Doc and deployment improvements (#402)

* Added env variables page with all possible environment variables for GeoPulse.

* Simplified installation guide

* Added images and refactored README

* Updated readme

* Updated readme

* Updated readme

* Fixed CSRF issue

* Build dev images for ARM64 as well

* Build dev images for ARM64 as well

* Build dev images in compat mode

Author: tess1o

.env.example

@@ -6,12 +6,23 @@
 # The version of the app, frontend and backend should use the same version
 GEOPULSE_VERSION=1.22.0
 
-# Frontend (UI) URLs - used in CORS policies (comma-separated for multiple access methods)
-# Local development: http://localhost:5555
-# Homelab example: http://localhost:5555,http://192.168.1.100:5555,http://your-tailscale-ip:5555
-# Production example: https://geopulse.yourdomain.com
+# Frontend (UI) URL (legacy)
+# DEPRECATED: kept for backward compatibility with older deployments.
+# New deployments should use GEOPULSE_CORS_ORIGINS and GEOPULSE_PUBLIC_BASE_URL.
 GEOPULSE_UI_URL=http://localhost:5555
 
+# CORS configuration
+# Standard docker-compose deployment uses nginx reverse proxy and same-origin requests,
+# so CORS can be disabled by default.
+GEOPULSE_CORS_ENABLED=false
+# When CORS is enabled, set allowed origins as comma-separated URLs.
+# Example: http://localhost:5555,http://192.168.1.100:5555,https://geopulse.yourdomain.com
+GEOPULSE_CORS_ORIGINS=
+
+# Public base URL for callback/link generation (optional, recommended for OIDC)
+# Example: https://geopulse.yourdomain.com
+GEOPULSE_PUBLIC_BASE_URL=
+
 # Cookie domain for authentication cookies
 #
 # IMPORTANT: GeoPulse uses nginx to proxy all requests (frontend + backend), so the browser
@@ -80,9 +91,11 @@ GEOPULSE_MQTT_PASSWORD=change-this-mqtt-admin-password
 GEOPULSE_OIDC_ENABLED=false
 
 # OIDC Callback URL Override (optional)
-# By default, uses the first URL from GEOPULSE_UI_URL.
-# Set this explicitly when GEOPULSE_UI_URL contains multiple comma-separated URLs for CORS,
-# or when you need a different callback URL than the UI URL.
+# Callback URL resolution order:
+# 1. GEOPULSE_OIDC_CALLBACK_BASE_URL (this value)
+# 2. GEOPULSE_PUBLIC_BASE_URL
+# 3. GEOPULSE_UI_URL (legacy fallback)
+# Set this explicitly when your callback base URL must differ from your public UI URL.
 # Example: GEOPULSE_OIDC_CALLBACK_BASE_URL=https://geopulse.mydomain.com
 GEOPULSE_OIDC_CALLBACK_BASE_URL=
 

.github/workflows/dev-build.yml

@@ -12,17 +12,13 @@ permissions:
   contents: read
 
 jobs:
-  build-frontend:
-    name: Build Frontend Multi-Arch (dev)
   build-frontend-amd64:
     name: Build Frontend AMD64 (dev)
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -62,27 +58,20 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Build and push Frontend Multi-Arch (dev)
       - name: Build and push Frontend ARM64 (dev)
         uses: docker/build-push-action@v5
         with:
           context: .
           file: frontend/Dockerfile
-          platforms: linux/amd64,linux/arm64
           platforms: linux/arm64
           push: true
           build-args: |
             VERSION=${{ env.DEV_VERSION }}
           tags: |
-            ${{ env.DOCKERHUB_FRONTEND_IMAGE }}:${{ env.DEV_VERSION }}
-          cache-from: type=gha,scope=dev-frontend-multiarch
-          cache-to: type=gha,mode=max,scope=dev-frontend-multiarch
             ${{ env.DOCKERHUB_FRONTEND_IMAGE }}:${{ env.DEV_VERSION }}-arm64
           cache-from: type=gha,scope=dev-frontend-arm64
           cache-to: type=gha,mode=max,scope=dev-frontend-arm64
 
-  build-backend-native:
-    name: Build Backend Native Multi-Arch (dev)
   create-frontend-manifest:
     name: Create Frontend Multi-Arch Manifest (dev)
     needs: [build-frontend-amd64, build-frontend-arm64]
@@ -102,15 +91,12 @@ jobs:
             ${{ env.DOCKERHUB_FRONTEND_IMAGE }}:${{ env.DEV_VERSION }}-arm64
 
   build-backend-native-amd64:
-    name: Build Backend Native AMD64 (dev)
+    name: Build Backend Native AMD64 Compatible (dev)
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -120,28 +106,23 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Build and push Backend Native Multi-Arch (dev)
-      - name: Build and push Backend Native AMD64 (dev)
+      - name: Build and push Backend Native AMD64 Compatible (dev)
         uses: docker/build-push-action@v5
         with:
           context: .
           file: backend/Dockerfile.native
-          platforms: linux/amd64,linux/arm64
           platforms: linux/amd64
           push: true
           build-args: |
             VERSION=${{ env.DEV_VERSION }}-native
-            QUARKUS_NATIVE_BUILD_ARGS=
+            QUARKUS_NATIVE_BUILD_ARGS=,-march=x86-64-v2
           tags: |
-            ${{ env.DOCKERHUB_BACKEND_IMAGE }}:${{ env.DEV_VERSION }}-native
-          cache-from: type=gha,scope=dev-backend-native-multiarch
-          cache-to: type=gha,mode=max,scope=dev-backend-native-multiarch
             ${{ env.DOCKERHUB_BACKEND_IMAGE }}:${{ env.DEV_VERSION }}-native-amd64
-          cache-from: type=gha,scope=dev-backend-native-amd64
-          cache-to: type=gha,mode=max,scope=dev-backend-native-amd64
+          cache-from: type=gha,scope=dev-backend-native-amd64-compat
+          cache-to: type=gha,mode=max,scope=dev-backend-native-amd64-compat
 
   build-backend-native-arm64:
-    name: Build Backend Native ARM64 (dev)
+    name: Build Backend Native ARM64 Compatible (dev)
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout code
@@ -156,7 +137,7 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Build and push Backend Native ARM64 (dev)
+      - name: Build and push Backend Native ARM64 Compatible (dev)
         uses: docker/build-push-action@v5
         with:
           context: .
@@ -165,11 +146,11 @@ jobs:
           push: true
           build-args: |
             VERSION=${{ env.DEV_VERSION }}-native
-            QUARKUS_NATIVE_BUILD_ARGS=
+            QUARKUS_NATIVE_BUILD_ARGS=,-march=armv8-a+nolse
           tags: |
             ${{ env.DOCKERHUB_BACKEND_IMAGE }}:${{ env.DEV_VERSION }}-native-arm64
-          cache-from: type=gha,scope=dev-backend-native-arm64
-          cache-to: type=gha,mode=max,scope=dev-backend-native-arm64
+          cache-from: type=gha,scope=dev-backend-native-arm64-compat
+          cache-to: type=gha,mode=max,scope=dev-backend-native-arm64-compat
 
   create-backend-native-manifest:
     name: Create Backend Native Multi-Arch Manifest (dev)
@@ -188,4 +169,3 @@ jobs:
             -t ${{ env.DOCKERHUB_BACKEND_IMAGE }}:${{ env.DEV_VERSION }}-native \
             ${{ env.DOCKERHUB_BACKEND_IMAGE }}:${{ env.DEV_VERSION }}-native-amd64 \
             ${{ env.DOCKERHUB_BACKEND_IMAGE }}:${{ env.DEV_VERSION }}-native-arm64
-