mirror of
https://github.com/Routstr/routstrd.git
synced 2026-08-12 04:53:21 +00:00
redshift
df226dfa90
The daemon was binding to all network interfaces (0.0.0.0) by default because server.listen(port) without a host argument listens on all interfaces in Node.js. This exposed unauthenticated endpoints (/balance, /status, /providers, /wallet/balance, etc.) to anyone who could reach the port. Changes: - Add 'host' field to RoutstrdConfig (default: 127.0.0.1) - Add --host CLI flag to 'start' and 'restart' commands - Add ROUTSTRD_HOST env var support in parseArgs - Pass host to server.listen(port, host, callback) - Add startup warning when bound to 0.0.0.0 - Update getDaemonBaseUrl to use config.host (with 0.0.0.0 -> localhost fallback for client connections since 0.0.0.0 is not connectable) - Update start-daemon.ts health checks to use the correct host - Pass host through all startDaemon() call sites in cli.ts - Document --host flag, config field, and security implications in README Closes ROUTSTRD-BIND-ADDRESS