Listen on 0.0.0.0:6876 through cli #31249
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
At the moment, we're exposing the default DB port 6876 only to localhost, but the internal one to all addresses. This makes it difficult to test the console locally because it needs access to 6876, and running it on the host's network can cause other port collisions. For this reason, open up connections to 6876 to all hosts. This is not a security regression as we're already opening the internal endpoint to all addresses. Signed-off-by: Moritz Hoffmann <[email protected]>
benesch
reviewed
Jan 30, 2025
There was a problem hiding this comment.
Seems fine to me, but deferring to @def- who defaulted these to bind to 127.0.0.1 in the first place. Perhaps we should just wholesale roll that change back? If 6876 and 6878 are exposed, there's no security benefit to leaving 6875 and 6877 closed.
def-
approved these changes
Jan 30, 2025
teskje
reviewed
Jan 31, 2025
Comment on lines
277
to
279
| # Setting the listen addresses below to 0.0.0.0 is required | ||
| # to allow Prometheus running in Docker (misc/prometheus) | ||
| # access these services to scrape metrics. |
There was a problem hiding this comment.
Maybe adjust the comment too? Otherwise someone might in the future realize that Prometheus only needs 6878 and revert the change.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
At the moment, we're exposing the default DB port 6876 only to localhost,
but the internal one to all addresses. This makes it difficult to test the
console locally because it needs access to 6876, and running it on the
host's network can cause other port collisions.
For this reason, open up connections to 6876 to all hosts. This is not a
security regression as we're already opening the internal endpoint to all
addresses.
Checklist
$T ⇔ Proto$Tmapping (possibly in a backwards-incompatible way), then it is tagged with aT-protolabel.