fix(extensions): bind community extension ports via ${BIND_ADDRESS}

Twenty-nine community extensions in resources/dev/extensions-library/
hardcoded `127.0.0.1:` on `ports:` entries, so setting BIND_ADDRESS=0.0.0.0
(via --lan flag, dashboard network-mode toggle, or .env) only exposed
core services to the LAN. Community extensions remained loopback-only
regardless of user intent.

Rewrite 35 port-lines across 29 files to use the established pattern
from PR #964:
  before: "127.0.0.1:${EXT_PORT:-NNNN}:NNNN"
  after:  "${BIND_ADDRESS:-127.0.0.1}:${EXT_PORT:-NNNN}:NNNN"

Default behaviour unchanged (loopback by default; user opt-in via
BIND_ADDRESS=0.0.0.0 now works correctly). Healthcheck URLs inside
`healthcheck:` blocks are intentionally preserved — those are
container-internal loopback and should stay literal.

Add tests/test-bind-address-sweep.sh to prevent regression, wired
into the `test:` target of dream-server/Makefile (and inherited by
`gate:` via `gate: lint test bats smoke simulate`).

Author: yasinBursali

dream-server/Makefile

@@ -33,6 +33,9 @@ test: ## Run unit and contract tests
 	@echo "=== Overlay/plist contracts ==="
 	@bash tests/contracts/test-overlay-map-coherence.sh
 	@bash tests/contracts/test-plist-log-paths.sh
+	@echo ""
+	@echo "=== Bind address sweep ==="
+	@bash tests/test-bind-address-sweep.sh
 
 bats: ## Run BATS unit tests for shell libraries
 	@echo "=== BATS unit tests ==="

dream-server/tests/test-bind-address-sweep.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+# ============================================================================
+# Test: community extensions port-binding sweep
+# ============================================================================
+# Regression guard for PR #964 follow-up: every community extension compose
+# file under resources/dev/extensions-library/services/ must bind its host
+# ports via ${BIND_ADDRESS:-127.0.0.1} — never a bare "127.0.0.1:" literal.
+# A hard-coded 127.0.0.1 defeats the --lan / dashboard opt-in that flips
+# BIND_ADDRESS to 0.0.0.0.
+#
+# Scope: ports: list entries only. healthcheck: blocks reference 127.0.0.1
+# as container-internal loopback and are excluded.
+#
+# Usage: bash tests/test-bind-address-sweep.sh
+# ============================================================================
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+REPO_ROOT="$(cd "$ROOT_DIR/.." && pwd)"
+
+EXT_DIR="$REPO_ROOT/resources/dev/extensions-library/services"
+
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+NC='\033[0m'
+
+if [[ ! -d "$EXT_DIR" ]]; then
+    echo -e "  ${RED}FAIL${NC} community extensions directory missing: $EXT_DIR"
+    exit 1
+fi
+
+# Match lines that start a ports entry with a literal 127.0.0.1, quoted or not.
+# Healthcheck URLs live on `test:` lines and never start with `- "127.0.0.1:`
+# or `- 127.0.0.1:`, so this pattern is specific to ports: entries.
+OFFENDERS="$(grep -REn '^\s*-\s*"?127\.0\.0\.1:' "$EXT_DIR" --include='compose.yaml' || true)"
+
+if [[ -n "$OFFENDERS" ]]; then
+    echo -e "  ${RED}FAIL${NC} community extensions still bind to literal 127.0.0.1 in ports:"
+    echo "$OFFENDERS"
+    echo ""
+    echo "  Use the BIND_ADDRESS pattern instead, e.g.:"
+    echo '    - "${BIND_ADDRESS:-127.0.0.1}:${EXT_PORT:-NNNN}:NNNN"'
+    exit 1
+fi
+
+echo -e "  ${GREEN}PASS${NC} no literal 127.0.0.1 ports bindings in community extensions"
+exit 0

resources/dev/extensions-library/services/anythingllm/compose.yaml

@@ -27,7 +27,7 @@ services:
     volumes:
       - ./data/anythingllm:/app/server/storage:rw
     ports:
-      - "127.0.0.1:${ANYTHINGLLM_PORT:-7800}:3001"
+      - "${BIND_ADDRESS:-127.0.0.1}:${ANYTHINGLLM_PORT:-7800}:3001"
     healthcheck:
       test: ["CMD", "curl", "-sf", "http://127.0.0.1:3001/api/health"]
       interval: 30s

resources/dev/extensions-library/services/audiocraft/compose.yaml

@@ -14,7 +14,7 @@ services:
       - ./data/audiocraft:/app/outputs:rw
       - ./data/audiocraft/models:/root/.cache/audiocraft:rw
     ports:
-      - "127.0.0.1:${AUDIOCRAFT_PORT:-7863}:7860"
+      - "${BIND_ADDRESS:-127.0.0.1}:${AUDIOCRAFT_PORT:-7863}:7860"
     healthcheck:
       test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:7860/"]
       interval: 30s

resources/dev/extensions-library/services/bark/compose.yaml

@@ -8,7 +8,7 @@ services:
     security_opt:
       - no-new-privileges:true
     ports:
-      - "127.0.0.1:${BARK_PORT:-9200}:9200"
+      - "${BIND_ADDRESS:-127.0.0.1}:${BARK_PORT:-9200}:9200"
     environment:
       # Use small models (faster, less VRAM) — set to false for full quality
       - SUNO_USE_SMALL_MODELS=${BARK_USE_SMALL_MODELS:-false}

resources/dev/extensions-library/services/baserow/compose.yaml

@@ -35,7 +35,7 @@ services:
     volumes:
       - ./data/baserow:/baserow/data:rw
     ports:
-      - "127.0.0.1:${BASEROW_PORT:-3007}:80"
+      - "${BIND_ADDRESS:-127.0.0.1}:${BASEROW_PORT:-3007}:80"
     networks:
       - dream-network
     healthcheck:

resources/dev/extensions-library/services/chromadb/compose.yaml

@@ -3,7 +3,7 @@ services:
     image: chromadb/chroma:1.5.3
     container_name: dream-chromadb
     ports:
-      - "127.0.0.1:${CHROMADB_PORT:-8000}:8000"
+      - "${BIND_ADDRESS:-127.0.0.1}:${CHROMADB_PORT:-8000}:8000"
     volumes:
       - ./data/chromadb:/chromadb
     environment:

resources/dev/extensions-library/services/continue/compose.yaml

@@ -25,7 +25,7 @@ services:
       - ./config/continue/nginx.conf:/etc/nginx/conf.d/default.conf:ro
       - ./config/continue/entrypoint.sh:/docker-entrypoint.d/50-continue-init.sh:ro
     ports:
-      - "127.0.0.1:${CONTINUE_PORT:-8890}:8080"
+      - "${BIND_ADDRESS:-127.0.0.1}:${CONTINUE_PORT:-8890}:8080"
     networks:
       - dream-network
     healthcheck:

resources/dev/extensions-library/services/crewai/compose.yaml

@@ -40,7 +40,7 @@ services:
       # App data (SQLite DB, crew configs, history) lives under /app in the container
       - ./data/crewai:/app:rw
     ports:
-      - "127.0.0.1:${CREWAI_PORT:-8501}:8501"
+      - "${BIND_ADDRESS:-127.0.0.1}:${CREWAI_PORT:-8501}:8501"
     healthcheck:
       test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8501/')"]
       interval: 30s

resources/dev/extensions-library/services/flowise/compose.yaml

@@ -20,7 +20,7 @@ services:
     volumes:
       - ./data/flowise:/root/.flowise:rw
     ports:
-      - "127.0.0.1:${FLOWISE_PORT:-7801}:3000"
+      - "${BIND_ADDRESS:-127.0.0.1}:${FLOWISE_PORT:-7801}:3000"
     healthcheck:
       test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:3000/api/v1/ping"]
       interval: 30s