feat(service_router): --bind flag for the local TCP UI listener #231

Merged

mik-tf merged 1 commit from development_mik_router_bind into development

2026-05-07 14:04:08 +00:00

mik-tf commented

2026-05-07 13:30:48 +00:00

Owner

Surfaces hero_router's new --bind (lhumina_code/hero_router#89) on service_router start.

Default 127.0.0.1 preserves existing loopback-only behaviour. --bind 0.0.0.0 is the public-cloud bootstrap mode — only safe behind an external auth + TLS gate (e.g. nginx + Let's Encrypt + htpasswd on a fresh DO/Hetzner/AWS droplet).

Closes the consumer side of lhumina_code/home#227.

Behaviour

$bind is threaded into svx_action and emitted as --bind ($bind) on every hero_router script invocation. hero_router's clap default is also 127.0.0.1, so existing actions are byte-for-byte equivalent.
--address (extra mycelium listener) keeps disabling the local listener via --port 0; --bind only matters when --port != 0.
The post-start health probe targets the loopback even when --bind 0.0.0.0 — the listener accepts on every interface, so loopback is always the right local probe target.
Summary banner notes "also reachable on every interface" when --bind 0.0.0.0.

Verification

nu -c "use nutools/modules/services/service_router.nu; service_router start --help" parses clean and surfaces the new flag.
Functional smoke gated on hero_router PR #89 squashing first; tagging v0.2.4-rc1 afterward and validating end-to-end on the DO bootstrap.

Out of scope

Producer is hero_router PR #89.
cloud_vm.conf.template for nginx + LE + htpasswd lands separately under lhumina_code/hero_demo/deploy/nginx/.

Signed-off-by: mik-tf

Surfaces hero_router's new `--bind` (https://forge.ourworld.tf/lhumina_code/hero_router/pulls/89) on `service_router start`. Default `127.0.0.1` preserves existing loopback-only behaviour. `--bind 0.0.0.0` is the public-cloud bootstrap mode — only safe behind an external auth + TLS gate (e.g. nginx + Let's Encrypt + htpasswd on a fresh DO/Hetzner/AWS droplet). Closes the consumer side of https://forge.ourworld.tf/lhumina_code/home/issues/227. ## Behaviour - `$bind` is threaded into `svx_action` and emitted as `--bind ($bind)` on every `hero_router` script invocation. hero_router's clap default is also `127.0.0.1`, so existing actions are byte-for-byte equivalent. - `--address` (extra mycelium listener) keeps disabling the local listener via `--port 0`; `--bind` only matters when `--port != 0`. - The post-start health probe targets the loopback even when `--bind 0.0.0.0` — the listener accepts on every interface, so loopback is always the right local probe target. - Summary banner notes "also reachable on every interface" when `--bind 0.0.0.0`. ## Verification - `nu -c "use nutools/modules/services/service_router.nu; service_router start --help"` parses clean and surfaces the new flag. - Functional smoke gated on hero_router PR #89 squashing first; tagging `v0.2.4-rc1` afterward and validating end-to-end on the DO bootstrap. ## Out of scope - Producer is hero_router PR #89. - `cloud_vm.conf.template` for nginx + LE + htpasswd lands separately under `lhumina_code/hero_demo/deploy/nginx/`. Signed-off-by: mik-tf

mik-tf added 1 commit

2026-05-07 13:30:48 +00:00

feat(service_router): --bind flag for the local TCP UI listener

Build and Publish Skills / build-and-publish (pull_request) Successful in 2s

Details

b26ac13465

Surfaces hero_router's new `--bind` (lhumina_code/hero_router#89) on
`service_router start`. Default `127.0.0.1` preserves existing
loopback-only behaviour; `--bind 0.0.0.0` exposes the local listener
on every interface for cloud-VM deploys behind an external auth + TLS
gate (e.g. nginx + Let's Encrypt + htpasswd on a fresh DO/Hetzner/AWS
droplet — see hero_demo/deploy/nginx/cloud_vm.conf.template).

Behaviour summary:
- $bind is threaded into svx_action and emitted as `--bind ($bind)`
  on every script invocation. hero_router's clap default (127.0.0.1)
  matches, so existing actions are byte-for-byte equivalent.
- --address (extra mycelium listener) keeps disabling the local
  listener via `--port 0`; --bind only matters when --port != 0.
- The post-start health probe targets the loopback even when
  --bind 0.0.0.0 — the listener accepts on every interface, so
  loopback is always the right local probe target.
- Summary banner notes "also reachable on every interface" when
  --bind 0.0.0.0 is used.

Closes the consumer side of
lhumina_code/home#227.

Signed-off-by: mik-tf