[Yeeef]

What

• New .pm/config.toml settings, each written by its own pm init flag:
  • listen (--listen ADDR): the IP the site binds. 127.0.0.1 when unset. Beside a specific address other than 127.0.0.1 the service also binds 127.0.0.1, so probes, pm record link --local and a tunnel keep working. PortFree, CheckPort and FreePort bind exactly what the service binds.
  • access (--access cloudflare|none): how a request from beyond this machine gets in. It is required once listen is not loopback or site_url is set: the service refuses to start without it, pm doctor names it, and pm init refuses the flag change before writing anything.
• Local trust is decided by the peer, not the Host header. A request is local only when its TCP peer is loopback, its Host names this machine and it has no Cf-Connecting-IP. A LAN peer sending Host: localhost is refused. The Host check stays, against rebinding domains reached from a local browser.
• access = "none": the network reads site_url's host with no login. The owner decided that a non-local viewer may not reply:
  • their pages show the rule in place of every reply form and carry no token (Site.FillReadOnly);
  • /version hashes the page that viewer is served;
  • POST /reply gets a 403 naming the rule;
  • a request forwarded by Cloudflare's edge is refused.
• access = "cloudflare": the Access JWT check as before.
• Migration: pm init (session start included) and pm upgrade give a config with access_team and no access the line access = "cloudflare". It goes where ConfigText writes it, so pm doctor sees no drift. pm upgrade matters most here: it moves the pin that the restarted service reads.
• pm doctor and a typed pm init warn when listen is on the network but site_url is unset, since every network request is then refused. pm where and the service log state a non-loopback listen.
• Docs:
  • --help texts, with the golden files regenerated;
  • one prime.md clause;
  • changelog.d/site-listen-access.md, with an Upgrade guide step;
  • the design pages site-replies (Security rewritten by peer, Host and access), pm-product, pm-go and views-and-site.

Sprint: https://pm.yeeefs.com/sprints/pm-site-5.html

Evidence

• make test-go: 19 packages ok. make lint: 0 issues. make test: 152 passed, 169 skipped.
• Integration (make test-full -k): test_init_and_upgrade_keep_what_is_not_pms, test_service_refuses_the_public_host…, test_doctor_reports_each_changed…, test_service_install…, test_every_config_key…, test_reply_is_refused…: 7 passed.
• Live, in a scratch clone with listen = "0.0.0.0", access = "none", site_url = http://byeeefy:42075; requests from the LAN address 192.168.178.115:
  • Host byeeefy:42075: 200, no token in the page;
  • Host: localhost: 403;
  • POST /reply: 403 naming the rule.
• Live, from 127.0.0.1: GET 200; POST 303, and the reply was stored.
• Cloudflare mode after the session-start migration: a tunnel-like request without a token got 403 "no Cloudflare Access token".
• This repo's own tunnel waits for the pin move.

🤖 Generated with Claude Code