feat(router): --bind flag for local TCP UI listener (default 127.0.0.1) #89

Merged

mik-tf merged 1 commit from development_mik_router_bind into development

2026-05-07 14:04:07 +00:00

mik-tf commented

2026-05-07 12:33:45 +00:00

Owner

Adds --bind <ip> to hero_router (default 127.0.0.1). With --bind 0.0.0.0 the local TCP UI listener is reachable on a public-facing interface, unblocking cloud-VM deploys (DO / Hetzner / AWS) where there is no nginx-on-VM bridge.

The accepted-connection ADMIN_SECRETS whitelist (serve_tcp_with_admin_list) still gates every byte — no auth regression.

Closes the bind-mode side of lhumina_code/home#227.

Hygiene bundle

Bundles the fmt + clippy debt that blocked the workspace gate so this PR can land green:

log_bridge.rs — rewrite is_some + unwrap as match; collapse triple-nested if let into a single let-chain.
routes.rs — move urlenc above the #[cfg(test)] mod tests block (items_after_test_module).
rpc.rs — drop redundant let manual_src = manual_src; rebinding.
terminal.rs — extract AttachedSessions type alias for the static AsyncMutex<HashMap<...>>.
mechanical cargo fmt across the touched files.

Verification

Local:

cargo fmt --check
cargo clippy --workspace --all-targets -- -D warnings
cargo build --workspace --release

All green.

Out of scope

The consumer-side service_router.nu --bind wiring lands as a separate PR on hero_skills immediately after this merges.
Tag v0.2.4-rc1 cuts after both PRs are on development.

Signed-off-by: mik-tf

Adds `--bind <ip>` to `hero_router` (default `127.0.0.1`). With `--bind 0.0.0.0` the local TCP UI listener is reachable on a public-facing interface, unblocking cloud-VM deploys (DO / Hetzner / AWS) where there is no nginx-on-VM bridge. The accepted-connection ADMIN_SECRETS whitelist (`serve_tcp_with_admin_list`) still gates every byte — no auth regression. Closes the bind-mode side of https://forge.ourworld.tf/lhumina_code/home/issues/227. ## Hygiene bundle Bundles the fmt + clippy debt that blocked the workspace gate so this PR can land green: - `log_bridge.rs` — rewrite `is_some` + `unwrap` as `match`; collapse triple-nested `if let` into a single let-chain. - `routes.rs` — move `urlenc` above the `#[cfg(test)] mod tests` block (`items_after_test_module`). - `rpc.rs` — drop redundant `let manual_src = manual_src;` rebinding. - `terminal.rs` — extract `AttachedSessions` type alias for the static `AsyncMutex<HashMap<...>>`. - mechanical `cargo fmt` across the touched files. ## Verification Local: ``` cargo fmt --check cargo clippy --workspace --all-targets -- -D warnings cargo build --workspace --release ``` All green. ## Out of scope - The consumer-side `service_router.nu --bind` wiring lands as a separate PR on `hero_skills` immediately after this merges. - Tag `v0.2.4-rc1` cuts after both PRs are on `development`. Signed-off-by: mik-tf

mik-tf added 1 commit

2026-05-07 12:33:45 +00:00

feat(router): --bind flag for local TCP UI listener (default 127.0.0.1)

Build & Test / check (pull_request) Successful in 2m42s

Details

eaa2042352

Adds `--bind <ip>` to hero_router. Default `127.0.0.1` preserves the
existing loopback-only behaviour; `--bind 0.0.0.0` exposes the local
TCP listener on a public-facing interface for cloud-VM deploys where
no nginx-on-VM bridge exists (e.g. fresh DigitalOcean / Hetzner / AWS
bootstraps). Every accepted TCP connection is still gated by the
ADMIN_SECRETS whitelist via serve_tcp_with_admin_list — no auth
regression.

Closes the bind-mode side of
lhumina_code/home#227.

Bundles pre-existing fmt + clippy debt that blocked the workspace
gate (per the session-67 hygiene-bundle pattern):
- log_bridge.rs: rewrite is_some-then-unwrap as match; collapse
  triple-nested if-let chain into a single let-chain.
- routes.rs: move urlenc above #[cfg(test)] mod tests
  (clippy::items_after_test_module).
- rpc.rs: drop redundant rebinding `let manual_src = manual_src`.
- terminal.rs: extract AttachedSessions type alias for the
  AsyncMutex<HashMap<String, (..., ..., ...)>> static.
- mechanical cargo fmt across log_bridge / main / routes /
  rpc / terminal.

Verified locally: cargo fmt --check, cargo clippy --workspace
--all-targets -- -D warnings, cargo build --workspace --release.

Signed-off-by: mik-tf