diegosouzapw · Sep 12, 2026 · Sep 10, 2026
@@ -124,6 +124,21 @@ DISABLE_SQLITE_AUTO_BACKUP=false
 # Host port for the compose Redis sidecar. Default: 6379.
 # REDIS_PORT=6379
 
+# Host interface docker-compose publishes the app's own ports (dashboard,
+# API, live-WS) on for the base/web/cli/host profiles and docker-compose.prod.yml.
+# Default: 127.0.0.1 (loopback only). Combined with REQUIRE_API_KEY=false
+# (the default below), an unqualified publish spec would expose the anonymous
+# /v1 LLM proxy to your whole LAN/WAN. Only set this to 0.0.0.0 once you've
+# confirmed REQUIRE_API_KEY=true, or that a reverse proxy in front of this
+# instance already enforces its own authentication. (#12568)
+# APP_BIND_HOST=127.0.0.1
+# Host interface docker-compose publishes the Qdrant memory sidecar on.
+# Default: 127.0.0.1 (loopback only). Same LAN-exposure reasoning as Redis.
+# QDRANT_BIND_HOST=127.0.0.1
+# Host interface docker-compose publishes the Bifrost router sidecar on.
+# Default: 127.0.0.1 (loopback only). Same LAN-exposure reasoning as Redis.
+# BIFROST_BIND_HOST=127.0.0.1
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # 3. NETWORK & PORTS
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -373,6 +388,8 @@ AUTH_COOKIE_SECURE=false
 # Require an API key for all /v1/* proxy endpoints.
 # Used by: API middleware — rejects unauthenticated requests to the proxy API.
 # Default: false  |  Set true for multi-user/public deployments.
+# Leaving this false is only safe when the app is reachable on loopback only
+# (see APP_BIND_HOST above) or sits behind a reverse proxy doing its own auth.
 REQUIRE_API_KEY=false
 
 # Allow revealing full API key values in the Dashboard UI.
@@ -2077,6 +2094,13 @@ APP_LOG_TO_FILE=true
 # Management key for an externally managed instance. Embedded instances use
 # OmniRoute's encrypted service key.
 # CLIPROXYAPI_MANAGEMENT_KEY=
+# Host interface docker-compose publishes the cliproxyapi sidecar on (the
+# --profile cliproxyapi Docker service, port 8317). Default: 127.0.0.1
+# (loopback only) — its data volume holds provider OAuth/API credentials, and
+# the pinned image has no env-based data-plane api-keys override (only a
+# mounted config.yaml), so an unqualified publish spec would put a
+# credential-bearing service on your whole LAN. (#12578)
+# CLIPROXY_BIND_HOST=127.0.0.1
 
 # ── Mux embedded service ──
 # Override the port where the embedded Mux (coder/mux) agent-orchestration

@@ -0,0 +1 @@
+- fix(docker): default docker-compose app ports (dashboard/API/live-WS) to loopback instead of `0.0.0.0`, closing the anonymous `/v1` LAN/WAN exposure gap left open by `REQUIRE_API_KEY=false` (#12568)
@@ -0,0 +1 @@
+- fix(docker): scope the cliproxyapi/qdrant/bifrost sidecars to loopback by default and forward `CLIPROXYAPI_MANAGEMENT_KEY` into the cliproxyapi container so its management API is not left both unauthenticated and LAN-published (#12578)
@@ -63,17 +63,22 @@ services:
       - DASHBOARD_PORT=${DASHBOARD_PORT:-${PORT:-20128}}
       - API_PORT=${API_PORT:-20129}
       - LIVE_WS_PORT=${LIVE_WS_PORT:-20132}
-      - LIVE_WS_HOST=${LIVE_WS_HOST:-0.0.0.0}
+      - LIVE_WS_HOST=${LIVE_WS_HOST:-127.0.0.1}
       - LIVE_WS_ALLOWED_ORIGINS=${LIVE_WS_ALLOWED_ORIGINS:-http://localhost:${PROD_DASHBOARD_PORT:-20130},http://127.0.0.1:${PROD_DASHBOARD_PORT:-20130}}
-      - API_HOST=${API_HOST:-0.0.0.0}
-      - HOSTNAME=0.0.0.0
+      - API_HOST=${API_HOST:-127.0.0.1}
+      # HOSTNAME intentionally not hardcoded to 0.0.0.0 (#12568) — let the
+      # app's own loopback-first default apply unless the operator sets it.
       - DATA_DIR=/app/data
       - OMNIROUTE_BASE_PATH=${OMNIROUTE_BASE_PATH:-}
       - CHATGPT_WEB_CODEX_CDP_URL=http://chatgpt-web-codex-browser:9223
     ports:
-      - "${PROD_DASHBOARD_PORT:-20130}:${DASHBOARD_PORT:-${PORT:-20128}}"
-      - "${PROD_API_PORT:-20131}:${API_PORT:-20129}"
-      - "${PROD_LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
+      # Loopback-only by default (#12568) — see docker-compose.yml's
+      # APP_BIND_HOST comment for the rationale. Override for a LAN/WAN prod
+      # deployment only once REQUIRE_API_KEY=true or a reverse proxy in front
+      # of this instance is confirmed to enforce its own auth.
+      - "${APP_BIND_HOST:-127.0.0.1}:${PROD_DASHBOARD_PORT:-20130}:${DASHBOARD_PORT:-${PORT:-20128}}"
+      - "${APP_BIND_HOST:-127.0.0.1}:${PROD_API_PORT:-20131}:${API_PORT:-20129}"
+      - "${APP_BIND_HOST:-127.0.0.1}:${PROD_LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     volumes:
       - omniroute-prod-data:/app/data
     healthcheck:

@@ -37,9 +37,9 @@ x-common: &common
     - PORT=${PORT:-20128}
     - DASHBOARD_PORT=${DASHBOARD_PORT:-20128}
     - API_PORT=${API_PORT:-20129}
-    - API_HOST=${API_HOST:-0.0.0.0}
+    - API_HOST=${API_HOST:-127.0.0.1}
     - LIVE_WS_PORT=${LIVE_WS_PORT:-20132}
-    - LIVE_WS_HOST=${LIVE_WS_HOST:-0.0.0.0}
+    - LIVE_WS_HOST=${LIVE_WS_HOST:-127.0.0.1}
     - LIVE_WS_ALLOWED_ORIGINS=${LIVE_WS_ALLOWED_ORIGINS:-http://localhost:20128,http://127.0.0.1:20128}
     - REDIS_URL=${REDIS_URL:-redis://redis:6379}
     - NODE_OPTIONS=--max-old-space-size=2048
@@ -99,9 +99,14 @@ services:
         OMNIROUTE_BASE_PATH: ${OMNIROUTE_BASE_PATH:-}
     image: omniroute:base
     ports:
-      - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
-      - "${API_PORT:-20129}:${API_PORT:-20129}"
-      - "${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
+      # Loopback-only by default (#12568): with REQUIRE_API_KEY=false shipping
+      # as the .env.example default, an unqualified publish spec here binds
+      # 0.0.0.0 and exposes the anonymous /v1 LLM proxy on every LAN/WAN
+      # interface. Set APP_BIND_HOST=0.0.0.0 only once you've confirmed
+      # REQUIRE_API_KEY=true or an upstream reverse proxy enforces its own auth.
+      - "${APP_BIND_HOST:-127.0.0.1}:${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
+      - "${APP_BIND_HOST:-127.0.0.1}:${API_PORT:-20129}:${API_PORT:-20129}"
+      - "${APP_BIND_HOST:-127.0.0.1}:${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     profiles:
       - base
 
@@ -126,17 +131,17 @@ services:
       - PORT=${PORT:-20128}
       - DASHBOARD_PORT=${DASHBOARD_PORT:-20128}
       - API_PORT=${API_PORT:-20129}
-      - API_HOST=${API_HOST:-0.0.0.0}
+      - API_HOST=${API_HOST:-127.0.0.1}
       - LIVE_WS_PORT=${LIVE_WS_PORT:-20132}
-      - LIVE_WS_HOST=${LIVE_WS_HOST:-0.0.0.0}
+      - LIVE_WS_HOST=${LIVE_WS_HOST:-127.0.0.1}
       - LIVE_WS_ALLOWED_ORIGINS=${LIVE_WS_ALLOWED_ORIGINS:-http://localhost:20128,http://127.0.0.1:20128}
       - REDIS_URL=${REDIS_URL:-redis://redis:6379}
       - OMNIROUTE_BASE_PATH=${OMNIROUTE_BASE_PATH:-}
       - CHATGPT_WEB_CODEX_CDP_URL=http://chatgpt-web-codex-browser:9223
     ports:
-      - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
-      - "${API_PORT:-20129}:${API_PORT:-20129}"
-      - "${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
+      - "${APP_BIND_HOST:-127.0.0.1}:${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
+      - "${APP_BIND_HOST:-127.0.0.1}:${API_PORT:-20129}:${API_PORT:-20129}"
+      - "${APP_BIND_HOST:-127.0.0.1}:${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     profiles:
       - web
 
@@ -165,9 +170,9 @@ services:
         OMNIROUTE_BASE_PATH: ${OMNIROUTE_BASE_PATH:-}
     image: omniroute:cli
     ports:
-      - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
-      - "${API_PORT:-20129}:${API_PORT:-20129}"
-      - "${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
+      - "${APP_BIND_HOST:-127.0.0.1}:${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
+      - "${APP_BIND_HOST:-127.0.0.1}:${API_PORT:-20129}:${API_PORT:-20129}"
+      - "${APP_BIND_HOST:-127.0.0.1}:${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     volumes:
       - ./data:/app/data
       # SECURITY: mounting the host Docker socket gives this container full
@@ -194,17 +199,17 @@ services:
         OMNIROUTE_BASE_PATH: ${OMNIROUTE_BASE_PATH:-}
     image: omniroute:base
     ports:
-      - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
-      - "${API_PORT:-20129}:${API_PORT:-20129}"
-      - "${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
+      - "${APP_BIND_HOST:-127.0.0.1}:${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
+      - "${APP_BIND_HOST:-127.0.0.1}:${API_PORT:-20129}:${API_PORT:-20129}"
+      - "${APP_BIND_HOST:-127.0.0.1}:${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     environment:
       - DATA_DIR=/app/data
       - PORT=${PORT:-20128}
       - DASHBOARD_PORT=${DASHBOARD_PORT:-20128}
       - API_PORT=${API_PORT:-20129}
-      - API_HOST=${API_HOST:-0.0.0.0}
+      - API_HOST=${API_HOST:-127.0.0.1}
       - LIVE_WS_PORT=${LIVE_WS_PORT:-20132}
-      - LIVE_WS_HOST=${LIVE_WS_HOST:-0.0.0.0}
+      - LIVE_WS_HOST=${LIVE_WS_HOST:-127.0.0.1}
       - LIVE_WS_ALLOWED_ORIGINS=${LIVE_WS_ALLOWED_ORIGINS:-http://localhost:20128,http://127.0.0.1:20128}
       - CLI_MODE=host
       - CLI_EXTRA_PATHS=/host-local/bin:/host-node/bin
@@ -243,8 +248,8 @@ services:
     container_name: omniroute-qdrant
     restart: unless-stopped
     ports:
-      - "${QDRANT_PORT:-6333}:6333"
-      - "${QDRANT_GRPC_PORT:-6334}:6334"
+      - "${QDRANT_BIND_HOST:-127.0.0.1}:${QDRANT_PORT:-6333}:6333"
+      - "${QDRANT_BIND_HOST:-127.0.0.1}:${QDRANT_GRPC_PORT:-6334}:6334"
     volumes:
       - qdrant-data:/qdrant/storage
     environment:
@@ -271,7 +276,7 @@ services:
     container_name: omniroute-bifrost
     restart: unless-stopped
     ports:
-      - "${BIFROST_PORT:-8080}:8080"
+      - "${BIFROST_BIND_HOST:-127.0.0.1}:${BIFROST_PORT:-8080}:8080"
     volumes:
       - bifrost-data:/data
     environment:
@@ -294,12 +299,22 @@ services:
     image: docker.io/eceasy/cli-proxy-api:v6.9.7
     restart: unless-stopped
     ports:
-      - "${CLIPROXYAPI_PORT:-8317}:${CLIPROXYAPI_PORT:-8317}"
+      # Loopback-only by default: this sidecar's data volume
+      # (cliproxiapi-data:/root/.cli-proxy-api) holds provider OAuth/API
+      # credentials, and the pinned image only reads api-keys from a mounted
+      # config.yaml (not env vars), so an unqualified "8317:8317" publish spec
+      # would put a credential-bearing service with no compose-configured
+      # data-plane auth on every LAN interface. Same reasoning as Redis above.
+      - "${CLIPROXY_BIND_HOST:-127.0.0.1}:${CLIPROXYAPI_PORT:-8317}:${CLIPROXYAPI_PORT:-8317}"
     volumes:
       - cliproxyapi-data:/root/.cli-proxy-api
     environment:
       - PORT=${CLIPROXYAPI_PORT:-8317}
       - HOST=0.0.0.0
+      # Forwards to the one auth-related env var the pinned binary actually
+      # reads (MANAGEMENT_PASSWORD) — secures the management API only; the
+      # data-plane completions endpoints have no env-based override upstream.
+      - MANAGEMENT_PASSWORD=${CLIPROXYAPI_MANAGEMENT_KEY:-}
     healthcheck:
       test:
         ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:${CLIPROXYAPI_PORT:-8317}/v1/models"]

@@ -338,6 +338,8 @@ Beyond the defaults documented in [ENVIRONMENT.md](../reference/ENVIRONMENT.md),
 | `AUTO_UPDATE_HOST_REPO_DIR`   | Host path mounted into `cli` profile at `/workspace/omniroute` for self-update workflows                                                                                   | `.` (current directory)  |
 | `OMNIROUTE_MEMORY_MB`         | Runtime Node heap ceiling for the Docker standalone server; overrides the image default above. Coding agents: `8192`+ (see [runtime RAM](#runtime-ram-for-coding-agents)). | `1024`                   |
 | `DASHBOARD_PORT` / `API_PORT` | Override exposed ports for dashboard (20128) and API (20129)                                                                                                               | `20128` / `20129`        |
+| `APP_BIND_HOST`               | Host interface docker-compose publishes the dashboard/API/live-WS ports on. With `REQUIRE_API_KEY=false` (the default), `0.0.0.0` exposes the anonymous `/v1` proxy to the LAN — only widen with `REQUIRE_API_KEY=true` or a reverse proxy in front. | `127.0.0.1`              |
+| `CLIPROXY_BIND_HOST`          | Host interface docker-compose publishes the `cliproxyapi` sidecar on — its data volume holds provider credentials.                                                        | `127.0.0.1`              |
 | `OMNIROUTE_PLUGINS_DIR`       | Directory the runtime plugin scanner reads and installs into. Set it when plugins are bind-mounted: the default follows `HOME`, which an image need not export.            | `~/.omniroute/plugins`   |
 | `OMNIROUTE_BASE_PATH`         | URL subpath when the app is published behind a reverse proxy (e.g. `/omniroute`)                                                                                           | _(empty = root)_         |
 | `NEXT_PUBLIC_BASE_URL`        | Public browser origin including the subpath (e.g. `https://host/omniroute`)                                                                                                | unset                    |
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		- fix(docker): default docker-compose app ports (dashboard/API/live-WS) to loopback instead of `0.0.0.0`, closing the anonymous `/v1` LAN/WAN exposure gap left open by `REQUIRE_API_KEY=false` (#12568)
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		- fix(docker): scope the cliproxyapi/qdrant/bifrost sidecars to loopback by default and forward `CLIPROXYAPI_MANAGEMENT_KEY` into the cliproxyapi container so its management API is not left both unauthenticated and LAN-published (#12578)