Support separate public forms domain

README.md

@@ -21,6 +21,7 @@ POSTGRES_PASSWORD=replace-with-a-strong-password
 
 AUTH_SECRET=replace-with-openssl-rand-base64-32
 AUTH_URL=https://forms.example.com
+PUBLIC_FORM_URL=https://forms-public.example.com
 
 OIDC_ISSUER=https://authentik.example.com/application/o/formbuilder/
 OIDC_CLIENT_ID=replace-with-authentik-client-id
@@ -62,6 +63,33 @@ location / {
 
 `502 Bad Gateway` means openresty cannot reach the upstream. First verify the app from the proxy host with `curl http://127.0.0.1:3080/signin` or `curl http://<docker-host-ip>:3080/signin`.
 
+### Separate Builder And Public Forms Domains
+
+To build/manage forms at `forms.internal.vyntehome.com` and serve published forms at `forms.vyntehome.com`, point both reverse-proxy hosts to the same app upstream and set:
+
+```bash
+AUTH_URL=https://forms.internal.vyntehome.com
+PUBLIC_FORM_URL=https://forms.vyntehome.com
+```
+
+Keep the Authentik redirect URI on the internal builder domain:
+
+```text
+https://forms.internal.vyntehome.com/api/auth/callback/oidc
+```
+
+The public proxy host must forward these paths to the app:
+
+```text
+/f/*
+/embed.js
+/_next/*
+/api/forms/*
+/api/files/*
+```
+
+Published forms intended for `forms.vyntehome.com` must use **Public** visibility. Workspace-only forms require an authenticated session and should be opened on the internal builder domain.
+
 ## Authentik Setup
 
 Create an OAuth2/OpenID provider in Authentik: