fix(installer,docs): actually honor SPANNORA_ALLOWED_ORIGINS

The installer documented `SPANNORA_ALLOWED_ORIGINS` as a supported env
var but never read it — the systemd unit hard-codes its own
`Environment=` lines, so re-running `install.sh` with the var set did
nothing. Now we write `/etc/systemd/system/spannora.service.d/origins.conf`
when the var is set and remove it when unset, so the env var is the
single source of truth across re-runs.

Docs: drop the broken `VAR=... systemctl restart spannora` recipe
(env in front of systemctl never reaches the unit) and the
`VAR=... curl ... | bash` recipe (env stays in curl's process, never
reaches bash). Add a `Passing env vars correctly` subsection covering
the two shapes that actually work.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: gididaf

install.sh

@@ -7,11 +7,14 @@
 #   curl -fsSL https://spannora.dev/install.sh | sudo bash
 #
 # Environment overrides:
-#   SPANNORA_DOMAIN      Use this hostname instead of <public-ip>.sslip.io
-#   SPANNORA_NO_PROXY    Skip all reverse-proxy install/config
-#   SPANNORA_NO_HTTPS    On nginx hosts, skip the certbot/HTTPS step
-#   SPANNORA_ACME_EMAIL  Email used when registering with Let's Encrypt
-#                        (default: anonymous registration, no expiry notices)
+#   SPANNORA_DOMAIN           Use this hostname instead of <public-ip>.sslip.io
+#   SPANNORA_NO_PROXY         Skip all reverse-proxy install/config
+#   SPANNORA_NO_HTTPS         On nginx hosts, skip the certbot/HTTPS step
+#   SPANNORA_ACME_EMAIL       Email used when registering with Let's Encrypt
+#                             (default: anonymous registration, no expiry notices)
+#   SPANNORA_ALLOWED_ORIGINS  Comma-separated origins permitted to talk
+#                             cross-origin (needed for the hub PWA at
+#                             spannora.dev/app/). Re-run unset to clear.
 
 set -euo pipefail
 
@@ -277,6 +280,25 @@ ok "Dependencies installed"
 # --- systemd unit ---
 say "Installing systemd unit"
 install -m 644 "$INSTALL_DIR/deploy/spannora.service" "/etc/systemd/system/${SERVICE_NAME}.service"
+
+# Optional CORS allowlist via a drop-in. The drop-in lives outside the
+# main unit so future installer runs don't clobber it; the env var is
+# the source of truth — re-run with it unset to clear the allowlist.
+DROPIN_DIR="/etc/systemd/system/${SERVICE_NAME}.service.d"
+ORIGINS_DROPIN="${DROPIN_DIR}/origins.conf"
+if [[ -n "${SPANNORA_ALLOWED_ORIGINS:-}" ]]; then
+  say "Configuring CORS allowlist: ${SPANNORA_ALLOWED_ORIGINS}"
+  mkdir -p "$DROPIN_DIR"
+  cat > "$ORIGINS_DROPIN" <<EOF
+[Service]
+Environment=SPANNORA_ALLOWED_ORIGINS=${SPANNORA_ALLOWED_ORIGINS}
+EOF
+elif [[ -f "$ORIGINS_DROPIN" ]]; then
+  say "Clearing previous CORS allowlist drop-in"
+  rm -f "$ORIGINS_DROPIN"
+  rmdir "$DROPIN_DIR" 2>/dev/null || true
+fi
+
 systemctl daemon-reload
 systemctl enable "$SERVICE_NAME" >/dev/null 2>&1 || true
 systemctl restart "$SERVICE_NAME"

packages/site/src/pages/docs/hub.mdx

@@ -21,21 +21,34 @@ If you only have one spannora, the per-server PWA at `https://<your-vm>/` works
 
 ## Per-install setup (CORS opt-in)
 
-The hub talks to your spannora across origins, so each install you want to manage needs to allow the hub's origin. On the VM:
+The hub talks to your spannora across origins, so each install you want to manage needs to allow the hub's origin. The cleanest way is to re-run the installer with the var set — it'll write a systemd drop-in that survives future upgrades:
 
 ```bash
-SPANNORA_ALLOWED_ORIGINS=https://spannora.dev systemctl restart spannora
+curl -fsSL https://spannora.dev/install.sh | sudo SPANNORA_ALLOWED_ORIGINS=https://spannora.dev bash
 ```
 
-Or edit `/etc/systemd/system/spannora.service` to add:
+The variable must be on the **bash** at the tail of the pipe, not the `curl`. `SPANNORA_ALLOWED_ORIGINS=... curl ... | bash` does nothing — the var lives in curl's environment and never reaches bash. See [install docs](/docs/install/#passing-env-vars-correctly) for the full explanation.
 
-```
-Environment="SPANNORA_ALLOWED_ORIGINS=https://spannora.dev"
+To clear the allowlist later, re-run the installer with the variable **unset** — the drop-in is removed.
+
+If you'd rather skip the installer round-trip, write the drop-in directly on the VM:
+
+```bash
+sudo mkdir -p /etc/systemd/system/spannora.service.d
+sudo tee /etc/systemd/system/spannora.service.d/origins.conf >/dev/null <<'EOF'
+[Service]
+Environment=SPANNORA_ALLOWED_ORIGINS=https://spannora.dev
+EOF
+sudo systemctl daemon-reload && sudo systemctl restart spannora
 ```
 
-Then `systemctl daemon-reload && systemctl restart spannora`.
+Without this, the browser will refuse cross-origin requests and the hub will show a CORS error. Verify it took with:
+
+```bash
+curl -i -X OPTIONS https://<your-spannora-host>/api/auth/status -H 'Origin: https://spannora.dev'
+```
 
-Without this, the browser will refuse cross-origin requests and the hub will show a CORS error.
+A `204` with an `Access-Control-Allow-Origin: https://spannora.dev` header means you're good.
 
 ## Adding an instance to the hub
 

packages/site/src/pages/docs/install.mdx

@@ -41,23 +41,39 @@ Visit `https://<your-vm-ip>.sslip.io/setup`, paste the setup token, create your
 Point an A record at your VM, then run:
 
 ```bash
-SPANNORA_DOMAIN=chat.example.com curl -fsSL https://spannora.dev/install.sh | bash
+curl -fsSL https://spannora.dev/install.sh | sudo SPANNORA_DOMAIN=chat.example.com bash
 ```
 
 The installer will configure the proxy and request a certificate for that hostname instead of `sslip.io`.
 
 ## Other install options
 
-The installer respects a handful of environment variables. Set them before piping into bash:
+The installer respects a handful of environment variables:
 
 | Variable | Purpose |
 |---|---|
 | `SPANNORA_DOMAIN` | Custom hostname (otherwise auto-derived from public IP via sslip.io). |
-| `SPANNORA_PORT` | Local port to bind the Node process (default `7878`). |
 | `SPANNORA_NO_PROXY=1` | Skip reverse-proxy setup entirely. You handle TLS yourself. |
 | `SPANNORA_NO_HTTPS=1` | nginx path only — skip certbot. |
 | `SPANNORA_ACME_EMAIL` | Email registered with Let's Encrypt. |
-| `SPANNORA_ALLOWED_ORIGINS` | Comma-separated origins permitted to talk to this install (needed for cross-origin hub access). |
+| `SPANNORA_ALLOWED_ORIGINS` | Comma-separated origins permitted to talk to this install (needed for cross-origin [hub](/docs/hub/) access). Re-run unset to clear. |
+
+### Passing env vars correctly
+
+The variable must be set in the **bash** process at the end of the pipe, not the `curl` in front. Two shapes that work:
+
+```bash
+# inline on bash (one-shot)
+curl -fsSL https://spannora.dev/install.sh | sudo SPANNORA_ALLOWED_ORIGINS=https://spannora.dev bash
+
+# or export + sudo -E to preserve env
+export SPANNORA_ALLOWED_ORIGINS=https://spannora.dev
+curl -fsSL https://spannora.dev/install.sh | sudo -E bash
+```
+
+`SPANNORA_ALLOWED_ORIGINS=... curl ... | bash` does **not** work — the variable lives in curl's environment and never reaches bash. Same trap applies to all the variables above.
+
+The installer is idempotent: re-running with `SPANNORA_ALLOWED_ORIGINS` set writes a systemd drop-in at `/etc/systemd/system/spannora.service.d/origins.conf`; re-running with it unset removes that drop-in.
 
 ## Reverse-proxy detection