feat: default BIND_HOST to loopback so the dashboard is not LAN-exposed - #35
Closed
im0xMagnus wants to merge 1 commit into
Closed
feat: default BIND_HOST to loopback so the dashboard is not LAN-exposed#35im0xMagnus wants to merge 1 commit into
im0xMagnus wants to merge 1 commit into
Conversation
The dashboard is unauthenticated and ships SSH exec plus shutdown-all and Wake-on-LAN, but the server defaulted to 0.0.0.0 — exposing those controls on every LAN interface for bare-metal `npm start` users. Default BIND_HOST to 127.0.0.1, warn at startup when bound to a non-loopback address, and document opting in to the LAN. Docker is unaffected: docker-compose.yml sets BIND_HOST=0.0.0.0 explicitly, so this only changes the unset-env default.
Owner
|
Landed on This was the right call: the dashboard is unauthenticated and can SSH / shutdown-all, so What went in:
Docker is unchanged: Closing rather than merging the branch — CHANGELOG / README / |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The dashboard is unauthenticated (
server/validate.jscalls it "an otherwise unauthenticated LAN dashboard") and ships SSH exec,shutdown-all(passwordless-sudo power-off), and Wake-on-LAN. It defaulted toBIND_HOST=0.0.0.0, so a bare-metalnpm startexposed all of that on every LAN interface — anyone on the network could power off every Spark, unauthenticated. This defaults the bind to loopback instead.What changed
server/index.js:BIND_HOSTdefaults to127.0.0.1(was0.0.0.0); startup now warns when bound to a non-loopback address.README.md,.env.example,CHANGELOG.mdupdated.Non-breaking for Docker
docker-compose.ymlalready setsBIND_HOST=0.0.0.0explicitly (network_mode: host), so this only changes behaviour when the env var is unset — i.e. bare-metalnpm start.Migration
If you access sparkDash from another machine via bare-metal
npm start, setBIND_HOSTto the host's LAN IP (or0.0.0.0). Documented in README +.env.example+ the CHANGELOG entry.Notes
[Unreleased]CHANGELOG section.docker:devstill reaches the dashboard via Vite:5173(bound0.0.0.0) proxying to the now-loopback API; this hardens the prod /npm startserver bind, not the dev Vite port.BIND_HOSTresolution is an import-time side-effect with no bootstrap test harness (matches existing conventions).