Current behavior: LISTEN_ADDR only applies to nginx (UI, PORT). The API/GraphQL server (server/api_server/api_server_start.py) is started with a hard-coded app.run(host="0.0.0.0", port=graphql_port, …). With LISTEN_ADDR=127.0.0.1 (typical when running behind a reverse proxy) the UI listens on loopback only, but GRAPHQL_PORT (20212) stays reachable on every interface, e.g. 0.0.0.0:20212. Access is protected by API_TOKEN, but it is unexpected and not needed: nginx already proxies to it via http://127.0.0.1:${BACKEND_PORT}.
Verified on the 26.9.0 release image and on netalertx-dev:latest (image f854bec8bc7c, revision cd1d0ed).
Proposal: Use LISTEN_ADDR for the API server as well, or add a separate variable (e.g. GRAPHQL_LISTEN_ADDR, default 0.0.0.0 so existing setups keep working). Mention it in the docs.
Workaround I use: mount a one-line patched copy of api_server_start.py (host="127.0.0.1") read-only; this breaks on image updates and has to be regenerated.
Related observation (already mentioned in #1798): on a fresh volume the GRAPHQL_PORT environment variable is not applied to the GRAPHQL_PORT setting.
Current behavior:
LISTEN_ADDRonly applies to nginx (UI,PORT). The API/GraphQL server (server/api_server/api_server_start.py) is started with a hard-codedapp.run(host="0.0.0.0", port=graphql_port, …). WithLISTEN_ADDR=127.0.0.1(typical when running behind a reverse proxy) the UI listens on loopback only, butGRAPHQL_PORT(20212) stays reachable on every interface, e.g.0.0.0.0:20212. Access is protected byAPI_TOKEN, but it is unexpected and not needed: nginx already proxies to it viahttp://127.0.0.1:${BACKEND_PORT}.Verified on the 26.9.0 release image and on
netalertx-dev:latest(image f854bec8bc7c, revision cd1d0ed).Proposal: Use
LISTEN_ADDRfor the API server as well, or add a separate variable (e.g.GRAPHQL_LISTEN_ADDR, default0.0.0.0so existing setups keep working). Mention it in the docs.Workaround I use: mount a one-line patched copy of
api_server_start.py(host="127.0.0.1") read-only; this breaks on image updates and has to be regenerated.Related observation (already mentioned in #1798): on a fresh volume the
GRAPHQL_PORTenvironment variable is not applied to theGRAPHQL_PORTsetting.