# Domain Allowlist for 18004 Server
# One domain per line. Lines starting with # are comments.
# These domains are allowed on the restricted SVG/PNG ports.
#
# The server strips the first subdomain from incoming requests:
#   Request to qr.example.com -> checks "example.com" against this list
#   Request to png.mysite.org -> checks "mysite.org" against this list
#
# Domains can also be added/removed at runtime via the API port:
#   POST /domains/add    {"domain": "newsite.com"}
#   POST /domains/remove {"domain": "oldsite.com"}
# Runtime changes are persisted back to this file.

example.com
mysite.org