Allow internal endpoints from remote addresses; warn on unsecured non-loopback bind#2100
Draft
jeremyfowers wants to merge 1 commit into
Draft
Allow internal endpoints from remote addresses; warn on unsecured non-loopback bind#2100jeremyfowers wants to merge 1 commit into
jeremyfowers wants to merge 1 commit into
Conversation
…-loopback bind The /internal/* endpoints (shutdown, set, config, cleanup-cache) were hard-restricted to loopback, which breaks the many-clients-one-server topology: a desktop app, tray, or CLI on another machine could not manage a shared lemond. This also blocks remote clients from the upcoming client-driven cloud discovery endpoint (#1785). Lift the loopback restriction and rely on the existing admin-key gating (LEMONADE_ADMIN_API_KEY, which defaults to LEMONADE_API_KEY) for access control. Since an unsecured non-loopback bind now exposes the control endpoints to the network, lemond logs a startup warning (and again on host rebind via /internal/set) when bound to a non-loopback host with no API key set, advising the operator to set one. Docs updated to match. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
github-actions
Bot
added
area::api
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/internal/*endpoints returned403for any non-localhost request, breaking the many-clients-one-server topology (a desktop app/CLI on another machine can't manage a sharedlemond) and blocking remote clients from/internal/cloud/discoverin #1785.This lifts the loopback restriction and relies on the existing admin-key gating (
LEMONADE_ADMIN_API_KEY, which defaults toLEMONADE_API_KEY). Since an unsecured non-loopback bind now exposes the control endpoints to the network,lemondlogs a startup warning (re-checked on host rebind) when bound to a non-loopback host with no key set:Docs updated to match.
Testing
Verified manually on a
0.0.0.0bind via the machine's LAN IP (non-loopbackremote_addr):GET /internal/config→ 200 (was 403); startup warning loggedExisting
test/server_env_vars.pyadmin-key tests are unaffected. No automated test for the remote-address path — it needs a routable interface, which is flaky in CI.🤖 Generated with Claude Code