self_hosted: empty WEB_HOST silently produces broken URLs instead of failing fast

Summary

In self_hosted mode, an empty WEB_HOST is accepted and silently produces broken URLs. The app should fail fast (or log a loud, clear error) at startup instead.

Details

WEB_HOST is read with a default that only applies when the variable is unset, not when it is set to an empty string:

• enterprise/server/constants.py: HOST = os.getenv('WEB_HOST', 'app.all-hands.dev').strip()
• openhands/app_server/mcp/mcp_router.py: f'https://{os.getenv("WEB_HOST", "app.all-hands.dev").strip()}'

A deployment that sets WEB_HOST to an empty string yields HOST = "", not the fallback. Consumers then split two ways:

• Guarded (handle empty gracefully): openhands/app_server/config.py and openhands/app_server/integrations/provider.py return None when WEB_HOST is empty.
• Not guarded (build broken URLs): mcp_router.py produces https:// with no host; email verification links and integration OAuth redirect URIs (e.g. enterprise/server/routes/integration/jira_dc.py, the keycloak realm templates) build https:///....

Impact

A self-hosted operator who runs their own ingress controller and does not set the app's public hostname boots with an empty WEB_HOST. Auth, email verification, and integration redirect URLs are broken, with no error pointing at the cause. Bring-your-own ingress is an encouraged setup, so this is a realistic path rather than an edge case. The failure is silent and degraded, not a crash, which makes it hard to diagnose.

Proposed fix

In self_hosted mode, validate WEB_HOST at startup and fail fast with a clear message when it is empty (something like "WEB_HOST must be set to the public hostname this deployment is reached on"). Confirm first that no valid self_hosted setup legitimately runs without a public hostname before making it a hard failure; if such a mode exists, a loud startup error/log is the safer choice.

Priority

Low. This preserves a finding from a configuration-safeguards review. The common path is already caught earlier; this covers the bring-your-own-ingress path where the app is the only place to catch it.

This issue was drafted by an AI agent on behalf of the user.