Public website origin

Selected public origin

Vitni’s selected public web and issuer origin is https://certificate.vitni.cc. The repository does not configure DNS, TLS, a reverse proxy, or production hosting, so this hostname is a deployment decision and is not evidence that the site is live.

Set the same origin for the web application and public credential documents:

VITNI_WEB_ORIGIN=https://certificate.vitni.cc
VITNI_PUBLIC_ISSUER_BASE_URL=https://certificate.vitni.cc
NUXT_PUBLIC_SITE_ORIGIN=https://certificate.vitni.cc
NUXT_PUBLIC_API_BASE=https://api.certificate.vitni.cc/api/v1
NUXT_PUBLIC_DOCS_URL=https://docs.certificate.vitni.cc
VITNI_OIDC_ISSUER=https://<instance>.zitadel.cloud
NUXT_OAUTH_ISSUER=https://<instance>.zitadel.cloud
NUXT_OAUTH_CLIENT_ID=<web-client-id>
NUXT_OAUTH_REDIRECT_URL=https://certificate.vitni.cc/auth/callback
NUXT_OAUTH_POST_LOGOUT_REDIRECT_URL=https://certificate.vitni.cc/

VITNI_WEB_ORIGIN supplies the public web origin used for API CORS and invitation links. VITNI_PUBLIC_ISSUER_BASE_URL supplies canonical issuer, achievement, credential, status-list, and marketing URLs. Keep it as a plain HTTPS origin with no path, query, or fragment. The web app falls back to VITNI_WEB_ORIGIN for page canonicals and social metadata when the issuer origin is not set.

Set NUXT_PUBLIC_SITE_ORIGIN in the Nuxt runtime so server-rendered canonicals, social metadata, robots.txt, and the sitemap use the public hostname after deployment. Keep it equal to VITNI_PUBLIC_ISSUER_BASE_URL.

The free prelaunch deployment uses Cloudflare Workers for certificate.vitni.cc and docs.certificate.vitni.cc, Render for api.certificate.vitni.cc, and the generated ZITADEL issuer URL for sign-in. Register the exact callback URL https://certificate.vitni.cc/auth/callback and post-logout URL https://certificate.vitni.cc/ in the ZITADEL web application. See free prelaunch hosting for the OIDC audience and provider setup.

The Cloudflare variables and secret names are listed in Cloudflare deployment. Keep the repository’s .env local values on 127.0.0.1 for development. Set the production origin before publishing the first production issuer identity because its canonical identifier is stable after publication.

Before launch

Cloudflare Worker custom domains create DNS records and certificates when the vitni.cc zone is active in the account. Deployment still requires provider logins, a connected Git repository for Render, production database credentials, ZITADEL instance values, Wrangler authorization, and a verified email sender before delivery can be enabled.