gitops/optimclaw
1
0
Fork 0
mirror of https://github.com/outbackdingo/optimclaw.git synced 2026-08-27 08:00:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): default webhook server to loopback when tunnel is configured (#1194)

Browse Source 
When a tunnel provider (ngrok, cloudflare, tailscale, etc.) or static
TUNNEL_URL is configured, external traffic arrives through the tunnel,
so binding 0.0.0.0 is unnecessary attack surface. The webhook server
now defaults to 127.0.0.1 when a tunnel is active. Explicit HTTP_HOST
still overrides the default in all cases.

Co-authored-by: Claude Opus 4.6 <[email protected]>
This commit is contained in:
Illia Polosukhin
2026-03-15 20:38:02 +00:00
committed by GitHub
co-authored by Claude Opus 4.6
parent e0f393bf04
commit 6aaa89010a
3 changed files with 91 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cli/doctor.rs
+4 -1
View File
@@ -405,7 +405,10 @@ fn check_routines_config() -> CheckResult {
fn check_gateway_config(settings: &Settings) -> CheckResult {
// Use the same resolve() path as runtime so invalid env values
// (e.g. GATEWAY_PORT=abc) are caught here too.
match crate::config::ChannelsConfig::resolve(settings) {
let tunnel_enabled = crate::config::TunnelConfig::resolve(settings)
.map(|t| t.is_enabled())
.unwrap_or(false);
match crate::config::ChannelsConfig::resolve(settings, tunnel_enabled) {
Ok(channels) => match channels.gateway {
Some(gw) => {
if gw.auth_token.is_some() {