server: lock to loopback (127.0.0.1) — was silently bound to 0.0.0.0 via global $HOST

adfdb2616ce9de8ce38019c888e677ac59a746aa · 2026-05-13 08:28:19 -0700 · steve

Initial app.listen(PORT, cb) defaulted to all interfaces; Steve caught
it on first review. The fix has two parts:

1. Pass explicit HOST to app.listen.
2. Use MP3_HOST (project-specific) instead of HOST. Steve's shell sets
   HOST=0.0.0.0 globally for other projects, which would have silently
   undone any 'default to 127.0.0.1' fix.

Override path preserved: MP3_HOST=0.0.0.0 npm start exposes on LAN.
Verified post-fix: netstat shows 127.0.0.1.9696 LISTEN only;
curl http://192.168.1.53:9696/ -> connection refused;
curl http://127.0.0.1:9696/ -> 200.

Files touched

M server.js

Diff

commit adfdb2616ce9de8ce38019c888e677ac59a746aa
Author: steve <steve@designerwallcoverings.com>
Date:   Wed May 13 08:28:19 2026 -0700

    server: lock to loopback (127.0.0.1) — was silently bound to 0.0.0.0 via global $HOST
    
    Initial app.listen(PORT, cb) defaulted to all interfaces; Steve caught
    it on first review. The fix has two parts:
    
    1. Pass explicit HOST to app.listen.
    2. Use MP3_HOST (project-specific) instead of HOST. Steve's shell sets
       HOST=0.0.0.0 globally for other projects, which would have silently
       undone any 'default to 127.0.0.1' fix.
    
    Override path preserved: MP3_HOST=0.0.0.0 npm start exposes on LAN.
    Verified post-fix: netstat shows 127.0.0.1.9696 LISTEN only;
    curl http://192.168.1.53:9696/ -> connection refused;
    curl http://127.0.0.1:9696/ -> 200.
---
 server.js | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/server.js b/server.js
index 75c8a4d..c98a6db 100644
--- a/server.js
+++ b/server.js
@@ -12,6 +12,11 @@ const path = require('path');
 const { spawnSync } = require('child_process');
 
 const PORT = parseInt(process.env.MP3_PORT || '9696', 10);
+// Bind to loopback only — this is a local-private tool until DNS + auth land.
+// Override with MP3_HOST=0.0.0.0 if you explicitly want LAN access.
+// We deliberately do NOT honor the global $HOST env var because Steve has it
+// set to 0.0.0.0 globally — which would silently expose this on the LAN.
+const HOST = process.env.MP3_HOST || '127.0.0.1';
 const MANIFEST_FILE = path.join(__dirname, 'manifest.json');
 
 function loadManifest() {
@@ -73,8 +78,9 @@ app.get('/healthz', (_req, res) => {
   });
 });
 
-app.listen(PORT, () => {
-  console.log(`\n  mp3-agentabrams :: http://127.0.0.1:${PORT}`);
+app.listen(PORT, HOST, () => {
+  console.log(`\n  mp3-agentabrams :: http://${HOST}:${PORT}`);
   console.log(`  serving ${manifest.count} mp3 entries`);
-  console.log(`  manifest generated ${manifest.generatedAt}\n`);
+  console.log(`  manifest generated ${manifest.generatedAt}`);
+  console.log(`  bound to ${HOST} — ${HOST === '127.0.0.1' ? 'LOOPBACK ONLY (Mac-local, no LAN exposure)' : 'EXPOSED on this interface'}\n`);
 });

← 6a16909 initial: mp3-agentabrams — grid+list of every MP3 on Mac2 · back to Mp3 Agentabrams · launchd: two opt-in plists for reboot-survival + tailscale a 066f365 →