vrr/ouroboros
2
0
Fork 0
mirror of https://github.com/razzant/ouroboros.git synced 2026-10-03 04:07:04 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7
ouroboros/docs/DEPLOYMENT.md
Ouroboros 409a856f7e v5.8.3-rc.2: centralize state helpers 
Move shared JSON, lock, review-doc, and direct-provider fallback logic behind explicit SSOT helpers while keeping trusted non-local binds env-only for managed deployments.
2026-05-08 02:12:09 +03:00

955 B
Raw Blame History

DEPLOYMENT.md — Deployment Notes

Trusted Docker / Kubernetes Non-Local Binds

By default, saving OUROBOROS_SERVER_HOST=0.0.0.0 through the Settings UI requires OUROBOROS_NETWORK_PASSWORD in the same save. This keeps desktop and local-network launches from accidentally exposing the full Ouroboros HTTP and WebSocket surface without the built-in password gate.

Trusted container deployments may opt out with:

OUROBOROS_TRUST_NONLOCAL_BIND_WITHOUT_PASSWORD=1

Use this flag only when access is already restricted by external infrastructure, for example:

  • ingress authentication
  • VPN-only routing
  • private Kubernetes service/network policy
  • an authenticated reverse proxy

With the flag enabled, Ouroboros still warns when saving a non-localhost bind without OUROBOROS_NETWORK_PASSWORD, but the Settings UI no longer blocks ordinary settings saves such as API-key updates. Do not use this flag on an open LAN or public port.