What's your idea?

Add an explicit, opt-in override that allows BookOrbit to accept OIDC/OAuth 2.0 issuer hosts that resolve to private or local IP addresses in self-hosted deployments. It took a bit of time to figure out why my OIDC endpoints were being rejected ;-).

Today, OIDC discovery uses a strict SSRF safety check that rejects issuers when the configured hostname resolves to any private or local address. That is a sensible production default, but it blocks common homelab and self-hosted patterns where BookOrbit, Authentik, and a reverse proxy such as Traefik run on the same host or the same private network behind split-horizon DNS.

The request is not to weaken the default behavior. The default should remain secure in production. Instead, there should be a clearly documented manual override for administrators who intentionally run their identity provider on a trusted private network.

A possible implementation could be:

• An environment variable such as ALLOW_LOCAL_OIDC_ISSUERS=false by default.
• Or an advanced admin setting in the UI, disabled by default.
• The override should apply only to OIDC/OAuth issuer validation and discovery, not disable SSRF protections globally.
• The UI and documentation should clearly warn that enabling this increases SSRF exposure and should only be used in trusted self-hosted environments.

What problem does it solve?

This solves a real issue for self-hosters and homelab users.

A common setup is:

• BookOrbit runs in Docker.
• IAM (e.g., Authentik, Authelia, Keycloak, etc.) runs on the same machine or private network.
• A reverse proxy such as Traefik terminates TLS.
• Internal DNS or split-horizon DNS resolves *.example.com to a private address such as 192.168.x.x.

In this setup, when NODE_ENV is set to production, BookOrbit currently rejects the OIDC issuer because the hostname resolves to a private IP, even when the administrator intentionally configured it that way and controls the whole environment.

That makes OIDC impossible or unnecessarily difficult for:

• Homelab users.
• Self-hosted private deployments.
• Users hosting the IdP and BookOrbit on the same machine.
• Users relying on internal wildcard DNS for all services.

The current behavior makes sense as a secure default for production and hosted environments, but without an override it is too strict for private self-hosted scenarios.

Anything else? (optional)

Example scenario

• auth.example.com is the Authentik issuer URL.
• Inside the BookOrbit container, DNS resolves auth.example.com to 192.168.2.20 because of split-horizon DNS.
• BookOrbit rejects the issuer with URL host is not allowed.

Why this should remain opt-in

Allowing private/local hosts by default in production would reduce SSRF protection, so the current default behavior should stay unchanged.

The feature request is specifically for a manual override that administrators must enable intentionally when they understand the trade-off.

Possible implementation direction

A minimal approach could be:

const allowLocal =
  this.appConfig.nodeEnv !== 'production' ||
  this.appConfig.allowLocalOidcIssuers;

Then use that only for OIDC issuer validation and discovery.

Alternatives considered

• Using public DNS plus hairpin NAT / NAT loopback.
• Avoiding split-horizon DNS entirely.
• Publishing every service differently for internal and external access.
• Updating the documentation, clearly describing the behaviour of the NODE_ENV environment variable.

Those workarounds are possible, but they add unnecessary complexity for homelab users and do not help people intentionally running BookOrbit and their IdP on the same private network.

Want to help?

I can help test and give feedback

Before submitting

• I've searched existing issues and this hasn't been requested yet.