feat(docker): configurable host bind address for kg-api and kg-web - #547
Open
theja0143 wants to merge 1 commit into
Open
feat(docker): configurable host bind address for kg-api and kg-web#547theja0143 wants to merge 1 commit into
theja0143 wants to merge 1 commit into
Conversation
aaronsb#502 bound postgres (5432) and garage (3900/3903) to 127.0.0.1, on the rationale that the API and operator reach them over the docker network and the host publish is only for local tooling. kg-api (8000) and kg-web (3000) were left on 0.0.0.0 — reasonably so: unlike postgres and garage, they are browser-facing and may legitimately need to be reachable off-box, so a hard loopback would break that. But that leaves single-box installs (a local dev setup, or WSL, where the browser and the API share a host) publishing an API and a web UI on every interface with no way to opt out short of patching the compose file — which then collides on every pull. So make the bind address configurable rather than choosing for the operator: - "${KG_API_BIND:-0.0.0.0}:8000:8000" - "${KG_WEB_BIND:-0.0.0.0}:3000:80" The default is 0.0.0.0 — current behaviour, byte-for-byte unchanged, nothing breaks for anyone who does need LAN access. Operators who don't can set KG_API_BIND=127.0.0.1 / KG_WEB_BIND=127.0.0.1 in .env and get the same treatment aaronsb#502 gave the backend services. The ${VAR:-default} idiom is already used throughout this compose file. Verified with `docker compose config`: * unset -> kg-api/kg-web host_ip 0.0.0.0 (postgres/garage 127.0.0.1) * both = 127.0.0.1 -> all five services host_ip 127.0.0.1 Documented under a new "Host Port Bind Addresses" section in .env.example.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
#502 bound postgres (5432) and garage (3900/3903) to
127.0.0.1, on the rationale that the API and operator reach them over the docker network, so the host publish is only for local tooling.kg-api(8000) andkg-web(3000) were left on0.0.0.0— and reasonably so. Unlike postgres and garage, they are browser-facing, and may legitimately need to be reachable from another machine. Hard-coding them to loopback would break that, which I assume is exactly why #502 stopped where it did.But that leaves single-box installs — a local dev setup, or WSL, where the browser and the API share a host — publishing an API and a web UI on every interface, with no way to opt out short of patching
docker-compose.yml. That patch then collides on every pull, and resolving the collision the wrong way silently re-widens the ports again.Change
Make the bind address configurable instead of choosing for the operator:
The default is
0.0.0.0— current behaviour, unchanged. Nothing breaks for anyone who needs off-box access. Operators who don't can setKG_API_BIND=127.0.0.1/KG_WEB_BIND=127.0.0.1in.envand get the same treatment #502 gave the backend services.The
${VAR:-default}idiom is already used ~19 times in this compose file, so this doesn't introduce a new pattern.Verification
Via
docker compose -f docker/docker-compose.yml config:host_iphost_ip0.0.0.00.0.0.0127.0.0.1KG_API_BIND=127.0.0.1 KG_WEB_BIND=127.0.0.1127.0.0.1127.0.0.1127.0.0.1So the default path resolves byte-for-byte to today's behaviour, and the opt-in brings all five published ports onto loopback.
Also
New Host Port Bind Addresses section in
.env.exampledocumenting both knobs and stating the default explicitly.Context, in the interest of being upfront: I run this project as a local, loopback-only knowledge substrate for another codebase, and have been carrying a local patch that hard-binds these two ports. This PR is the upstream-shaped version of that patch — configurable rather than imposed — so I can drop the local carry. Happy to adjust naming (
KG_API_BINDvs something else) or drop the.env.exampleprose if you'd rather keep it lean.