From bb0ad3a39df9f5065b129ca70ff246d606ab9d60 Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Tue, 21 Apr 2026 23:04:54 +1000 Subject: [PATCH] fix: bind awsgw and predastore on 0.0.0.0 in spinifex.toml template MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #144 (nats TLS) made every service listen on --bind's specific IP. For awsgw and predastore this broke localhost-reachability that the UI proxy (spinifexui/spinifexui.go:193-194) and AWS CLI spinifex profile rely on — latent since #144, surfaced by siv-7's auto-detect default on dev installs (502 from the UI). Hardcode awsgw and predastore host fields to 0.0.0.0 so both listen wildcard; loopback clients (UI proxy, spinifex AWS CLI profile, same-host daemon → predastore) keep working, LAN clients still reach them via the LAN-IP SAN on the cert. daemon.host and nats.host stay as {{.BindIP}} because peer-advertised values must not resolve to 0.0.0.0/loopback. predastore.host normalization at config.go:207 rewrites 0.0.0.0 → 127.0.0.1 for local-node consumers, so existing callers see a usable connect address. --- cmd/spinifex/cmd/templates/spinifex.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cmd/spinifex/cmd/templates/spinifex.toml b/cmd/spinifex/cmd/templates/spinifex.toml index 432dd70f0..072d03e10 100644 --- a/cmd/spinifex/cmd/templates/spinifex.toml +++ b/cmd/spinifex/cmd/templates/spinifex.toml @@ -61,7 +61,7 @@ dev_networking = true {{- end}} [nodes.{{.Node}}.awsgw] -host = "{{.BindIP}}:9999" +host = "0.0.0.0:9999" tlskey = "config/server.key" tlscert = "config/server.pem" debug = true @@ -90,7 +90,7 @@ wan_bridge = "{{.WanBridge}}" {{- end}} [nodes.{{.Node}}.predastore] -host = "{{.BindIP}}:8443" +host = "0.0.0.0:8443" region = "{{.Region}}" bucket = "predastore" accesskey = "{{.AccessKey}}"