Fix CSP / Hostname bugs.

config/application.rb

@@ -11,6 +11,7 @@ module FarmBot
     config.action_dispatch.perform_deep_munge = false
     I18n.enforce_available_locales = false
     LOCAL_API_HOST = ENV["API_HOST"] || "localhost"
+    WEBPACK_URL    = "http://#{LOCAL_API_HOST}:3808"
     config.generators do |g|
       g.template_engine :erb
       g.test_framework :rspec, :fixture_replacement => :factory_bot, :views => false, :helper => false
@@ -58,7 +59,8 @@ module FarmBot
                       "api.github.com",
                       "raw.githubusercontent.com",
                       "openfarm.cc",
-                      "api.rollbar.com"] +
+                      "api.rollbar.com",
+                      WEBPACK_URL] +
           (Rails.env.production? ? %w(wss:) : %w(ws: localhost:3000 localhost:3808)),
         font_src: %w(
           'self'
@@ -88,7 +90,7 @@ module FarmBot
           "cdnjs.cloudflare.com",
           "chrome-extension:",
           "localhost:3808",
-          "#{LOCAL_API_HOST}:3808",
+          WEBPACK_URL,
         ],
         style_src: %w(
           'unsafe-inline'

config/webpack.dev.js

@@ -1,12 +1,14 @@
-var devServerPort = 3808;
 var path = require("path");
 var genConfig = require("./webpack.base");
 var conf = genConfig();
 
+var devServerPort = 3808;
+const host = process.env["API_HOST"] || "localhost"
+
 conf.output = {
   // must match config.webpack.output_dir
   path: path.join(__dirname, '..', 'public', 'webpack'),
-  publicPath: '//localhost:' + devServerPort + '/webpack/',
+  publicPath: `//${host}:${devServerPort}/webpack/`,
   filename: '[name].js'
 };
 

package.json

@@ -13,7 +13,7 @@
     "build": "TARGET=production bundle exec rake webpack:compile",
     "start": "echo 'use `rails api:start`'",
     "heroku-postbuild": "webpack --config=./config/webpack.prod.js",
-    "webpack": "./node_modules/.bin/webpack-dev-server --config config/webpack.dev.js --host 0.0.0.0",
+    "webpack": "./node_modules/.bin/webpack-dev-server --config config/webpack.dev.js",
     "test-slow": "jest --coverage --no-cache -w 2",
     "test": "jest --no-coverage --cache -w 5",
     "typecheck": "./node_modules/.bin/tsc --noEmit --jsx preserve"