fix(api): Listen on localhost for API and RPC

api/api.go

@@ -22,6 +22,9 @@ import (
 
 var log = golog.Logger("qriapi")
 
+// LocalHostIP is the IP address for localhost
+const LocalHostIP = "127.0.0.1"
+
 func init() {
  // We don't use the log package, and the net/rpc package spits out some complaints b/c
  // a few methods don't conform to the proper signature (comment this out & run 'qri connect' to see errors)
@@ -127,7 +130,7 @@ func (s *Server) ServeRPC() {
  return
  }
 
- listener, err := net.Listen("tcp", fmt.Sprintf(":%d", s.cfg.RPC.Port))
+ listener, err := net.Listen("tcp", fmt.Sprintf("%s:%d", LocalHostIP, s.cfg.RPC.Port))
  if err != nil {
  log.Infof("RPC listen on port %d error: %s", s.cfg.RPC.Port, err)
  return

api/transports.go

@@ -16,7 +16,11 @@ import (
 // that should work just fine on the raw internet (ie not behind a proxy like nginx etc)
 // it'll also redirect http traffic to it's https route counterpart if port 80 is open
 func StartServer(c *config.API, s *http.Server) error {
- s.Addr = fmt.Sprintf(fmt.Sprintf(":%d", c.Port))
+ if c.ServeRemoteTraffic {
+ s.Addr = fmt.Sprintf(":%d", c.Port)
+ } else {
+ s.Addr = fmt.Sprintf("%s:%d", LocalHostIP, c.Port)
+ }
  if !c.Enabled || c.Port == 0 {
  return nil
  }

config/api.go

@@ -31,6 +31,8 @@ type API struct {
  ProxyForceHTTPS bool `json:"proxyforcehttps"`
  // support CORS signing from a list of origins
  AllowedOrigins []string `json:"allowedorigins"`
+ // whether to allow requests from addresses other than localhost
+ ServeRemoteTraffic bool `json:"serveremotetraffic"`
 }
 
 // Validate validates all fields of api returning all errors found.