Files
OmniRoute/tests/unit
diegosouzapw b87c92b3d7 fix(docker): bind app/sidecar compose ports to loopback by default (#12568, #12578)
docker-compose.yml and docker-compose.prod.yml defaulted API_HOST/LIVE_WS_HOST/
HOSTNAME to 0.0.0.0 and published the dashboard/API/live-WS ports with bare,
unscoped specs, which Docker expands to every interface. Combined with
REQUIRE_API_KEY=false shipping as the .env.example default, this exposed the
anonymous /v1 LLM proxy to the whole LAN/WAN (#12568). The optional cliproxyapi
sidecar had the same unscoped publish spec plus no forwarded auth env var,
exposing a credential-bearing service the same way (#12578); qdrant and bifrost
had the identical gap.

Applies the existing Redis loopback-bind precedent (tests/unit/compose-redis-
loopback-bind.test.ts) to the app's own ports and to cliproxyapi/qdrant/bifrost:
- New APP_BIND_HOST / CLIPROXY_BIND_HOST / QDRANT_BIND_HOST / BIFROST_BIND_HOST
  opt-in vars, defaulting to 127.0.0.1, documented in .env.example and
  docs/reference/ENVIRONMENT.md.
- API_HOST/LIVE_WS_HOST default to 127.0.0.1 in both compose files; the prod
  file no longer hardcodes HOSTNAME=0.0.0.0.
- cliproxyapi now forwards CLIPROXYAPI_MANAGEMENT_KEY as MANAGEMENT_PASSWORD,
  the one env var the pinned image actually reads for its management API.
- A new boot-time guard (src/lib/startup/nonLoopbackApiKeyGuard.ts) logs a
  warning — never a hard failure — when the API bridge or live-WS server ends
  up bound to a non-loopback host while REQUIRE_API_KEY is disabled.

⚠️ base-red inherited: #12732 — unit #12058, integration codex-cache,
package-artifact, tarball-smoke, agent-skills-sync

Closes #12568
Closes #12578
2026-09-10 13:51:25 -03:00
..
2026-06-17 19:26:32 -03:00
2026-08-26 14:25:01 -03:00
2026-06-27 09:07:12 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-06-23 17:06:18 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-06-29 16:51:03 -03:00
2026-06-27 09:07:12 -03:00
2026-05-24 18:05:58 -03:00
2026-06-17 19:26:32 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-05-26 23:51:47 -03:00
2026-06-21 08:56:51 -03:00
2026-08-26 14:25:01 -03:00
2026-05-29 12:44:29 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-05-26 23:51:47 -03:00
2026-08-26 14:25:01 -03:00
2026-05-26 23:51:47 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-06-13 17:27:40 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-07-04 13:00:30 -03:00
2026-06-29 16:51:03 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-06-26 02:51:06 -03:00
2026-07-04 13:00:30 -03:00
2026-06-27 09:07:12 -03:00
2026-08-26 14:25:01 -03:00
2026-06-19 06:49:01 -03:00
2026-08-26 14:25:01 -03:00
2026-06-19 06:49:01 -03:00
2026-08-26 14:25:01 -03:00
2026-06-29 08:40:06 -03:00
2026-06-30 06:54:29 -03:00
2026-06-09 15:56:24 -03:00
2026-05-29 19:54:00 -03:00
2026-08-26 14:25:01 -03:00
2026-06-29 16:51:03 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-06-20 07:09:43 -03:00
2026-06-19 06:49:01 -03:00
2026-06-11 04:01:24 -03:00
2026-06-29 08:40:06 -03:00
2026-05-24 18:05:58 -03:00