diff --git a/defaults/main.yml b/defaults/main.yml
index 29f5a681..2f49096d 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -148,6 +148,10 @@ horizon_session_timeout: 1800
 ## Horizon Help URL Path
 horizon_help_url: https://docs.openstack.org/horizon/latest/user/
 
+## Horizon ALLOWED_HOSTS
+horizon_allowed_hosts:
+  - '*'
+
 ## Installation directories
 horizon_lib_dir: "{{ _horizon_lib_dir }}"
 horizon_lib_wsgi_file: "{{ horizon_lib_dir }}/openstack_dashboard/wsgi.py"
diff --git a/releasenotes/notes/add_allowed_hosts-38036c7457afc255.yaml b/releasenotes/notes/add_allowed_hosts-38036c7457afc255.yaml
new file mode 100644
index 00000000..0c0a660d
--- /dev/null
+++ b/releasenotes/notes/add_allowed_hosts-38036c7457afc255.yaml
@@ -0,0 +1,7 @@
+---
+features:
+  - Add ``horizon_allowed_hosts`` to be able to configure django ALLOWED_HOSTS.
+    The default is still the same as it was but you can create a list of allowed
+    hosts in ``/etc/openstack_deploy/user_variables.yml``. to set the correct
+    value, see https://docs.djangoproject.com/en/dev/ref/settings/#allowed-hosts
+    for more details.
diff --git a/templates/horizon_local_settings.py.j2 b/templates/horizon_local_settings.py.j2
index 31dba572..0fa82fcb 100644
--- a/templates/horizon_local_settings.py.j2
+++ b/templates/horizon_local_settings.py.j2
@@ -41,7 +41,7 @@ LOGOUT_URL = '{{ horizon_logout_url }}'
 # with the list of host/domain names that the application can serve.
 # For more information see:
 # https://docs.djangoproject.com/en/dev/ref/settings/#allowed-hosts
-ALLOWED_HOSTS = ['*']
+ALLOWED_HOSTS = [ "{{ horizon_allowed_hosts | join(',') }}" ]
 
 {% if (horizon_enable_ssl | bool) and (horizon_external_ssl | bool) %}
 # Set SSL proxy settings: