From a6601e527e0dbc00778912d6271c6a3a15555896 Mon Sep 17 00:00:00 2001 From: Frank Date: Wed, 26 Aug 2026 08:25:40 -0700 Subject: [PATCH] hermes-webui: bind 0.0.0.0 inside the container (host publish stays loopback) Podman's port forwarder dials the container bridge IP; a container-internal loopback bind made every tunneled connection reset. --- dankclaw/compose.yaml | 5 ++++- tests/hermes_webui.bats | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/dankclaw/compose.yaml b/dankclaw/compose.yaml index 4140f32..a0b2de1 100644 --- a/dankclaw/compose.yaml +++ b/dankclaw/compose.yaml @@ -109,7 +109,10 @@ services: entrypoint: ["bash", "-c", "python3 /webui/bootstrap.py --foreground"] environment: HERMES_HOME: /data - HERMES_WEBUI_HOST: 127.0.0.1 + # Container-internal bind: 0.0.0.0 so Podman's port forwarder (which + # dials the container's bridge IP) can reach it. The *host-side* + # publish below stays on 127.0.0.1, so loopback-only ingress holds. + HERMES_WEBUI_HOST: 0.0.0.0 HERMES_WEBUI_PORT: "8787" HERMES_WEBUI_PASSWORD: "${HERMES_WEBUI_PASSWORD}" # Headless host: never show the first-run wizard (a profile already diff --git a/tests/hermes_webui.bats b/tests/hermes_webui.bats index e70461b..263171d 100644 --- a/tests/hermes_webui.bats +++ b/tests/hermes_webui.bats @@ -38,6 +38,9 @@ PYEOF # Host-side publish stays on loopback: the SSH tunnel is the only ingress. grep -q '127.0.0.1:8787' <<< "$y" grep -q 'HERMES_WEBUI_PASSWORD' <<< "$y" + # Container-internal bind must be 0.0.0.0 or Podman's port forwarder + # (which dials the bridge IP) resets every connection. + grep -q 'HERMES_WEBUI_HOST: 0.0.0.0' <<< "$y" } @test "hermes-webui shares the gateway data volume and mounts the webui checkout" {