From aea97cd929041becb8fb1a804f8b2e8655be52bd Mon Sep 17 00:00:00 2001
From: Schwitzz <abbreinholt@gmail.com>
Date: Mon, 2 Nov 2026 14:31:03 -0600
Subject: [PATCH] fix(server): auto-bind 0.0.0.0 when allowedHosts includes a
 reverse-proxy domain

---
 server/src/index.ts | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/server/src/index.ts b/server/src/index.ts
index a25ca70..3c88b48 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -160,20 +160,35 @@ export async function buildApp() {
     return false;
   }
 
+  function hasExternalAllowedHost(allowedHostsRaw: string): boolean {
+    const tokens = allowedHostsRaw
+      .split(/[,\s]+/)
+      .map((t) => extractHostname(t))
+      .filter(Boolean);
+    return tokens.some(
+      (t) => t !== "localhost" && t !== "127.0.0.1" && t !== "::1" && t !== "[::1]",
+    );
+  }
+
   function loadPersistedServerSysConfig(): PersistedServerSysConfig {
     try {
       if (existsSync(sysConfigPath)) {
         const raw = JSON.parse(readFileSync(sysConfigPath, "utf8")) as Partial<PersistedServerSysConfig>;
+        const allowedHosts =
+          typeof raw.allowedHosts === "string" && raw.allowedHosts.trim()
+            ? raw.allowedHosts.trim()
+            : "localhost, 127.0.0.1";
+        const rawHost =
+          typeof raw.host === "string" && raw.host.trim()
+            ? raw.host.trim()
+            : "127.0.0.1";
         return {
           enabled: typeof raw.enabled === "boolean" ? raw.enabled : true,
           host:
-            typeof raw.host === "string" && raw.host.trim()
-              ? raw.host.trim()
-              : "127.0.0.1",
-          allowedHosts:
-            typeof raw.allowedHosts === "string" && raw.allowedHosts.trim()
-              ? raw.allowedHosts.trim()
-              : "localhost, 127.0.0.1",
+            rawHost === "127.0.0.1" && hasExternalAllowedHost(allowedHosts)
+              ? "0.0.0.0"
+              : rawHost,
+          allowedHosts,
           port:
             typeof raw.port === "number" && raw.port >= 1024 && raw.port <= 65535
               ? raw.port