From b9d73497efe7c28800040b3e421bfb4cb6af6092 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 26 May 2026 21:08:25 +0000 Subject: feat(config,cli): loopback-default binding with fail-loud on external (Phase 7) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The server now defaults to binding 127.0.0.1 and refuses to bind a non-loopback address (:8484, 0.0.0.0, a LAN IP, …) unless external_bind_allowed = true is set in config — failing loud at startup instead of silently exposing itself. External access is expected to go through a reverse proxy (Tailscale / Cloudflare Access / Caddy), per the locked auth model. - config: ExternalBindAllowed flag + ValidateBindAddr/isLoopbackHost (tested across loopback, all-interfaces, LAN, and override cases). - cli: --addr default is now 127.0.0.1:8484; serve() validates before binding. Per-client bearer rotation stays deferred (single shared token for now). https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39 --- internal/config/bind_test.go | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 internal/config/bind_test.go (limited to 'internal/config/bind_test.go') diff --git a/internal/config/bind_test.go b/internal/config/bind_test.go new file mode 100644 index 0000000..8e0ab4b --- /dev/null +++ b/internal/config/bind_test.go @@ -0,0 +1,27 @@ +package config + +import "testing" + +func TestValidateBindAddr(t *testing.T) { + cases := []struct { + addr string + external bool + wantErr bool + }{ + {"127.0.0.1:8484", false, false}, // loopback ok + {"localhost:8484", false, false}, // loopback ok + {"[::1]:8484", false, false}, // ipv6 loopback ok + {":8484", false, true}, // all interfaces, not allowed + {"0.0.0.0:8484", false, true}, // all interfaces, not allowed + {"192.168.1.10:8484", false, true}, // LAN ip, not allowed + {":8484", true, false}, // all interfaces, explicitly allowed + {"0.0.0.0:8484", true, false}, // explicitly allowed + {"192.168.1.10:8484", true, false}, // explicitly allowed + } + for _, c := range cases { + err := ValidateBindAddr(c.addr, c.external) + if (err != nil) != c.wantErr { + t.Errorf("ValidateBindAddr(%q, external=%v): err=%v, wantErr=%v", c.addr, c.external, err, c.wantErr) + } + } +} -- cgit v1.2.3