mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-13 18:32:12 +03:00
b87c92b3d7
docker-compose.yml and docker-compose.prod.yml defaulted API_HOST/LIVE_WS_HOST/ HOSTNAME to 0.0.0.0 and published the dashboard/API/live-WS ports with bare, unscoped specs, which Docker expands to every interface. Combined with REQUIRE_API_KEY=false shipping as the .env.example default, this exposed the anonymous /v1 LLM proxy to the whole LAN/WAN (#12568). The optional cliproxyapi sidecar had the same unscoped publish spec plus no forwarded auth env var, exposing a credential-bearing service the same way (#12578); qdrant and bifrost had the identical gap. Applies the existing Redis loopback-bind precedent (tests/unit/compose-redis- loopback-bind.test.ts) to the app's own ports and to cliproxyapi/qdrant/bifrost: - New APP_BIND_HOST / CLIPROXY_BIND_HOST / QDRANT_BIND_HOST / BIFROST_BIND_HOST opt-in vars, defaulting to 127.0.0.1, documented in .env.example and docs/reference/ENVIRONMENT.md. - API_HOST/LIVE_WS_HOST default to 127.0.0.1 in both compose files; the prod file no longer hardcodes HOSTNAME=0.0.0.0. - cliproxyapi now forwards CLIPROXYAPI_MANAGEMENT_KEY as MANAGEMENT_PASSWORD, the one env var the pinned image actually reads for its management API. - A new boot-time guard (src/lib/startup/nonLoopbackApiKeyGuard.ts) logs a warning — never a hard failure — when the API bridge or live-WS server ends up bound to a non-loopback host while REQUIRE_API_KEY is disabled. ⚠️ base-red inherited: #12732 — unit #12058, integration codex-cache, package-artifact, tarball-smoke, agent-skills-sync Closes #12568 Closes #12578
60 lines
2.6 KiB
TypeScript
60 lines
2.6 KiB
TypeScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import path from "node:path";
|
|
|
|
const REPO_ROOT = path.resolve(import.meta.dirname, "../..");
|
|
|
|
// The optional `cliproxyapi` sidecar (profile `cliproxyapi`) proxies provider
|
|
// credentials (its data volume is `cliproxyapi-data:/root/.cli-proxy-api`) and
|
|
// carried no auth-related environment variable in its `environment:` block.
|
|
// Docker/Podman expand an unqualified "8317:8317" publish spec to 0.0.0.0,
|
|
// which puts this credential-bearing sidecar on every LAN interface the same
|
|
// way a bare "6379:6379" would for Redis (see
|
|
// tests/unit/compose-redis-loopback-bind.test.ts, the precedent this repo
|
|
// already applied). Issue #12578.
|
|
|
|
function readCompose(file: string): string {
|
|
return fs.readFileSync(path.join(REPO_ROOT, file), "utf8");
|
|
}
|
|
|
|
test("docker-compose publishes cliproxyapi on loopback by default", () => {
|
|
const compose = readCompose("docker-compose.yml");
|
|
assert.match(
|
|
compose,
|
|
/- "\$\{CLIPROXY_BIND_HOST:-127\.0\.0\.1\}:\$\{CLIPROXYAPI_PORT:-8317\}:\$\{CLIPROXYAPI_PORT:-8317\}"/,
|
|
"cliproxyapi publish spec must default to 127.0.0.1 (matching the Redis precedent)"
|
|
);
|
|
assert.doesNotMatch(
|
|
compose,
|
|
/- "\$\{CLIPROXYAPI_PORT:-8317\}:\$\{CLIPROXYAPI_PORT:-8317\}"/,
|
|
"unqualified cliproxyapi publish spec binds 0.0.0.0"
|
|
);
|
|
});
|
|
|
|
test("cliproxyapi service forwards a management/auth key into its environment", () => {
|
|
const compose = readCompose("docker-compose.yml");
|
|
const serviceMatch = compose.match(/ {2}cliproxyapi:\n(?:.*\n)*?(?=\n {2}\S|$)/);
|
|
assert.ok(serviceMatch, "cliproxyapi service block must exist in docker-compose.yml");
|
|
assert.match(
|
|
serviceMatch![0],
|
|
/CLIPROXYAPI_MANAGEMENT_KEY/,
|
|
"cliproxyapi environment block must forward CLIPROXYAPI_MANAGEMENT_KEY (already documented in docs/reference/ENVIRONMENT.md) instead of leaving auth entirely to the upstream image's undocumented default"
|
|
);
|
|
});
|
|
|
|
test("qdrant and bifrost sidecars also publish on loopback by default", () => {
|
|
const compose = readCompose("docker-compose.yml");
|
|
assert.match(compose, /- "\$\{QDRANT_BIND_HOST:-127\.0\.0\.1\}:\$\{QDRANT_PORT:-6333\}:6333"/);
|
|
assert.match(
|
|
compose,
|
|
/- "\$\{QDRANT_BIND_HOST:-127\.0\.0\.1\}:\$\{QDRANT_GRPC_PORT:-6334\}:6334"/
|
|
);
|
|
assert.match(compose, /- "\$\{BIFROST_BIND_HOST:-127\.0\.0\.1\}:\$\{BIFROST_PORT:-8080\}:8080"/);
|
|
});
|
|
|
|
test(".env.example documents CLIPROXY_BIND_HOST and its default", () => {
|
|
const env = fs.readFileSync(path.join(REPO_ROOT, ".env.example"), "utf8");
|
|
assert.match(env, /# CLIPROXY_BIND_HOST=127\.0\.0\.1/);
|
|
});
|