Maniacs_Mansion/NestQuest
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bind the API port to a configurable LAN address for the reverse proxy

Browse Source 
Publish port 8080 on ${NESTQUEST_BIND_ADDRESS:-127.0.0.1} so the shared
Traefik proxy (TLS for nestquest.cubecraftlabs.com) can reach the API
box, while an unconfigured deployment stays localhost-only. Document the
variable in deploy/.env.example and the production topology in
api/README.md.

Maestro task 9d121e76-e1ce-479f-aef5-0e5e9756fda8.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
overseer
2026-09-24 07:52:47 -04:00
co-authored by Claude Opus 5.5
parent 859737faec
commit 3321a70ffd
3 changed files with 26 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/README.md
+10 -2
View File
@@ -27,6 +27,14 @@ Run it with compose — the SQLite file lives on the named volume
``deploy/.env`` is git-ignored and supplies the secrets (panel service
token, Authentik OIDC settings); ``NESTQUEST_DB_PATH`` is fixed to
``/var/lib/nestquest/nestquest.db`` by compose. The port is bound to
localhost only — TLS/reverse proxy, Authentik, network separation,
``/var/lib/nestquest/nestquest.db`` by compose.
The published port binds ``NESTQUEST_BIND_ADDRESS`` from
``deploy/.env`` and defaults to ``127.0.0.1`` (localhost only). In
production TLS is terminated by the shared Traefik reverse proxy,
which serves ``https://nestquest.cubecraftlabs.com`` (Let's Encrypt,
auto-renewed, HTTP redirected to HTTPS) and forwards to the API box
on port 8080 — so on that box set ``NESTQUEST_BIND_ADDRESS`` to its
LAN address (``10.60.1.14``). Traefik only allows
``/api/v1/panel`` from the Home Assistant host. Network separation,
backup and restore are later Feature 17 tasks.