Wanjohi b00f1064ae fix(api,auth)!: bind loopback by default, and let a container ask for more ...

Both servers bound `0.0.0.0`. That was harmless while the only deployment was
docker-compose.yml, which publishes these ports on 127.0.0.1 and makes the
container's own bind irrelevant. As ordinary processes on a rented machine
there is no such wrapper, and `0.0.0.0` is a listener on the internet — in
front of an issuer that sets cookies without `Secure` and mints sign-in codes,
because it expects something else to be terminating TLS.

So the default is `127.0.0.1` and `HOST` is there for the deployment that
genuinely needs every interface. compose now sets `HOST: 0.0.0.0` explicitly,
which is not a workaround: inside a container, binding loopback is what would
make the published port unreachable. The right answer differs by deployment,
which is why it is a variable rather than a constant.

Both now log the address they bound, not the one they hoped for.

BREAKING CHANGE: api and auth no longer listen on every interface by default.
A deployment that relied on that must set HOST=0.0.0.0.

2026-09-16 23:10:22 +03:00

..

middleware

feat(machine): record where a host can be reached, as the host reports it

2026-09-06 23:44:37 +03:00

routes

fix(machine): a taken endpoint id is a conflict, not a server fault

2026-09-07 00:19:34 +03:00

utils

feat: Sync to OSS repo

2026-08-06 22:13:51 +03:00

index.ts

feat(api): record which host holds a Steam token for whom

2026-09-06 13:27:51 +03:00

server.ts

fix(api,auth)!: bind loopback by default, and let a container ask for more

2026-09-16 23:10:22 +03:00