Public and local access for ODK Central WebUI

1. What is the issue? Please be detailed.

I'd like to setup a single instance of the Central server using both a public domain and a local domain without having to break SSL certificate trust, or manually modifying the database. The goal is to have the least setup / re-setup when changing infrastructure per project. Read more below for more details of the problem.

2. What steps can we take to reproduce this issue?

Our research group most of the time is setup in an environment with internet, so we can use our reverse proxy with SSL upstream, with no problem. However, the problem comes in when we're required to be on-site with the interview team, and having no internet access due to full infrastructure black out - most of the time due to typhoons - and need to setup an AdHoc WiFi for our interviewers. This time, SSL trust breaks, due to having to use a local reverse proxy which also handles its own SSL generation with the same domain. Using the IP directly of the Central server, doesn't work either since we can't access the WebUI to verify or change form access on the fly; the server refuses to even display the login page due to having a different url than what was setup on the .env file.

3. What have you tried to fix the issue?

Tried adding a comma to the .env file, in-order for us to use a different domain for the AdHoc cases that we sometimes need, but the whole setup breaks and refuses to start. We tried having a secondary server, and that worked, but we needed all data to be sent to a centralized database that our clients can connect to after the project is done, and it was more than a hassle to setup, especially with encryption, it definitely was not a comfortable experience manually modifying the database.

4. Upload any forms or screenshots you can share publicly below.

Something similar below could work as a fix. Note in the documentation for installation now has to include a warning stating that Let's Encrypt would not work in this setup; a custom or upstream would be ideal since a double reverse proxy might be the best option for this.