[velixio]

A user on production created a site whose only host was afaridar. The tracker can never match a single-word host, so the site stayed at 0 events.

Decision: the rule applies only when SUPERMETRY_MANAGED is true. Self-hosters keep intranet names such as wiki.

• In managed mode a host needs a dot (example.com, blog.example.co.uk, *.example.com). localhost and IPv4 addresses stay allowed for testing. IPv6 was already rejected by the existing validator.
• Anything else is rejected with 400: host "afaridar" is not a domain: use something like example.com.
• Only create and host-changing updates are checked. Hosts a site already stores are not re-checked, so renaming or re-saving such a site still works.
• The new-site form and site settings show a hint when /auth/config reports managed. The form checks before submitting. Self-hosted forms are unchanged. Strings are translated in de, es and bn.
• The flag reaches the service through Sites.SetRequireDomain, set from cfg.Managed in serve.go.
• OpenAPI, configuration docs and the changelog are updated.

Tests: table tests (managed vs not, wildcard, localhost, IPs, case and whitespace), an update-unchanged DB test, an HTTP 400 test, and web tests. The full go test ./... -count=1 -p 2 run passed, as did web typecheck and bun run test.

Cloud: its demo site uses CLOUD_DEMO_HOST, default demo.supermetry.com, which is fine. Its config only checks for a valid host name, so an operator could set a single-label value; the demo site is only created when absent.

[coderabbitai]

Caution

Review failed

The pull request is closed.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}