Thanks for your reply, and no worries I know it will be worthwhile!
I’ve simplified things to use a server-rendered (rails) site and omit the nginx layer all around. I have my app running on port 3001 and discourse running on port 3000.
My embed code is rendered as this:
<script type="text/javascript">
DiscourseEmbed = { discourseUrl: 'http://localhost:3000/',
discourseEmbedUrl: 'http://localhost:3001/enlistments/1' };
(function() {
var d = document.createElement('script'); d.type = 'text/javascript'; d.async = true;
d.src = DiscourseEmbed.discourseUrl + 'javascripts/embed.js';
(document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(d);
})();
</script>
I added localhost:3001 to the embeddable hosts in Admin > Customize > Embedding and http://localhost:3001 to the hostnames in Admin > Settings > cors.
The error is the same, but with the hostnames updated:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('http://localhost:3000') does not match the recipient window's origin ('http://localhost:3001').
The stack is about as simple as it gets now
I assume that means it’s a configuration issue of some sort? Any ideas?