This deployment serves /widget.js and /widget-full.js for embedded sites.
When you open this page, the browser sends Origin: https://… for this host
() — not the marina’s production website.
If the chat shows “Midagi läks valesti” / “Service temporarily unavailable”, configure both:
Railway — add https:// to CORS_ALLOWED_ORIGINS
(comma-separated); Admin → marina (Kuressaare) — add to
domain whitelist (one hostname per line, no https://). In production, an empty whitelist
blocks the widget; development mode skips origin checks.