From 5bad72259357cb045b404db491418e60150b382d Mon Sep 17 00:00:00 2001
From: BaaRai <130491490+BaaRai@users.noreply.github.com>
Date: Tue, 3 Nov 2026 22:10:45 +0100
Subject: [PATCH] fix(auth): make the published bind address configurable

Publishing 127.0.0.1:8787 removed the only working access path for installs
reached through a host or WSL IP, without an obvious way back. Keep loopback as
the default and let ARTEX_BIND_ADDR override it (0.0.0.0 restores the old
behaviour; the setup token still protects the first-run claim).
---
 .env.example       | 3 +++
 README.md          | 2 ++
 docker-compose.yml | 2 +-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index c1f2cb2..5a417b5 100644
--- a/.env.example
+++ b/.env.example
@@ -1,5 +1,8 @@
 # Docker deployment configuration (copy to .env)
 # The image is built locally by `docker compose build`; there is no registry tag.
+# Address the web UI is published on. 127.0.0.1 keeps it host-local; set 0.0.0.0
+# to reach it from another machine or from Windows when ARTEX runs inside WSL.
+ARTEX_BIND_ADDR=127.0.0.1
 POSTGRES_USER=artex
 POSTGRES_PASSWORD=change-me-please
 POSTGRES_DB=artex
diff --git a/README.md b/README.md
index 8467759..b8fe7c1 100644
--- a/README.md
+++ b/README.md
@@ -90,6 +90,8 @@ The script will: detect / auto-install Docker → then let you choose **① all-
 Once installed, open **http://localhost:8787** (on first entry, `/setup` sets the admin password).
 `/setup` asks for a one-time setup token: while no password is set, the backend prints it at startup in its log (`docker compose logs artex | grep "Setup token"`, or the terminal running `./start.sh`).
 
+The web UI is published on `127.0.0.1` by default. To reach it from another machine, or from Windows when ARTEX runs inside WSL, set `ARTEX_BIND_ADDR=0.0.0.0` in `.env` (the setup token still protects the first-run claim), or keep loopback and use a reverse proxy or an SSH tunnel.
+
 ### Option 2: Docker Compose (manual)
 
 ```bash
diff --git a/docker-compose.yml b/docker-compose.yml
index 94e7a13..b041f28 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -35,7 +35,7 @@ services:
       ARTEX_LLM_BASE_URL: ${ARTEX_LLM_BASE_URL:-}
       ARTEX_LLM_PROXY: ${ARTEX_LLM_PROXY:-}
     ports:
-      - "127.0.0.1:8787:8787"
+      - "${ARTEX_BIND_ADDR:-127.0.0.1}:8787:8787"
       - "127.0.0.1:8788:8788"
     volumes:
       # Bind the data directory (jwt.key, SQLite, etc.) to data/ in the project root,