Duplicate of #20136, which implements the same reverse proxy host allowlisting via config (dashboard.allowed_hosts + trusted_proxy_hosts). Also related to #22437 (env-var approach) and #21104.

Hey @farena-ai — flagged by the duplicate-detector bot alongside several other PRs solving similar dashboard-host-allowlist problems. Wanted to share one observation in case it's useful.

The placement of the extras check matters for the DNS-rebinding defence. In this PR the check runs before the bind discrimination:

if host_only in extra_hosts:
    return True

if bound_host in {"0.0.0.0", "::"}:
    return True
# ... loopback branch ...
# ... explicit non-loopback branch ...

That means setting HERMES_DASHBOARD_ALLOWED_HOSTS=proxy.example widens the accept list on every bind mode — including the explicit-non-loopback bind (line 232-203 of the unmodified _is_accepted_host). An operator who deliberately bound to my-server.corp.net now also accepts proxy.example unexpectedly.

I opened #29195 which gates the extras check inside the loopback-bind branch so the explicit-non-loopback case stays strict, with a regression test for that exact scenario (test_additional_hosts_not_consulted_on_non_loopback_bind). Same env var idea, just a tighter placement. Linked the discussion in case it's helpful — happy to consolidate either way.