9a5c160b39
Co: operator-ui (18180:8080) bindowal na 0.0.0.0, wiec /action/mutate (brak autoryzacji, moze przenosic akcje do "approved") byl osiagalny z publicznego internetu. Fix stosuje istniejacy wzorzec repo (TAILSCALE_BIND_IP env var, patrz fleet-prometheus/llm-gateway/gokapi) + dual-bind jak w ollama (127.0.0.1 obok TAILSCALE_BIND_IP), bo node-agent na VPS laczy sie z network_mode: host przez localhost:18180/summary. Nie ruszono operator_ui.py / mutate_action — auth to osobny temat.
14 lines
715 B
Plaintext
14 lines
715 B
Plaintext
# Copy to .env next to docker-compose.yml (gitignored); docker compose picks
|
|
# it up automatically. Same convention as services/fleet-prometheus,
|
|
# services/llm-gateway, services/gokapi, services/ollama.
|
|
|
|
# Tailscale IP of the VPS node. The operator-ui port (18180) is published as
|
|
# ${TAILSCALE_BIND_IP}:18180:8080 so the mesh-facing bind is never 0.0.0.0.
|
|
# Verify when rebuilding the host: tailscale ip -4.
|
|
#
|
|
# WARNING (same footgun as fleet-prometheus, see its README): if .env is
|
|
# missing at deploy time, Compose resolves this to an empty string and
|
|
# SILENTLY binds to 0.0.0.0 instead of failing — always confirm with
|
|
# `docker compose config | grep host_ip` before `up -d`.
|
|
TAILSCALE_BIND_IP=100.95.58.48
|