fix: support reverse proxy domains via HERMES_DASHBOARD_EXTRA_HOSTS env var#22437
Open
Cyrene963 wants to merge 1 commit into
Open
fix: support reverse proxy domains via HERMES_DASHBOARD_EXTRA_HOSTS env var#22437Cyrene963 wants to merge 1 commit into
Cyrene963 wants to merge 1 commit into
Conversation
…nv var When the dashboard is bound to 127.0.0.1, the Host header validation middleware rejects requests from reverse proxy domains (e.g. webui.bz9.me via Cloudflare). This makes the dashboard unusable behind any reverse proxy without --insecure (0.0.0.0 bind). Add HERMES_DASHBOARD_EXTRA_HOSTS environment variable support to _is_accepted_host(). When set (comma-separated list of hostnames), the specified domains are accepted alongside the loopback aliases. Usage: HERMES_DASHBOARD_EXTRA_HOSTS=webui.bz9.me hermes dashboard # or in systemd: Environment=HERMES_DASHBOARD_EXTRA_HOSTS=webui.bz9.me,admin.example.com This is more secure than --insecure because it keeps the loopback bind while only adding specific trusted hostnames.
Collaborator
19 tasks
Author
|
Re-evaluating closure status for #22437 I closed this after noting competing implementations, but I rechecked the referenced alternatives and do not see a merged replacement yet. Reopening so this small reverse-proxy host support fix remains trackable; if maintainers prefer the config-based shape from another PR, I can adapt this branch accordingly. |
3 tasks
19 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When the dashboard is bound to
127.0.0.1(default), the Host header validation middleware rejects requests from reverse proxy domains (e.g.webui.bz9.mevia Cloudflare). This makes the dashboard unusable behind any reverse proxy without using--insecure(which binds to0.0.0.0).The user sees a blank page because:
Invalid Host header)Solution
Add
HERMES_DASHBOARD_EXTRA_HOSTSenvironment variable support to_is_accepted_host(). When set (comma-separated list of hostnames), the specified domains are accepted alongside the loopback aliases.Usage
Why not --insecure?
--insecurebinds to0.0.0.0, which exposes the dashboard to the entire network. The env var approach keeps the loopback bind while only adding specific trusted hostnames — much safer for users behind Cloudflare, Caddy, or Nginx reverse proxies.Changes
hermes_cli/web_server.py: 7 lines added to_is_accepted_host()— readsHERMES_DASHBOARD_EXTRA_HOSTSenv var and accepts matching hostnames.