fix: let self-hosted web builds bake their own public URL

The web Dockerfile hardcodes NEXT_PUBLIC_WEB_URL=http://localhost:3000. Next
inlines NEXT_PUBLIC_* into the client bundle, so that value reaches the
browser no matter what WEB_URL or CAP_URL says at runtime: share links,
embeds, oEmbed and the CORS allowlist all use localhost on a self-hosted
build. Back the ENV with an ARG of the same default so a build can pass
--build-arg NEXT_PUBLIC_WEB_URL=... without changing the published image.

Author: fancyHeat

apps/web/Dockerfile

@@ -12,7 +12,8 @@ COPY . .
 RUN --mount=type=cache,id=bun-1.4.0,target=/root/.bun/install/cache bun install --frozen-lockfile
 
 ARG NEXT_PUBLIC_DOCKER_BUILD=true
-ENV NEXT_PUBLIC_WEB_URL=http://localhost:3000
+ARG NEXT_PUBLIC_WEB_URL=http://localhost:3000
+ENV NEXT_PUBLIC_WEB_URL=$NEXT_PUBLIC_WEB_URL
 
 RUN bun run build:web
 

apps/web/content/docs/self-hosting.mdx

@@ -70,6 +70,14 @@ MYSQL_PASSWORD=your-secure-password
 MINIO_ROOT_PASSWORD=your-minio-password
 ```
 
+**Building your own web image:**
+
+`CAP_URL` is read at runtime by the server, but the browser bundle gets its copy of the public URL baked in at build time from `NEXT_PUBLIC_WEB_URL`. The pre-built `ghcr.io` image bakes `http://localhost:3000`. If you build `apps/web/Dockerfile` yourself, pass your public URL as a build argument so share links, embeds and CORS work in the browser:
+
+```bash
+docker build -f apps/web/Dockerfile --build-arg NEXT_PUBLIC_WEB_URL=https://cap.yourdomain.com .
+```
+
 ### Option 2: Railway (One-Click)
 
 [![Deploy on Railway](https://railway.com/button.svg)](https://railway.com/new/template/PwpGcf)