How can I pass the correct RpOriginDomain for Passkey setting?

[Escovan]

Hi, I've succesfully setup EmDash on my locally hosted VPS behind a NPM proxy and networked via CloudFlare to the outside domain. However, this introduces a difference between the original OriginDomain - and the effective domain it eventually uses. I've tried some tweaks my Agent came up with - from trying to make a custom .env file, to actually altering the SQLlite DB here with the desired option - but it still won't fly. Hence, I cannot get into the EmDash Admin from here - and it keeps looping setup until the Passkey Error. Without my password manager - it won't compute at all.

[marcusbellamyshaw-cell]

The RP origin isn't set directly — it's derived from siteUrl. Set siteUrl in your astro.config.mjs emdash({...}) integration options (or the EMDASH_SITE_URL / SITE_URL env var as a fallback) to the external HTTPS domain your users actually hit, not the internal proxy target. rpId and the passkey origin are both computed from that URL's hostname at request time.

If you're serving multiple hostnames (e.g. apex + a Cloudflare-fronted subdomain), add the extras via allowedOrigins in config or EMDASH_ALLOWED_ORIGINS (comma-separated) — they need to be same-hostname-or-subdomain of siteUrl. Full example in the configuration reference.

Note this is separate from trustedProxyHeaders/EMDASH_TRUSTED_PROXY_HEADERS, which is for client-IP/rate-limiting behind a proxy, not the passkey RP origin — worth not conflating the two. And since the origin is derived from siteUrl at request time rather than stored per-record, editing the sqlite DB directly won't fix this.