From 48b27bd6f59004ac78e0f1dc42f80e9cf6305d78 Mon Sep 17 00:00:00 2001 From: Nicolas Pastorello Date: Mon, 6 Jul 2026 19:35:02 -0300 Subject: [PATCH] fix: Docker healthcheck connection refused - Bind to 0.0.0.0 inside containers (DOCKER=true env marker) - Healthcheck was failing because localhost resolved to IPv6 ::1 but server was bound to IPv4 127.0.0.1 - External exposure still protected via Coolify port mapping to 127.0.0.1 --- Dockerfile | 3 +++ src/server.ts | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 0c833db..abf9194 100644 --- a/Dockerfile +++ b/Dockerfile @@ -29,6 +29,9 @@ RUN npm run build # Ensure docs directory exists for /ui static files RUN mkdir -p docs +# Docker environment marker (tells server.ts to bind to 0.0.0.0) +ENV DOCKER=true + # Expose port EXPOSE 3333 diff --git a/src/server.ts b/src/server.ts index 1f16a79..2fc18e4 100755 --- a/src/server.ts +++ b/src/server.ts @@ -144,7 +144,8 @@ const PORT = process.env.T3MP3ST_PORT || 3333; // this local command-executing API (CSRF / DNS-rebinding), NOT remote attackers. // The CORS lock + origin guard below defend that vector; if this is ever exposed // beyond localhost, add real Bearer-token auth as the upgrade path. -const HOST = process.env.T3MP3ST_HOST || '127.0.0.1'; +// DOCKER: Inside containers, bind to 0.0.0.0 (env var can still override). +const HOST = process.env.T3MP3ST_HOST || (process.env.DOCKER === 'true' ? '0.0.0.0' : '127.0.0.1'); // B-02: only enforce the Host-header allow-list when bound to loopback (the // default). If the operator EXPLICITLY exposes the server (T3MP3ST_HOST set to a // non-loopback address) they've opted into network access behind their own front,