From c9b935f8424df48a27467097880f79b7211e6f09 Mon Sep 17 00:00:00 2001 From: Christian Johannesen Date: Wed, 28 Oct 2026 11:29:57 +0100 Subject: [PATCH] Allow LAN tunnel access to the web entrypoint --- README.md | 2 +- compose.yaml | 2 +- docs/DEPLOYMENT.md | 6 +++++- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 9bd6b78..616e5cd 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ docker compose ps curl -fsS http://localhost:8155/health ``` -Open http://localhost:8155. Only the web entrypoint is published, bound to loopback. API and PostgreSQL stay on the Compose network. The one-shot bootstrap service applies transaction-locked, tracked migrations, then seeds the sandbox owner/catalog and 100 deterministic demo plants. Repeat runs do not duplicate or overwrite plants. A named volume retains your collection across `docker compose down` / `up`. Do not use `down -v` unless intentionally deleting all saved data. +Open http://localhost:8155. Only the web entrypoint is published. It binds to all host interfaces by default so the configured Cloudflare tunnel can reach `http://192.168.1.197:8155`; set `HOST_BIND=127.0.0.1` in the deployment environment for loopback-only access. API and PostgreSQL stay on the Compose network. The one-shot bootstrap service applies transaction-locked, tracked migrations, then seeds the sandbox owner/catalog and 100 deterministic demo plants. Repeat runs do not duplicate or overwrite plants. A named volume retains your collection across `docker compose down` / `up`. Do not use `down -v` unless intentionally deleting all saved data. ## Explore diff --git a/compose.yaml b/compose.yaml index 16bd6a3..cd1b530 100644 --- a/compose.yaml +++ b/compose.yaml @@ -4,7 +4,7 @@ services: build: context: . dockerfile: apps/web/Dockerfile - ports: ["127.0.0.1:${HOST_PORT:-8155}:8080"] + ports: ["${HOST_BIND:-0.0.0.0}:${HOST_PORT:-8155}:8080"] depends_on: api: condition: service_healthy diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md index 01f08e9..ad5a6e6 100644 --- a/docs/DEPLOYMENT.md +++ b/docs/DEPLOYMENT.md @@ -51,4 +51,8 @@ The seed now creates exactly 100 fixed-ID demonstration specimens, including the Run the isolated acceptance database with `npm run test:integration`, then `docker compose -f compose.test.yaml down`. That Compose project uses a tmpfs database, no persistent volume and no published ports. It neither resets nor connects to the application's named volume. The deliberate rollback test logs an expected PostgreSQL exception while checking that the API returns only a safe generic response. -API examples and cursor/idempotency contracts are documented in `docs/API_EXAMPLES.md`. Before any public deployment add real identity, owner authorization, rate limits, TLS/access controls and operational backup/restore checks. The current published address remains loopback-only. Future game scope is documented in `docs/ROADMAP.md` and is not implemented. +API examples and cursor/idempotency contracts are documented in `docs/API_EXAMPLES.md`. Before any public deployment add real identity, owner authorization, rate limits, TLS/access controls and operational backup/restore checks. The original milestone deployment used loopback-only publication; see the LAN tunnel configuration below for the current binding. Future game scope is documented in `docs/ROADMAP.md` and is not implemented. + +## LAN tunnel configuration — 2026-10-28 + +The owner configured botanica.p20.dev to use origin http://192.168.1.197:8155. Web publication therefore uses ${HOST_BIND:-0.0.0.0}:${HOST_PORT:-8155}:8080 so the tunnel can reach the host over LAN. HOST_BIND can be set to 127.0.0.1 for loopback-only access. API and PostgreSQL remain unpublished. HOST_PORT=8155 and PUBLIC_DOMAIN=http://localhost in .env were preserved; PUBLIC_DOMAIN is not a hostname allowlist.