Where I should go to set the `DISCOURSE_ENABLE_CORS` env variable?

iframe is created by official js script. I’m using the codes that are provided on /admin/customize/embedding, as blow:


I need to keep the embedded parts consistent with the color pattern of my website, so I have to access the iframe althogh the iframe is not created by me.