rb-portless 0.5.0 → 0.5.1.dev.20260805.5cf596b

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 47bfd748cef02443448a74938054d6cd57db229d76f286df305fbae28e4a2b7c
-  data.tar.gz: ba03fd513085d3d6cc56395792367a7211da79791dff2e2a8a017890af55ee5e
+  metadata.gz: 77538c8604e444cdbe84b5ee01c20e4e27171e550ca21b3c0181b34d09723104
+  data.tar.gz: 0b1308e10a949443b7f3184bd682ba337b8ac48eb91f27d4f7565cbdeb4f452f
 SHA512:
-  metadata.gz: 140b4a24273bb2bce99a52fcd103b5a21fb7adb397cf4881d1928572985b1446d2c8137f56e5c6b0530359746742f29318c303f7b2b7e9406f075a80c63ea103
-  data.tar.gz: ea86eebc7033820eac77352a8178add894d22e08ec5564d92715f22538c239ed78aae1c2289bf1974452f7f61cd9faf00fad6bbee88009f61d1c98a8eae14d70
+  metadata.gz: 19ebe65d313d0a3ac14497aafe5d10557157722a0dfcde4c3d6ccaa99acc51a48b086e9d5ff17ceb2846a38532f5c5ec5b1ad1ca8a1d934dfb8743831a135819
+  data.tar.gz: 6bacf132c93f00fb84e1f6d4c8be2437a9d85e45a7e2dd390332e1ffcd3e1dee8844e93ddecc910d81e461f48d39530d19b32cf4f442c8bc625ce857eaadfbc9

data/AGENTS.md

@@ -27,6 +27,13 @@ injected as `PORT`; the proxy routes the named host to it.
 - **Per-host SNI certs.** `*.localhost` wildcard certs are invalid at the
   reserved-TLD boundary, so mint a leaf per hostname on the TLS SNI callback,
   cached on disk + in memory.
+- **Loopback by default; LAN is opt-in twice.** The proxy binds `127.0.0.1` +
+  `::1` unless started `--lan` (persisted in `proxy.lan`). Even then only
+  routes carrying `lan: true` (registered by `run --lan`) are served to
+  off-loopback clients — one daemon serves every project, so without that
+  gate one app's `--lan` would expose all of them. Gating fails closed: an
+  unreadable peer address counts as remote. The 404 page's app listing is
+  suppressed for LAN clients (it would enumerate your projects).
 
 ## Module map (`lib/portless/`)
 

data/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [0.5.1]
+
+### Security
+
+- **`--lan` exposed every running app, not just the one you shared.** LAN mode
+  is a property of the daemon — one proxy serves every project — so
+  `run --lan` in one app made every other registered route answer the whole
+  Wi-Fi too. Routes now record the opt-in (`lan: true`, set by `run --lan`) and
+  the proxy serves *only* those to off-loopback clients; everything else 404s.
+  Loopback access is unchanged. The gate fails closed: a peer address we can't
+  read counts as remote. (Upstream portless has the same daemon-wide exposure
+  and no per-route gating; this goes further deliberately.)
+- **The 404 page listed your running apps to LAN clients.** The app listing
+  added in 0.5.0 handed anyone on the network the name of every project you had
+  running. Off-loopback clients now get a bare 404.
+
+### Added
+
+- **`proxy restart --no-lan`** — return the daemon to loopback-only without a
+  `stop`/`start` dance. (`--lan`/`--no-lan` are both explicit now; a plain
+  `restart` still preserves the current mode.) The warning printed when `run
+  --lan` switches a loopback-only daemon over now says how to undo it.
+
 ## [0.5.0]
 
 ### Security

data/README.md

@@ -84,10 +84,19 @@ proxy (loopback-only by default, for safety) to listen on the network:
 ```bash
 rb-portless run --lan bin/dev      # also → https://<name>.local
 rb-portless run --lan --ip 10.0.0.5 bin/dev   # override the detected IP
+rb-portless proxy restart --no-lan            # stop serving the LAN
 ```
+
+**`--lan` shares that one app.** There's a single proxy for every project, so
+LAN mode opens one socket for all of them — but only routes started with
+`--lan` answer clients from the network. Everything else you have running stays
+loopback-only and 404s (without naming your other apps). The daemon stays in LAN
+mode until `proxy restart --no-lan`.
+
 > Devices won't trust your local CA without installing it — use `--lan` with
 > `--no-tls` (set `"tls": false`) for plain HTTP, or install `~/.rb-portless/ca.pem`
-> on the device.
+> on the device. mDNS publishes only `<name>.local`, so tenant subdomains
+> (`kobe.<name>.local`) won't resolve on the device.
 
 **Public sharing** (experimental) — expose the app via ngrok or your tailnet:
 

data/lib/portless/cli.rb

@@ -105,10 +105,10 @@ module Portless
       case args.first
       when "start"
         Daemon.start(tls: tls_flag(args), port: int_flag(args, "--port"),
-                     foreground: flag?("--foreground"), lan: args.include?("--lan"))
+                     foreground: flag?("--foreground"), lan: lan_flag(args) || false)
       when "stop"    then Daemon.stop
       when "restart" then Daemon.restart(tls: explicit_tls_flag(args), port: int_flag(args, "--port"),
-                                         lan: args.include?("--lan") || nil)
+                                         lan: lan_flag(args))
       when nil       then command_help("proxy")
       else invalid_action!("proxy start|stop|restart")
       end
@@ -280,6 +280,14 @@ module Portless
       nil
     end
 
+    # nil unless the user passed --lan/--no-lan (restart preserves the mode).
+    def lan_flag(args)
+      return false if args.include?("--no-lan")
+      return true if args.include?("--lan")
+
+      nil
+    end
+
     def int_flag(args, name)
       i = args.index(name)
       i ? Integer(args[i + 1], exception: false) : nil
@@ -358,8 +366,10 @@ module Portless
                      example: "rb-portless alias postgres 5432   # -> https://postgres.localhost" },
       "proxy"   => { summary: "Manage the proxy daemon.",
                      usage: [ "proxy start [--no-tls] [--port <n>] [--lan]", "proxy stop",
-                              "proxy restart   (pick up an updated rb-portless)" ],
-                     flags: [ [ "--lan", "listen on all interfaces (default: loopback only)" ] ] },
+                              "proxy restart [--lan | --no-lan]   (also picks up an updated gem)" ],
+                     flags: [ [ "--lan", "listen on all interfaces (default: loopback only)" ],
+                              [ "--no-lan", "go back to loopback-only" ] ],
+                     example: "rb-portless proxy restart --no-lan   # stop serving the LAN" },
       "trust"   => { summary: "Trust the local CA so HTTPS works without warnings.",
                      usage: [ "trust" ] },
       "hosts"   => { summary: "Manage the /etc/hosts block (Safari / non-.localhost TLDs).",

data/lib/portless/daemon.rb

@@ -17,7 +17,8 @@ module Portless
       if port && lan && !lan_active?
         # The proxy binds loopback-only by default; --lan needs it reachable
         # from the network, so switch the running daemon over.
-        warn "rb-portless: restarting the proxy in LAN mode (it was loopback-only)"
+        warn "rb-portless: restarting the proxy in LAN mode (it was loopback-only) — only apps run " \
+             "with --lan answer network clients; `rb-portless proxy restart --no-lan` undoes it"
         restart(tls: tls, port: port, lan: true)
         return Health.discover_port || port
       end

data/lib/portless/proxy.rb

@@ -62,10 +62,15 @@ module Portless
     # requests forwarded by the tunnel keep the *.ts.net authority, upstream
     # issue #297), then wildcard fallback so *.name.localhost all reach the
     # single app registered as name.localhost.
-    def route_for(host)
+    #
+    # `lan_client:` restricts the search to routes that opted into LAN serving
+    # (`run --lan`). LAN mode opens one socket for the whole daemon, so without
+    # this every app you happen to be running would answer the whole Wi-Fi.
+    def route_for(host, lan_client: false)
       authority = host.to_s.downcase.delete_suffix(":443")
       host = authority.split(":").first.to_s
       routes = @route_store.routes
+      routes = routes.select(&:lan?) if lan_client
       routes.find { |r| r.hostname == host } ||
         routes.find { |r| share_match?(r, authority, host) } ||
         routes.find { |r| host.end_with?(".#{r.hostname}") }
@@ -76,8 +81,12 @@ module Portless
     # (Async::HTTP::Server.for(endpoint, &proxy.method(:call))).
     def call(request)
       host = request_host(request)
-      route = route_for(host)
-      return not_found(host) unless route
+      # Only consulted in LAN mode: with a loopback-only bind there is no
+      # off-machine client, and a stricter default there could 404 local dev if
+      # the peer address were ever unreadable.
+      lan_client = @lan && !loopback_client?(request)
+      route = route_for(host, lan_client: lan_client)
+      return not_found(host, lan_client: lan_client) unless route
 
       hops = request.headers[HOP_HEADER].to_a.first.to_i
       return error(508, "Proxy loop detected for #{host}.") if hops >= Constants::MAX_PROXY_HOPS
@@ -187,6 +196,20 @@ module Portless
       "127.0.0.1"
     end
 
+    # Is the peer on this machine? Positive identification only — an unreadable
+    # address counts as remote, so LAN gating fails closed.
+    def loopback_client?(request)
+      address = begin
+        request.remote_address&.ip_address
+      rescue StandardError
+        nil
+      end
+      return false unless address
+
+      address = address.to_s.downcase.delete_prefix("::ffff:")
+      address == "::1" || address.start_with?("127.")
+    end
+
     def strip_hop_headers(response)
       HOP_BY_HOP.each { |key| response.headers.delete(key) }
     end
@@ -246,7 +269,11 @@ module Portless
 
     # The 404 lists what IS running (clickable) plus the command that would
     # register the missing name — upstream portless's most-loved error page.
-    def not_found(host)
+    # Never to a LAN client though: that would hand anyone on the Wi-Fi the
+    # name of every project you have running.
+    def not_found(host, lan_client: false)
+      return error(404, "No app is registered for <strong>#{escape(host)}</strong>.") if lan_client
+
       safe_host = escape(host)
       routes = @route_store.routes
       suffix = @port == (@tls ? Constants::HTTPS_PORT : Constants::HTTP_PORT) ? "" : ":#{@port}"

data/lib/portless/route_store.rb

@@ -9,8 +9,12 @@ module Portless
   # directory mutex (atomic mkdir), and the proxy watches it. Dead-pid entries
   # are reaped on every load. Mirrors portless's RouteStore.
   class RouteStore
-    Route = Struct.new(:hostname, :port, :pid, :tailscale, :ngrok, keyword_init: true) do
+    Route = Struct.new(:hostname, :port, :pid, :tailscale, :ngrok, :lan, keyword_init: true) do
       def alias? = pid.to_i.zero? # pid 0 = static alias (never reaped)
+
+      # Did this route opt into being served to LAN clients (`run --lan`)?
+      # The proxy refuses to serve anything else off-loopback.
+      def lan? = !!lan
     end
 
     LOCK_STALE_SECONDS = 10
@@ -36,7 +40,7 @@ module Portless
       @routes_cache_key = key
       @routes_cache = load.map do |h|
         Route.new(hostname: h["hostname"], port: h["port"], pid: h["pid"],
-                  tailscale: h["tailscale"], ngrok: h["ngrok"])
+                  tailscale: h["tailscale"], ngrok: h["ngrok"], lan: h["lan"])
       end
     end
 
@@ -44,7 +48,7 @@ module Portless
     # unless force, which SIGTERMs the incumbent. Alias routes use pid 0. Public
     # share URLs (tailscale/ngrok), when present, are recorded so `list` can show
     # them while the run is active.
-    def add(hostname:, port:, pid:, force: false, tailscale: nil, ngrok: nil)
+    def add(hostname:, port:, pid:, force: false, tailscale: nil, ngrok: nil, lan: false)
       with_lock do
         all = load.reject { |r| dead?(r["pid"]) }
         existing = all.find { |r| r["hostname"] == hostname }
@@ -59,6 +63,7 @@ module Portless
         entry = { "hostname" => hostname, "port" => port, "pid" => pid }
         entry["tailscale"] = tailscale if tailscale
         entry["ngrok"] = ngrok if ngrok
+        entry["lan"] = true if lan
         all << entry
         write(all)
       end

data/lib/portless/runner.rb

@@ -29,7 +29,10 @@ module Portless
       warn "rb-portless: #{@config.tld_warning}" if @config.tld_warning
       ensure_trusted
       proxy_port = Daemon.ensure_running(tls: @config.tls, lan: !!@options[:lan])
-      @route_store.add(hostname: hostname, port: port, pid: Process.pid, force: @options[:force])
+      # lan: marks the route as opted into LAN serving — the proxy serves only
+      # these to off-loopback clients, so --lan shares THIS app, not every app.
+      @route_store.add(hostname: hostname, port: port, pid: Process.pid,
+                       force: @options[:force], lan: !!@options[:lan])
 
       url = display_url(hostname, proxy_port)
       rows = [ [ "Local", url, :cyan ] ]
@@ -57,7 +60,8 @@ module Portless
       return [ [ "Network", "no LAN IPv4 found", :dim ] ] unless ip
 
       @lan_host = "#{@config.name}.local"
-      @route_store.add(hostname: @lan_host, port: backend_port, pid: Process.pid, force: @options[:force])
+      @route_store.add(hostname: @lan_host, port: backend_port, pid: Process.pid,
+                       force: @options[:force], lan: true)
       @mdns_pid = Mdns.publish(@lan_host, ip)
       warn "rb-portless: trust #{State.ca_cert} on the device for HTTPS over the LAN" if @config.tls
       [ [ "Network", display_url(@lan_host, proxy_port), :green ] ]
@@ -81,7 +85,7 @@ module Portless
     def record_share_urls(hostname, port)
       return unless @ngrok || @tailscale
 
-      @route_store.add(hostname: hostname, port: port, pid: Process.pid,
+      @route_store.add(hostname: hostname, port: port, pid: Process.pid, lan: !!@options[:lan],
                        tailscale: @tailscale&.dig(:url), ngrok: @ngrok&.dig(:url))
     end
 

data/lib/portless/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Portless
-  VERSION = "0.5.0"
+  VERSION = "0.5.1.dev.20260805.5cf596b"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rb-portless
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.1.dev.20260805.5cf596b
 platform: ruby
 authors:
 - David Afonso