# Using MineGeo on a Mac or another LAN server

MineGeo validates browser requests against the hostname and port used to reach
the server. The internal Next.js listening address can differ from that address.
Supabase's email redirect settings do not configure MineGeo's origin validation.

In the server's `.env.local`, set the public URL to the address you actually use.
For example, if the Mac is `192.168.1.50` and MineGeo runs on port `3000`:

```dotenv
MINEGEO_URL=http://192.168.1.50:3000
# Needed only if other devices access the Mac over the LAN:
MINEGEO_HOST=0.0.0.0
```

Use your own IP address and port, then restart MineGeo. `MINEGEO_URL` also controls
the browser pairing link generated for the capture tools.

In Supabase **Authentication → URL Configuration**, use the same base address for
the Site URL and add `http://192.168.1.50:3000/auth/callback` to Redirect URLs.
MineGeo sends the current browser origin plus `/auth/callback` when requesting an
email sign-in link. After changing redirect settings, request a fresh link.
See [Supabase's redirect URL documentation](https://supabase.com/docs/guides/auth/redirect-urls).

For a reverse proxy whose public scheme or hostname differs from the backend,
set `MINEGEO_URL` to the public HTTPS URL. Additional exact origins can be listed
in `MINEGEO_ALLOWED_ORIGINS`, separated by commas. Arbitrary forwarded-host headers
do not authorize additional origins.

For a testing server reached through changing IP addresses, ports, or domains,
add this to its `.env.local` and restart MineGeo:

```dotenv
MINEGEO_ALLOW_ANY_ORIGIN=true
```

This bypasses MineGeo's browser origin checks, including their CSRF protection.
The default is `false`; only the exact value `true` enables the bypass.
Authentication, permissions, and JSON request requirements still apply. This
setting controls MineGeo's API checks; Supabase email sign-in still needs allowed
redirect URLs, and `MINEGEO_URL` still controls capture-tool pairing links.