[bugfix] Frontend: make Caddy listen address configurable, secure by default#482
Merged
Conversation
…default
By default Caddy bound :5137 on all interfaces with no way to change it. In
network_mode: host that exposes the UI on every host interface, which is
rarely intended.
Add GQ_LISTEN_ADDR (host:port) and make the image secure by default:
- Caddyfile: site address from {$GQ_LISTEN_ADDR:127.0.0.1:5137}.
- Dockerfile: default 127.0.0.1:5137 (loopback) — the UI is not exposed on any
external interface out of the box.
- Bridged containers and Kubernetes must bind all interfaces (published ports /
the kubelet probes and Service reach the container by IP, not loopback), so
they set GQ_LISTEN_ADDR=:5137 explicitly:
- Helm chart: config.listenAddr (default ":5137") wired through the ConfigMap.
- goquery-ui/docker-compose.yml (bridge): pins ":5137".
- docker-compose.yaml (host network): makes the loopback default explicit and
documents how to expose the UI deliberately.
- README: document the secure default and the bind-address knob.
- Chart.yaml: bump chart version 0.1.2 -> 0.1.3 (ct lint enforces
--check-version-increment on chart changes).
Fixes #479
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TsqHDFCs6ebQPjXQNpvNsW
els0r
force-pushed
the
claude/github-issue-479-listen-addr
branch
from
00e334a to
69c9d84
Compare
fako1024
approved these changes
Jun 22, 2026
fako1024
left a comment
fako1024
left a comment
Collaborator
There was a problem hiding this comment.
One minor point of feedback for comment.
| # the UI from other hosts, set it to :5137 (all | ||
| # interfaces) and put it behind a reverse proxy / | ||
| # firewall, or bind a specific trusted interface. | ||
| # GQ_BACKEND_HOST - backend API address for Caddy's reverse proxy |
Collaborator
There was a problem hiding this comment.
The comment here is still weak in terms of clarity (it should be clear that this the global query endpoint, the phrase "backend API address for Caddy's reverse proxy may be confusing, even more so if an actual reverse proxy like nginx is involved in a production environment).
Owner
Author
There was a problem hiding this comment.
Reworded in 1881c1d. It now names the global-query API explicitly, states that this is Caddy's own in-container forwarding (distinct from any external reverse proxy like nginx in front of the UI), and points at the query service's SERVER_ADDR rather than a hardcoded port — which also drops the stale 8145 (sensor port) in favour of 8146:
# GQ_BACKEND_HOST - address of the global-query API that Caddy forwards
# the UI's /_query and /-/ requests to. This is Caddy's
# own in-container forwarding, not any external reverse
# proxy (e.g. nginx) you may run in front of the UI.
# Match it to the query service's SERVER_ADDR above.
Note: the same 8145→8146 default correction (plus a fuller GQ_BACKEND_HOST vs GQ_API_BASE_URL write-up) is also in #483, which targets #480 specifically — so there'll be a trivial overlap on these lines when both land.
Generated by Claude Code
Address review feedback on #482: the old comment ("backend API address for Caddy's reverse proxy") was ambiguous, especially when an actual external reverse proxy (e.g. nginx) fronts the UI. Name the global-query API explicitly, state it is Caddy's own in-container forwarding, and point at the query service's SERVER_ADDR (8146) instead of the stale 8145 sensor port. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsqHDFCs6ebQPjXQNpvNsW
main reached chart 0.1.3 via the v4.2.13 release automation, so the listen-addr chart change needs 0.1.4 to satisfy ct lint --check-version-increment. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TsqHDFCs6ebQPjXQNpvNsW
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
By default Caddy bound :5137 on all interfaces with no way to change it. In
network_mode: host that exposes the UI on every host interface, which is
rarely intended.
Add GQ_LISTEN_ADDR (host:port) and make the image secure by default:
external interface out of the box.
the kubelet probes and Service reach the container by IP, not loopback), so
they set GQ_LISTEN_ADDR=:5137 explicitly:
documents how to expose the UI deliberately.
Closes #479
Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com