If you can read me, it means that you misconfigured Lychee.

Please check that:

  • your
    APP_URL
    is properly set to the correct url.
    For example:
    APP_URL=https://lychee.example.com
  • if you are working behind a reverse proxy, that
    TRUSTED_PROXIES
    is set to the forwarding ip.
    For example:
    TRUSTED_PROXIES=*

    Note that the wildcard value (
    *
    ) is a very insecure option and not recommended.
  • if you are working behind an apache reverse proxy, that the forwarding headers are properly set.
    For example:
    RequestHeader set X-Forwarded-Proto https
    is set.
  • if the CSP is blocking your assets because serving http, you need to force https.
    This is done by setting
    APP_FORCE_HTTPS=true