Iuliia Ivashko
dc100ed0da
## Summary Fixes #736 — OpenChamber listens on `0.0.0.0` (all interfaces) by default, exposing the server to the network without warning. The log output shows `visit: http://127.0.0.1:...` which is misleading. ## Changes - **Default bind address changed to `127.0.0.1`** — server is only accessible locally unless explicitly configured otherwise - **New `--host` CLI flag** — `openchamber --host 0.0.0.0 -p 8080` to listen on all interfaces - **`OPENCHAMBER_HOST` env var** — documented in help text and docker-compose.yml as an alternative to `--host` - **Docker entrypoint** defaults to `OPENCHAMBER_HOST=0.0.0.0` so container port mapping continues to work - **Startup logs** show the actual bind address instead of hardcoded `localhost` ### Resolution priority ``` --host flag > OPENCHAMBER_HOST env var > 127.0.0.1 (default) ``` ### What doesn't break - **Desktop app** — already forces `OPENCHAMBER_HOST=127.0.0.1` via Tauri - **VS Code extension** — doesn't use the web server - **Docker** — entrypoint sets `OPENCHAMBER_HOST=0.0.0.0`, preserving current behavior - **Tunnels** — cloudflared connects to `127.0.0.1` origin internally, works regardless of bind address ## Testing Automated: - `bun run type-check` / `bun run lint` — pass Manual (CLI, direct `node` execution): - Default bind → `127.0.0.1` (verified via `lsof`/netstat) - `--host 0.0.0.0` → binds all interfaces - `--host=0.0.0.0` (inline) → works - `--host` without value → error exit 2 - `OPENCHAMBER_HOST` env var → respected - `--host` flag overrides env var - IPv6 `::1` → correct bracketed URL, health check 200 - CLI daemon start/stop → works - `visit:` URL → correct - Help text → `--host` in OPTIONS, `OPENCHAMBER_HOST` in ENVIRONMENT - Browser UI → loads and works - Tunnel via UI → works - Desktop app → no regression Docker (tested on Ubuntu with native Docker): - SSH key generated successfully - `OpenChamber server listening on 0.0.0.0:3000` - Health check 200 - `uid=1000(openchamber)` confirmed
75 lines
2.1 KiB
Bash
75 lines
2.1 KiB
Bash
#!/usr/bin/env sh
|
|
set -eu
|
|
|
|
HOME="/home/openchamber"
|
|
|
|
OPENCODE_CONFIG_DIR="${OPENCODE_CONFIG_DIR:-${HOME}/.config/opencode}"
|
|
export OPENCODE_CONFIG_DIR
|
|
|
|
SSH_DIR="${HOME}/.ssh"
|
|
SSH_PRIVATE_KEY_PATH="${SSH_DIR}/id_ed25519"
|
|
SSH_PUBLIC_KEY_PATH="${SSH_PRIVATE_KEY_PATH}.pub"
|
|
|
|
mkdir -p "${SSH_DIR}"
|
|
if ! chmod 700 "${SSH_DIR}" 2>/dev/null; then
|
|
echo "[entrypoint] warning: cannot chmod ${SSH_DIR}, continuing with existing permissions"
|
|
fi
|
|
|
|
if [ ! -f "${SSH_PRIVATE_KEY_PATH}" ] || [ ! -f "${SSH_PUBLIC_KEY_PATH}" ]; then
|
|
if [ ! -w "${SSH_DIR}" ]; then
|
|
echo "[entrypoint] error: ssh key missing and ${SSH_DIR} is not writable" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "[entrypoint] generating SSH key..."
|
|
ssh-keygen -t ed25519 -N "" -f "${SSH_PRIVATE_KEY_PATH}" >/dev/null
|
|
fi
|
|
|
|
if ! chmod 600 "${SSH_PRIVATE_KEY_PATH}" 2>/dev/null; then
|
|
echo "[entrypoint] warning: cannot chmod ${SSH_PRIVATE_KEY_PATH}, continuing"
|
|
fi
|
|
|
|
if ! chmod 644 "${SSH_PUBLIC_KEY_PATH}" 2>/dev/null; then
|
|
echo "[entrypoint] warning: cannot chmod ${SSH_PUBLIC_KEY_PATH}, continuing"
|
|
fi
|
|
|
|
echo "[entrypoint] SSH public key:"
|
|
cat "${SSH_PUBLIC_KEY_PATH}"
|
|
|
|
# Handle UI password environment variable
|
|
if [ -n "${UI_PASSWORD:-}" ]; then
|
|
echo "[entrypoint] UI password set, enabling authentication"
|
|
fi
|
|
|
|
if [ "${OH_MY_OPENCODE:-false}" = "true" ]; then
|
|
OMO_CONFIG_FILE="${OPENCODE_CONFIG_DIR}/oh-my-opencode.json"
|
|
|
|
if [ ! -f "${OMO_CONFIG_FILE}" ]; then
|
|
echo "[entrypoint] npm installing oh-my-opencode..."
|
|
npm install -g oh-my-opencode
|
|
|
|
OMO_INSTALL_ARGS="--no-tui --claude=no --openai=no --gemini=no --copilot=no --opencode-zen=no --zai-coding-plan=no --kimi-for-coding=no --skip-auth"
|
|
|
|
echo "[entrypoint] oh-my-opencode installing..."
|
|
oh-my-opencode install ${OMO_INSTALL_ARGS}
|
|
fi
|
|
fi
|
|
|
|
# Docker containers need to listen on all interfaces for port mapping to work.
|
|
OPENCHAMBER_HOST="${OPENCHAMBER_HOST:-0.0.0.0}"
|
|
export OPENCHAMBER_HOST
|
|
|
|
echo "[entrypoint] starting..."
|
|
|
|
if [ "$#" -gt 0 ]; then
|
|
exec "$@"
|
|
fi
|
|
|
|
set -- bun packages/web/bin/cli.js
|
|
if [ -n "${UI_PASSWORD:-}" ]; then
|
|
set -- "$@" --ui-password "$UI_PASSWORD"
|
|
fi
|
|
"$@"
|
|
|
|
exec bun packages/web/bin/cli.js logs
|