feat: add WEBAPP_URL_INTERNAL for server-side self-fetches

[GAURAV07C]

Description

The Problem:
Currently, when the container makes server-side HTTP calls to itself during SSR (such as tRPC queries, OG image font fetches, or email verification flows), it uses the public WEBAPP_URL. When the container sits behind a reverse proxy or CDN (like Cloudflare or nginx), these internal calls are routed all the way out to the public IP and back to the same container (hairpin routing). This causes:

• Extra latency on every SSR render.
• Wasted bandwidth and potential false positives in WAF audit logs.
• Broken SSR on hosting providers (like OVH) that do not support hairpin NAT.

The Solution:
Similar to how NextAuth handles its own SSR fetches with NEXTAUTH_URL_INTERNAL, this PR introduces a new environment variable: WEBAPP_URL_INTERNAL.

When WEBAPP_URL_INTERNAL is set (e.g. http://localhost:3000), server-side code uses it in place of the public WEBAPP_URL for its internal HTTP requests. Client-facing URL generation remains unaffected and strictly uses WEBAPP_URL.

Changes Made:

• environment.d.ts: Added type definition for WEBAPP_URL_INTERNAL.
• packages/trpc/react/trpc.ts: Updated the tRPC Next.js client initialization to prioritize WEBAPP_URL_INTERNAL during SSR evaluations.
• getServerSideProps (verify-email-change) & OG image font fetching (route.tsx): Updated server-side fetch() logic to securely fall back to the internal URL.

Backwards Compatibility

If WEBAPP_URL_INTERNAL is unset, the system seamlessly falls back to using the standard WEBAPP_URL internally. Existing deployments will keep working as before without any breaking changes.

Fixes #29834

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have run yarn type-check:ci --force and ensured there are no TypeScript errors

[github-actions]

Welcome to Cal.diy, @GAURAV07C! Thanks for opening this pull request.

A few things to keep in mind:

• This is Cal.diy, not Cal.com. Cal.diy is a community-driven, fully open-source fork of Cal.com licensed under MIT. Your changes here will be part of Cal.diy — they will not be deployed to the Cal.com production app.
• Please review our Contributing Guidelines if you haven't already.
• Make sure your PR title follows the Conventional Commits format.

A maintainer will review your PR soon. Thanks for contributing!

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4062418e-1519-4cf3-a06f-d9a9b19596bd

📥 Commits

Reviewing files that changed from the base of the PR and between f5c1420 and b6ff24a.

📒 Files selected for processing (4)

• apps/web/app/api/social/og/image/route.tsx
• apps/web/server/lib/auth/verify-email-change/getServerSideProps.tsx
• packages/lib/constants.ts
• packages/trpc/react/trpc.ts

🚧 Files skipped from review as they are similar to previous changes (3)

• apps/web/app/api/social/og/image/route.tsx
• apps/web/server/lib/auth/verify-email-change/getServerSideProps.tsx
• packages/trpc/react/trpc.ts

---

📝 Walkthrough

Walkthrough

Adds the optional WEBAPP_URL_INTERNAL process environment variable. Server-side OG image font fetches and email verification requests now prefer this URL, falling back to WEBAPP_URL. Non-browser tRPC configuration also prefers the internal URL before its existing deployment URL fallbacks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding WEBAPP_URL_INTERNAL for server-side self-fetches.
Description check	✅ Passed	The description matches the implemented changes and explains the motivation, behavior, and compatibility correctly.
Linked Issues check	✅ Passed	The PR implements the requested internal URL fallback for server-side self-fetches while preserving public URL behavior and compatibility.
Out of Scope Changes check	✅ Passed	The changed files all relate to the internal server-side URL feature, with no obvious unrelated scope added.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/trpc/react/trpc.ts`:
- Around line 55-62: Normalize and validate WEBAPP_URL_INTERNAL before appending
endpoint paths or passing it to URL-based self-fetches. Apply this in
packages/trpc/react/trpc.ts around internalUrl,
apps/web/app/api/social/og/image/route.tsx at lines 40-42 before new URL(...),
and apps/web/server/lib/auth/verify-email-change/getServerSideProps.tsx at line
29 before composing the verification endpoint; host-only values such as
localhost:3000 must become valid URLs while preserving already normalized
values.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0b7c1d84-6430-459c-85fe-4d6db5c32d54

📥 Commits

Reviewing files that changed from the base of the PR and between 3894f37 and f5c1420.

📒 Files selected for processing (4)

• apps/web/app/api/social/og/image/route.tsx
• apps/web/server/lib/auth/verify-email-change/getServerSideProps.tsx
• packages/trpc/react/trpc.ts
• packages/types/environment.d.ts

[GAURAV07C]

@bandhan-majumder can you review ?