From b9d73497efe7c28800040b3e421bfb4cb6af6092 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 26 May 2026 21:08:25 +0000 Subject: feat(config,cli): loopback-default binding with fail-loud on external (Phase 7) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The server now defaults to binding 127.0.0.1 and refuses to bind a non-loopback address (:8484, 0.0.0.0, a LAN IP, …) unless external_bind_allowed = true is set in config — failing loud at startup instead of silently exposing itself. External access is expected to go through a reverse proxy (Tailscale / Cloudflare Access / Caddy), per the locked auth model. - config: ExternalBindAllowed flag + ValidateBindAddr/isLoopbackHost (tested across loopback, all-interfaces, LAN, and override cases). - cli: --addr default is now 127.0.0.1:8484; serve() validates before binding. Per-client bearer rotation stays deferred (single shared token for now). https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39 --- internal/config/config.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'internal/config/config.go') diff --git a/internal/config/config.go b/internal/config/config.go index 58de95c..6f6b958 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -70,6 +70,10 @@ type Config struct { ClaudeConfigDir string `toml:"claude_config_dir"` LocalModel LocalModel `toml:"local_model"` Budget BudgetConfig `toml:"budget"` + // ExternalBindAllowed must be explicitly true to bind a non-loopback address. + // Default external access should go through a reverse proxy (Tailscale / + // Cloudflare Access / Caddy); binding the server directly is a footgun. + ExternalBindAllowed bool `toml:"external_bind_allowed"` } // BudgetConfig configures rolling per-provider spend caps. With no providers @@ -103,7 +107,7 @@ func Default() (*Config, error) { GeminiImage: "claudomator-agent:latest", MaxConcurrent: 3, DefaultTimeout: "15m", - ServerAddr: ":8484", + ServerAddr: "127.0.0.1:8484", WorkspaceRoot: "/workspace", ClaudeConfigDir: "/workspace/claudomator/credentials/claude", }, nil -- cgit v1.2.3