apache · dependabot · Feb 16, 2026 · Feb 16, 2026 · Mar 26, 2026
diff --git a/Dockerfile b/Dockerfile
@@ -14,7 +14,7 @@ LABEL MAINTAINER="https://caswaf.org/"
 
 COPY --from=BACK /go/src/caswaf/ ./
 COPY --from=BACK /usr/bin/wait-for-it ./
-RUN mkdir -p web/build && apk add --no-cache bash coreutils
+RUN mkdir -p web/build && apk add --no-cache bash coreutils tzdata
 COPY --from=FRONT /web/build /web/build
 ENTRYPOINT ["./wait-for-it", "db:3306", "--", "./server"]
 
diff --git a/README.md b/README.md
@@ -61,6 +61,30 @@ CasWAF uses Casdoor to manage members. So you need to create an organization and
 - **Docker Compose**: Use the provided `docker-compose.yml` for quick local setup
 - **Manual Installation**: Build and run from source
 
+### Runtime Configuration (Recommended)
+
+You can configure CasWAF to use your own Casdoor instance **without rebuilding the Docker image** by mounting a custom `config.js` file:
+
+```bash
+# Create config.custom.js with your Casdoor settings
+docker run -d -p 17000:17000 \
+  -v $(pwd)/config.custom.js:/web/build/config.js:ro \
+  -v $(pwd)/conf/app.conf:/conf/app.conf:ro \
+  casbin/caswaf:latest
+```
+
+Example `config.custom.js`:
+```javascript
+window.appConfig = {
+  serverUrl: "https://your-casdoor.com",
+  clientId: "your-client-id",
+  appName: "caswaf",
+  organizationName: "your-org",
+  redirectPath: "/callback",
+};
+```
+
+
 ### Necessary configuration
 
 #### Get the code

diff --git a/web/public/config.js b/web/public/config.js
@@ -0,0 +1,24 @@
+// Copyright 2026 The casbin Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Runtime configuration for CasWAF frontend
+// This file can be mounted/replaced at runtime without rebuilding the Docker image
+// Mount location: /web/build/config.js
+window.appConfig = {
+    serverUrl: "https://door.casdoor.com",
+    clientId: "af6b5aa958822fb9dc33",
+    appName: "app-casibase",
+    organizationName: "casbin",
+    redirectPath: "/callback",
+};
diff --git a/web/public/index.html b/web/public/index.html
@@ -25,6 +25,8 @@
       Learn how to configure a non-root public URL by running `npm run build`.
     -->
     <title>CasWAF</title>
+    <!-- Load runtime configuration before React app -->
+    <script src="%PUBLIC_URL%/config.js"></script>
   </head>
   <body>
     <noscript>You need to enable JavaScript to run this app.</noscript>

diff --git a/web/src/Conf.js b/web/src/Conf.js
@@ -12,9 +12,11 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-export const AuthConfig = {
+// Load configuration from runtime config.js file (mounted at /web/build/config.js)
+// This allows configuration to be changed without rebuilding the Docker image
+export const AuthConfig = window.appConfig || {
+  // Fallback defaults if config.js is not loaded
   serverUrl: "https://door.casdoor.com",
-  // serverUrl: "http://localhost:7001",
   clientId: "af6b5aa958822fb9dc33",
   appName: "app-casibase",
   organizationName: "casbin",