vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

c0re: bind dashboard to 127.0.0.1 only (#652)

Browse source
This commit is contained in:
damocles 2026-05-30 19:29:27 +02:00 • committed by Mara
commit c5d466c5c5
2 changed files with 26 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

11
hive-c0re/src/dashboard.rs
View file

@ -92,9 +92,16 @@ pub async fn serve(port: u16, coord: Arc<Coordinator>) -> Result<()> {
// /static/dashboard.css → dist/static/dashboard.css, etc.).
.fallback_service(ServeDir::new(&static_dir))
.with_state(AppState { coord });
let addr = SocketAddr::from(([0, 0, 0, 0], port));
// Bind loopback-only (#652). External access funnels through
// hive-gateway (in-host-netns nginx container), which proxies
// `/` → `127.0.0.1:<dashboardPort>` upstream. Operators who opt
// out of the gateway lose remote dashboard access — that's by
// design; the c0re HTTP surface is privileged (approve / deny /
// destroy, etc.) and any external exposure needs to pass through
// a real reverse proxy with auth.
let addr = SocketAddr::from(([127, 0, 0, 1], port));
let listener = bind_with_retry(addr).await?;
tracing::info!(%port, "dashboard listening");
tracing::info!(%addr, "dashboard listening");
axum::serve(listener, app).await?;
Ok(())
}