAGE_ALLOWED_HOSTS=* as described on the Installation page:

This can be disabled by setting HOMEPAGE_ALLOWED_HOSTS to * but this is not recommended.

Just make sure you're running at least v1.0.3. It took me a couple of failed attempts (and some pulled hair) before I realized I was still on v1.0.2, and the HOMEPAGE_ALLOWED_HOSTS=* feature was only introduced in v1.0.3.

[deiniolj]

Thanks for the fix advise, I don't understand why this all of a sudden appeared.. Broke my setup when I was away so could'nt access anything without logging into my Unraid first. This was the whole point of Homepage.. Might wonder off to an alternative..

[shamoon]

testdasi Please don’t be so obnoxious. We tried to make the release notes and the error message as clear as possible

[Arrmm]

release note is one thing but at least you can insert something in the main page to indicate something like "If you are to upgrade from x.y.z, please make sure you add "HOMEPAGE_ALLOWED_HOSTS: :<port if you are not using 3000>".

While I get that people should read the release notes, but most people (myself included), just want to enjoy running Homepage. And in my instance, I just have auto update using Watchtower. I only noticed it when it stopped working and that's when I had to research and found this thread.

[janek202]

I created a feature request: #4962

[ProxmoxG]

The API errors error: HTTP Error 401 calling while having environmental secrets it does not work with the new version, the documentation is not clear. It works on version v0.10.9 but with the new one it just fails.

[yusuf-madkour]

For those using reverse proxy, I had to add two entries separated by commas.

HOMEPAGE_ALLOWED_HOSTS: IP_WHERE_HOMEPAGE_IS_HOSTED:EXTERNAL_DOCKER_PORT,subdomain.domain.tld where subdomain.domain.tld is the same as the proxy host used on nginx proxy manager.

Using only one of those prevented me from reaching homepage.

[beboprocky]

Hi @shamoon the work on Homepage is greatly appreciated. For me there was a bit of confusion for using multiple host names. For example I actually will use homepage via an ip address, tailscale, and a .local address. I did not see documentation/logs for using multiple hostnames or to just disable the feature entirely. My use-case for example:

http://192.168.1.100:3000
http://mysynology.local:3000
http://mysynology:3000 (tailscale)

I tried separating with commas but that did not work.

HOMEPAGE_ALLOWED_HOSTS: 192.168.1.100:3000,mysynology:3000

Using the just the IP address created some issues with homepage in general. I'm sure there's a technical or security reason for this feature. I personally would rather allow any URL by being able to use "ALL" as the ENV variable. Thank you for the hard work on a free project that I, and many, use daily.

[timelordx]

You can use HOMEPAGE_ALLOWED_HOSTS=* as described on the Installation page:

This can be disabled by setting HOMEPAGE_ALLOWED_HOSTS to * but this is not recommended.

Just make sure you're running at least v1.0.3. It took me a couple of failed attempts (and some pulled hair) before I realized I was still on v1.0.2, and the HOMEPAGE_ALLOWED_HOSTS=* feature was only introduced in v1.0.3.

[micahp2]

Not to pile on here, but I have looked at the instructions and notes and I am also unable to get this to work after the update. I have tried structuring my compose file in both of the ways the documentation lists to no avail:

environment:
HOMEPAGE_ALLOWED_HOSTS: gethomepage.lan:80,192.168.1.2:80

AND

environment:
HOMEPAGE_ALLOWED_HOSTS=gethomepage.lan:80,192.168.1.2:80

Neither of these works in my environment. The only way to get things working for me is to use the not recommended method listed:

environment:
  - HOMEPAGE_ALLOWED_HOSTS=*

If anyone else finds a way to get this to work properly, please do share. If it is worth mentioning, I am trying to run homepage on port 80, just in case this wasn't obvious from my posting above.

[micahp2]

Never mind. This appears to be a series of fat finger errors on my part. Here's what I finally did to get everything working:

compose.yml:
services:
homepage:
image: ghcr.io/gethomepage/homepage:latest
container_name: homepage
restart: unless-stopped

ports:
  - 80:80

volumes:
  - ./:/app/config # Make sure your local config directory exists
  - ./images:/app/public/images # custom icons and images go here
  - /var/run/docker.sock:/var/run/docker.sock # (optional) For docker integrations

environment:
  - PORT=80
  - HOMEPAGE_ALLOWED_HOSTS=homepage.lan,homepage.mydomain.org,192.168.1.2

And the URLs I can now visit without errors in the logs are:
http://homepage.lan
https://homepage.mydomain.org
http://192.168.1.2

Sorry for all the confusion. I think I just couldn't find the right set of examples that initially worked for my setup. It is working now, thank goodness, so thank you for the help!

[timelordx]

If you have NPM in front of your Homepage, check (or post here) how you're proxying traffic to Homepage. If NPM rewrites the HOST header, you’ll need to include that in HOMEPAGE_ALLOWED_HOSTS.

In other words, what matters is what the Homepage app sees as the incoming HOST header. If the HOST header is modified along the way, the final value must be listed in HOMEPAGE_ALLOWED_HOSTS.

[timelordx]

@micahp2 , I’m glad you were able to fix the problem!

Just a sidenote - it’s better to post updates in new comments rather than editing your previous ones. Otherwise, it ends up looking like I’m having a stroke, replying to something that no longer exists. :)

[shamoon]

yes timelordx is accurate about the above, that’s why the hint in the logs is designed to show you what homepage is seeing. There are many different possible setups (eg reverse proxy that alters the host header etc)

glad you got it working 👍

[micahp2]

Sorry about that with the editing. I didn't want to leave wrong information sitting out there since I also go spelunking in these comments looking for solutions and hate finding stuff that doesn't work. I'll do better next time.

@shamoon, thank you as well for the help. It definitely wasn't clear to me what was happening initially, even with those hint error messages. It is much better now that I know what homepage is looking for.

[shamoon]

Im going to lock this thread because the original question is answered and it doesn't seem productive any more what with the griping and threatening to... not use the software?

While some seem insistent that we have just done this to annoy people, the reason it was introduced was indeed security, including DNS rebinding attacks.

Let's also remember this is homepage, a self-hosted dashboard. This update has literally done nothing that cant be changed back by changing the docker compose tag, no one's data has been altered or anything 'permanent', so the vitriol is completely unwarranted.

If there are users who need assistance setting this up, we will be glad to help and you can open your own discussion. Thanks to those of you who kept it civil, no thanks to the others.