|
Two different symptoms, one thread, because they're both about the same security defaults. |
Answered by
Ark0N
Aug 15, 2026
Replies: 1 comment
|
These are two different walls, and both are deliberate. Other devices can't connect at all. Codeman binds to 127.0.0.1 by default, and a browser pointing at the machine's LAN IP will never reach a loopback bind. Either bind wider: CODEMAN_PASSWORD=yourpassword codeman web --host 0.0.0.0or keep the loopback bind and front it with something running on the same box: Your custom domain gets rejected. That's the Host-header allowlist, which is DNS-rebinding protection and always on. Add your domain: CODEMAN_ALLOWED_HOSTS=codeman.example.com,.example.comA bare |
0 replies
Answer selected by
Ark0N
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
These are two different walls, and both are deliberate.
Other devices can't connect at all. Codeman binds to 127.0.0.1 by default, and a browser pointing at the machine's LAN IP will never reach a loopback bind. Either bind wider:
or keep the loopback bind and front it with something running on the same box:
tailscale serve, a Cloudflare tunnel, or your own reverse proxy.Your custom domain gets rejected. That's the Host-header allowlist, which is DNS-rebinding protection and always on. Add your domain:
A bare
.suffixentry matches subdomains. Restart the server and you're through.