-- The address users reach Minstrel at, e.g. https://music.example.com.
--
-- Before: password-reset links were built from the request's Host header,
-- which the requester controls, so a forgot-password call with a forged Host
-- would email the victim a real reset token on a link to the attacker's
-- server. After: links are built only from this admin-set value, and none
-- are sent while it is empty.
ALTER TABLE network_settings ADD COLUMN public_url text NOT NULL DEFAULT '';