From 3321a70ffd06ed06c4fa666de30b89700da8cdf9 Mon Sep 17 00:00:00 2001 From: Joshua Date: Thu, 24 Sep 2026 07:52:47 -0400 Subject: [PATCH] Bind the API port to a configurable LAN address for the reverse proxy Publish port 8080 on ${NESTQUEST_BIND_ADDRESS:-127.0.0.1} so the shared Traefik proxy (TLS for nestquest.cubecraftlabs.com) can reach the API box, while an unconfigured deployment stays localhost-only. Document the variable in deploy/.env.example and the production topology in api/README.md. Maestro task 9d121e76-e1ce-479f-aef5-0e5e9756fda8. Co-Authored-By: Claude Opus 5.5 --- api/README.md | 12 ++++++++++-- deploy/.env.example | 8 +++++++- deploy/compose.yaml | 13 +++++++++---- 3 files changed, 26 insertions(+), 7 deletions(-) diff --git a/api/README.md b/api/README.md index 376da9d..6feb6d1 100644 --- a/api/README.md +++ b/api/README.md @@ -27,6 +27,14 @@ Run it with compose — the SQLite file lives on the named volume ``deploy/.env`` is git-ignored and supplies the secrets (panel service token, Authentik OIDC settings); ``NESTQUEST_DB_PATH`` is fixed to -``/var/lib/nestquest/nestquest.db`` by compose. The port is bound to -localhost only — TLS/reverse proxy, Authentik, network separation, +``/var/lib/nestquest/nestquest.db`` by compose. + +The published port binds ``NESTQUEST_BIND_ADDRESS`` from +``deploy/.env`` and defaults to ``127.0.0.1`` (localhost only). In +production TLS is terminated by the shared Traefik reverse proxy, +which serves ``https://nestquest.cubecraftlabs.com`` (Let's Encrypt, +auto-renewed, HTTP redirected to HTTPS) and forwards to the API box +on port 8080 — so on that box set ``NESTQUEST_BIND_ADDRESS`` to its +LAN address (``10.60.1.14``). Traefik only allows +``/api/v1/panel`` from the Home Assistant host. Network separation, backup and restore are later Feature 17 tasks. \ No newline at end of file diff --git a/deploy/.env.example b/deploy/.env.example index ee27088..6c117b5 100644 --- a/deploy/.env.example +++ b/deploy/.env.example @@ -14,4 +14,10 @@ NESTQUEST_PANEL_TOKEN= # The Authentik OIDC settings the admin plane verifies JWTs against. NESTQUEST_OIDC_ISSUER= NESTQUEST_OIDC_AUDIENCE= -NESTQUEST_OIDC_JWKS_URL= \ No newline at end of file +NESTQUEST_OIDC_JWKS_URL= + +# The host interface the API's port 8080 is published on (compose +# interpolation, not read by the API). Defaults to 127.0.0.1 when +# unset; on the API box set the LAN address the reverse proxy +# forwards to, e.g. 10.60.1.14. +NESTQUEST_BIND_ADDRESS= diff --git a/deploy/compose.yaml b/deploy/compose.yaml index ea2be77..fd0cf3d 100644 --- a/deploy/compose.yaml +++ b/deploy/compose.yaml @@ -7,9 +7,14 @@ # path here, and the secret values (panel service token, Authentik # OIDC settings) from ``deploy/.env`` — a git-ignored file you create # from ``deploy/.env.example`` (placeholder names only; never commit -# real values). TLS/reverse proxy, Authentik wiring and network -# separation are later Feature 17 tasks; the port is bound to -# localhost only until those land. +# real values). +# +# TLS is terminated by the shared Traefik reverse proxy on another +# host, which forwards to this service on port 8080. The published +# port binds NESTQUEST_BIND_ADDRESS (read from deploy/.env, the +# project directory's env file): it defaults to 127.0.0.1 so an +# unconfigured deployment is never exposed; set it to the host's LAN +# address on the API box so the proxy can reach it. services: api: build: @@ -19,7 +24,7 @@ services: init: true restart: unless-stopped ports: - - "127.0.0.1:8080:8080" + - "${NESTQUEST_BIND_ADDRESS:-127.0.0.1}:8080:8080" environment: # The SQLite file inside the named volume; fixed, not a secret. NESTQUEST_DB_PATH: /var/lib/nestquest/nestquest.db