Changeset f99bbe8 in Klonkt for .env.example

Timestamp:

06/23/2026 10:00:00 PM (3 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

5eef817

Parents:

09ee2bd

Message:

security: bind to 127.0.0.1 by default behind a reverse proxy

New HOST env (default 0.0.0.0 for Docker/back-compat). The VPS installer now
writes HOST=127.0.0.1 and Docker maps the host port to loopback (127.0.0.1:3000:3000)
+ overrides HOST=0.0.0.0 inside the container — so the app is never reachable
directly on its port from the internet, only via the proxy. .env.example defaults
to 127.0.0.1 (manual installs); docs explain it. Existing installs hardened on
re-run of install.sh.

Co-Authored-By: Claude <noreply@…>

File:

• .env.example (modified) (1 diff)

.env.example

@@ -1 +1 @@
 NODE_ENV=development
 PORT=3000
+
+# Network interface to bind. 127.0.0.1 = only reachable via a reverse proxy on the
+# same machine (recommended for a manual install behind Caddy/nginx — keeps the app
+# off the public internet). Use 0.0.0.0 only if you need direct external access
+# (no proxy/HTTPS — not recommended). Docker sets this to 0.0.0.0 itself.
+HOST=127.0.0.1
 # Secret used to sign login-session cookies. Leave EMPTY to auto-generate a strong
 # one on first start (saved to storage/.session-secret, stays stable across