Host Validation Failed Even With Correct URL In HOMEPAGE_ALLOWED_HOSTS

[rajivvishwa]

Description

I'm getting this error when I'm trying to access homepage via the URL configured in ngnix proxy manager.

[2025-05-19T04:40:46.175Z] error: Host validation failed for: start.astra.home. Hint: Set the HOMEPAGE_ALLOWED_HOSTS environment variable to allow requests from this host / port.

I already have this url in the compose and I have restarted the container many times.

HOMEPAGE_ALLOWED_HOSTS: astra.infv:4100, start.astra.home, start.astra.home:443 # required, may need port. See gethomepage.dev/installation/#homepage_allowed_hosts

homepage version

v1.2.0 (2376184, Apr 28, 2025)

Installation method

Docker

Configuration

No response

Container Logs

No response

Browser Logs

No response

Troubleshooting

Already checked many posts related to this topic in github but this one seems different.

[shamoon]

Already checked many posts related to this topic in github but this one seems different.

Probably not :)

Please review the docs again, your setting as pasted here is invalid https://gethomepage.dev/installation/#homepage_allowed_hosts

Also, restarting a container is not sufficient when changing environment variables, you must re-create it

[rajivvishwa]

What exactly makes it invalid? When I mentioned "restart," I meant that I recreated the container and started it again. I missed to indicate that, my bad.

In any case, I switched the hosts, and it's working now.

HOMEPAGE_ALLOWED_HOSTS: start.astra.home, astra.infv:4100

If you were referring to the use of = instead of :, you're right—Docker Compose doesn't support HOMEPAGE_ALLOWED_HOSTS= syntax. Also, I couldn't find a clear way to define a wildcard for this setting, as HOMEPAGE_ALLOWED_HOSTS: * doesn’t work either. Someone else pointed this out in [discussion #4991](#4991 (comment)).

That said, my issue is resolved for now.
TL;DR for others: If you run into a similar problem, try switching the host values—this workaround might help.

Here is my full docker-compose.yml for reference

services:
  homepage:
    image: ghcr.io/gethomepage/homepage:latest
    restart: unless-stopped
    container_name: homepage
    ports:
      - 4100:3000
    volumes:
      - /home/rajivvishwa/docker/docker_files/homepage/config:/app/config # Make sure your local config directory exists
      - /var/run/docker.sock:/var/run/docker.sock # (optional) For docker integrations
    environment:
      HOMEPAGE_ALLOWED_HOSTS: start.astra.home, astra.infv:4100 # first one is reverse proxied via nginxproxymanager
    networks:
      - default_astra
networks:
  default_astra:
    external: true

[shamoon]

Gotta read more carefully friend, here are the instructions directly from the docs, again:

The value is a comma-separated (no spaces) list of allowed hosts (sometimes with the port) that can host your homepage install. See the docker, kubernetes and source installation pages for more information about where / how to set the variable.

localhost:3000 and 127.0.0.1:3000 are always included, but you can add a domain or IP address to this list to allow that host such as HOMEPAGE_ALLOWED_HOSTS=gethomepage.dev,192.168.1.2:1234, etc.

If you are seeing errors about host validation, check the homepage logs and ensure that the host exactly as output in the logs is in the HOMEPAGE_ALLOWED_HOSTS list.

This can be disabled by setting HOMEPAGE_ALLOWED_HOSTS to * but this is not recommended.

[rajivvishwa]

Are you referring to this comma-separated (no spaces) list? If yes, I have a space currently after the comma and as I mentioned earlier, I'm able to access from homepage from the domain which was previously not accessible even with the comma, so it doesnt make any difference it looks like. I can remove it just to be sure.

If you are not referring to that, I dont have any clue what you are talking about.

I'm still unclear on the how to do wildcard allow in docker compose, but I'm not worried about that since explicit domain reference works atm.

[buffaloexpatbill]

It's not controlling what you can access homepage from, it is what host is authorized to serve homepage.

[github-actions[bot]]

This discussion has been automatically closed due to inactivity. See our contributing guidelines for more details.

[github-actions[bot]]

This discussion has been automatically locked since there has not been any recent activity after it was closed. Please open a new discussion for related concerns. See our contributing guidelines for more details.