From 96724613541fd97d5314862060db4bf16dd67820 Mon Sep 17 00:00:00 2001 From: jatin Date: Thu, 4 Jun 2026 14:14:05 -0400 Subject: [PATCH] Document self-hosted same-origin agent-sandbox proxy (no extra ingress) Clarify that leaving agentSandbox.frontendWsProxyDomain empty makes the backend serve the sandbox proxy same-origin via the main ingress, so no dedicated proxy domain or ingress object is required for self-hosted. Co-Authored-By: Claude Opus 4.8 (1M context) --- charts/retool/values.yaml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/charts/retool/values.yaml b/charts/retool/values.yaml index 9c20a0a..f8c95ae 100644 --- a/charts/retool/values.yaml +++ b/charts/retool/values.yaml @@ -1094,8 +1094,13 @@ agentSandbox: # controllerUrl and proxyUrl default to internal service URLs when empty. controllerUrl: '' proxyUrl: '' - # Required: public URL for frontend browsers to reach the proxy via WebSocket. - # e.g. https://sandbox.yourdomain.com + # Public URL for frontend browsers to reach the proxy via WebSocket. + # Leave EMPTY for self-hosted: the backend then serves the sandbox same-origin + # as the editor (your Retool base URL) and the front server reverse-proxies the + # /sandbox/* WS+Vite paths to the in-cluster proxy Service — so no dedicated + # proxy domain or ingress is required, and your catch-all ingress is untouched. + # Only set this (e.g. https://sandbox.yourdomain.com) if you deliberately want + # the proxy on a separate domain, in which case also enable proxy.ingress above. frontendWsProxyDomain: '' # Public URL for proxy domain. Defaults to frontendWsProxyDomain if empty. proxyDomain: ''