Fix DJANGO_ALLOWED_HOSTS parsing

Closes #637.

web/README.md

@@ -65,7 +65,7 @@ change them unless you know what you want.
   `/opt/mailman-web-data/logs/mailmanweb.log`.
 
 - `DJANGO_ALLOWED_HOSTS`: Entry to add to ALLOWED_HOSTS in Django
-  configuration. This is a separate configuration from`SERVE_FROM_DOMAIN` as
+  configuration. Format as comma-separated list (no whitespace). This is a separate configuration from`SERVE_FROM_DOMAIN` as
   latter is used for other purposes too.
 
 - `POSTORIUS_TEMPLATE_BASE_URL`: The base url at which the `mailman-web`

web/mailman-web/settings.py

@@ -49,13 +49,11 @@ SITE_ID = 1
 # See https://docs.djangoproject.com/en/3.1/ref/settings/#allowed-hosts
 ALLOWED_HOSTS = [
     "localhost",  # Archiving API from Mailman, keep it.
-    # "lists.your-domain.org",
-    # Add here all production URLs you may have.
     "mailman-web",
     gethostbyname("mailman-web"),
     os.environ.get('SERVE_FROM_DOMAIN'),
-    os.environ.get('DJANGO_ALLOWED_HOSTS'),
 ]
+ALLOWED_HOSTS.extend(os.getenv("DJANGO_ALLOWED_HOSTS", "").split(","))
 
 # Mailman API credentials
 MAILMAN_REST_API_URL = os.environ.get('MAILMAN_REST_URL', 'http://mailman-core:8001')