first commit

config/domains.conf.example

@@ -0,0 +1,15 @@
+# Domain Allowlist for 18004 Server
+# One domain per line. Lines starting with # are comments.
+# These domains are allowed on the restricted SVG/PNG ports.
+#
+# The server strips the first subdomain from incoming requests:
+#   Request to qr.example.com -> checks "example.com" against this list
+#   Request to png.mysite.org -> checks "mysite.org" against this list
+#
+# Domains can also be added/removed at runtime via the API port:
+#   POST /domains/add    {"domain": "newsite.com"}
+#   POST /domains/remove {"domain": "oldsite.com"}
+# Runtime changes are persisted back to this file.
+
+example.com
+mysite.org