Bind web & microservice to 127.0.0.1

[dani]

Hi.

I'm running Immich on a Nomad cluster, exposed by Traefik through the Consul service mesh (anyone interested can have a look at https://git.lapiole.org/nomad/immich but it's a gomplate job template which I render with some custom scripts, so it won't be usable as is easily). Anyway, in this configuration, all the security relies on services binding exclusively on 127.0.0.1. It seems the server and the microservices are both listening on 0.0.0.0. Is there an option (or env var) to set to make them bind on 127.0.0.1 ?

Regards,
Daniel

[jrasm91]

We call listen on the *PORT environment variable. It looks like you can pass a string which I think would make it only listen to 127.0.0.1:3001. We might need to change validation for the environment variable though.

[dani]

Setting the PORT env var to 127.0.0.1 (:3001 for web, and :3002 for microservices), the logs shows it should be listening on 127.0.0.1 only

[Nest] 7  - 10/12/2023 00:54:42     LOG [NestApplication] Nest application successfully started +12ms
[Nest] 7  - 10/12/2023 00:54:42     LOG [ImmichServer] Immich Server is listening on http://127.0.0.1:3001 [v1.90.2] [PRODUCTION] 

Yet, it's still listening on 0.0.0.0 (as reported by netstat)

[jrasm91]

Ah, darn. I will have to look more into it. It might require different configuration. If that doesn't work I don't think it is possible at the moment.

[dani]

It looks like the problem is here : https://github.com/immich-app/immich/blob/main/server/src/immich/main.ts#L34C1-L34C41
It should add the address to listen on, eg

  const server = await app.listen(port, '127.0.0.1');