Changeset f99bbe8 in Klonkt for src/server.js

Timestamp:

06/23/2026 10:00:00 PM (3 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

5eef817

Parents:

09ee2bd

Message:

security: bind to 127.0.0.1 by default behind a reverse proxy

New HOST env (default 0.0.0.0 for Docker/back-compat). The VPS installer now
writes HOST=127.0.0.1 and Docker maps the host port to loopback (127.0.0.1:3000:3000)
+ overrides HOST=0.0.0.0 inside the container — so the app is never reachable
directly on its port from the internet, only via the proxy. .env.example defaults
to 127.0.0.1 (manual installs); docs explain it. Existing installs hardened on
re-run of install.sh.

Co-Authored-By: Claude <noreply@…>

File:

• src/server.js (modified) (2 diffs)

src/server.js

@@ -87 +87 @@
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PORT = process.env.PORT || 3000;
+// Interface to bind. Default 0.0.0.0 (needed for Docker port-forwarding). Behind a
+// reverse proxy on the same host, set HOST=127.0.0.1 so the app is NOT reachable
+// directly from the internet (only via the proxy) — see README/install docs.
+const HOST = process.env.HOST || '0.0.0.0';
 const isDev = process.env.NODE_ENV !== 'production';
 
@@ -427 +431 @@
 });
 
-server.listen(PORT, () => {
+server.listen(PORT, HOST, () => {
   console.log('');
   console.log('🪶 Klonkt Beta');