fix(dev): bind dx serve to a private LAN IP only #377

Closed

David wants to merge 0 commits from fix/dev-bind-private-ip into main

David commented

2026-06-28 23:09:06 +02:00

Owner

The just dev recipe discovered the host br0/eth0 IPv4 and bound dx serve (port 4301) to it. On this host br0 carries a public address, so the dev frontend was published on the internet. A sibling stack exposed the same way had its Postgres compromised by the PG_MEM botnet.

Discovery now keeps only RFC1918 (private) addresses and falls back to 127.0.0.1 with a warning when the only candidate is public, so dx serve can never be published on a public interface. The dev-sso path already forced HOST_IP=127.0.0.1 and is unchanged.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

The `just dev` recipe discovered the host br0/eth0 IPv4 and bound dx serve (port 4301) to it. On this host br0 carries a public address, so the dev frontend was published on the internet. A sibling stack exposed the same way had its Postgres compromised by the PG_MEM botnet. Discovery now keeps only RFC1918 (private) addresses and falls back to 127.0.0.1 with a warning when the only candidate is public, so dx serve can never be published on a public interface. The dev-sso path already forced HOST_IP=127.0.0.1 and is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

David added 1 commit

2026-06-28 23:09:06 +02:00

fix(dev): bind dx serve to a private LAN IP only

Check / clippy + fmt + tests (pull_request) Successful in 1m42s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

00aed27f5a

The `just dev` recipe discovered the host br0/eth0 IPv4 and bound dx serve (port 4301) to it. On this host br0 carries a public address, so the dev frontend was published on the internet. A sibling stack exposed the same way had its Postgres compromised by the PG_MEM botnet.

Discovery now keeps only RFC1918 (private) addresses and falls back to 127.0.0.1 with a warning when the only candidate is public, so dx serve can never be published on a public interface. The dev-sso path already forced HOST_IP=127.0.0.1 and is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>