AB#4106 Fix: serve Refinery Studio over HTTPS in Docker - #4
Merged
Conversation
- Map the published port to the container's TLS port (5011:443); the studio image now serves HTTPS when the mounted localhost_cert.pem is present. - Set OCTO_IDENTITY__RefineryStudioUrl=https://localhost:5011 so the identity service seeds the refinery-studio client's redirect URI and AllowedCorsOrigins with the studio's actual HTTPS origin, allowing the cross-origin /octosystem/_configuration fetch and OIDC login to succeed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Updates the local octo-mesh Docker Compose setup so the Refinery Studio container is served over HTTPS and the identity service can seed the correct Studio URL for OIDC redirect/CORS configuration.
Changes:
- Add
OCTO_IDENTITY__RefineryStudioUrl=https://localhost:5011to the identity service environment. - Switch the Refinery Studio port mapping from
5011:80to5011:443to align with HTTPS serving behavior.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
reikla
approved these changes
Jun 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AB#4106 — Refinery Studio does not work inside Docker
Two coordinated fixes so the dockerized Refinery Studio loads its configuration and authenticates.
Changes (
scripts/octo-mesh/docker-compose.yml)5011:80→5011:443— the studio image serves HTTPS once the mountedlocalhost_cert.pemis detected.+ OCTO_IDENTITY__RefineryStudioUrl=https://localhost:5011— the identity service seeds theocto-data-refinery-studioclient'sRedirectUrisandAllowedCorsOriginsfrom this value on startup. This is what lets the browser's cross-originGET https://localhost:5005/octosystem/_configurationsucceed (the admin panel's CORS allow-list is built from clients'AllowedCorsOrigins) and makes the OIDC redirect URI match.ADMIN_PANEL_URIalready correctly points at the admin panel (:5005), which serves the config JSON.Dependency
The HTTPS behaviour comes from the studio image built by the companion PR: meshmakers/octo-frontend-refinery-studio#22. A new official
octo-mesh-refinery-studioimage (built from that branch) is required before this compose serves HTTPS locally — the current published image is HTTP-only.🤖 Generated with Claude Code