Prepare deployment and Forgejo CI

settings.py

@@ -10,6 +10,7 @@ class Settings:
     app_base_url: str | None
     auth_secret_key: str | None
     auth_cookie_secure: bool
+    cors_allow_origins: tuple[str, ...]
     forgejo_base_url: str
     forgejo_token: str | None
     forgejo_oauth_client_id: str | None
@@ -35,6 +36,10 @@ def _normalize_base_url(raw_value: str | None) -> str:
 
 
 def _parse_calendar_feed_urls(raw_value: str | None) -> tuple[str, ...]:
+    return _parse_csv_values(raw_value)
+
+
+def _parse_csv_values(raw_value: str | None) -> tuple[str, ...]:
     value = (raw_value or "").strip()
     if not value:
         return ()
@@ -56,14 +61,25 @@ def _parse_bool(raw_value: str | None, *, default: bool = False) -> bool:
     return value in {"1", "true", "yes", "on"}
 
 
+def _cors_allow_origins(app_base_url: str | None, raw_value: str | None) -> tuple[str, ...]:
+    configured_origins = _parse_csv_values(raw_value)
+    if configured_origins:
+        return configured_origins
+    if app_base_url:
+        return (app_base_url,)
+    return ("*",)
+
+
 @lru_cache(maxsize=1)
 def get_settings() -> Settings:
+    app_base_url = (
+        _normalize_base_url(os.getenv("APP_BASE_URL")) if os.getenv("APP_BASE_URL") else None
+    )
     return Settings(
-        app_base_url=_normalize_base_url(os.getenv("APP_BASE_URL"))
-        if os.getenv("APP_BASE_URL")
-        else None,
+        app_base_url=app_base_url,
         auth_secret_key=os.getenv("AUTH_SECRET_KEY") or None,
         auth_cookie_secure=_parse_bool(os.getenv("AUTH_COOKIE_SECURE")),
+        cors_allow_origins=_cors_allow_origins(app_base_url, os.getenv("CORS_ALLOW_ORIGINS")),
         forgejo_base_url=_normalize_base_url(os.getenv("FORGEJO_BASE_URL")),
         forgejo_token=os.getenv("FORGEJO_TOKEN") or None,
         forgejo_oauth_client_id=os.getenv("FORGEJO_OAUTH_CLIENT_ID") or None,