Merge pull request #3478 from Dakraid/feature/set-listen-ip Feature: Allow user to configure an address to listen to

96d6a6df07a6ba945fc37f9eb5f9a01a8c7ae37b

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

default/config.yaml+4 -0 Viewed

 # -- SERVER CONFIGURATION --
 # Listen for incoming connections
 listen: false
+# Listen on a specific address, supports IPv4 and IPv6
+listenAddress:
+  ipv4: 0.0.0.0
+  ipv6: '[::]'
 # Enables IPv6 and/or IPv4 protocols. Need to have at least one enabled!
 # - Use option "auto" to automatically detect support
 # - Use true or false (no qoutes) to enable or disable each protocol

package-lock.json+13 -0 Viewed

                 "html-entities": "^2.5.2",
                 "iconv-lite": "^0.6.3",
                 "ip-matching": "^2.1.2",
+                "ip-regex": "^5.0.0",
                 "ipaddr.js": "^2.0.1",
                 "jimp": "^0.22.10",
                 "localforage": "^1.10.0",

             "integrity": "sha512-/ok+VhKMasgR5gvTRViwRFQfc0qYt9Vdowg6TO4/pFlDCob5ZjGPkwuOoQVCd5OrMm20zqh+1vA8KLJZTeWudg==",
             "license": "LGPL-3.0-only"
         },
+        "node_modules/ip-regex": {
+            "version": "5.0.0",
+            "resolved": "https://registry.npmjs.org/ip-regex/-/ip-regex-5.0.0.tgz",
+            "integrity": "sha512-fOCG6lhoKKakwv+C6KdsOnGvgXnmgfmp0myi3bcNwj3qfwPAxRKWEuFhvEFF7ceYIz6+1jRZ+yguLFAmUNPEfw==",
+            "license": "MIT",
+            "engines": {
+                "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+            },
+            "funding": {
+                "url": "https://github.com/sponsors/sindresorhus"
+            }
+        },
         "node_modules/ipaddr.js": {
             "version": "2.1.0",
             "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-2.1.0.tgz",

package.json+2 -0 Viewed

         "html-entities": "^2.5.2",
         "iconv-lite": "^0.6.3",
         "ip-matching": "^2.1.2",
+        "ip-regex": "^5.0.0",
         "ipaddr.js": "^2.0.1",
         "jimp": "^0.22.10",
         "localforage": "^1.10.0",

     "version": "1.12.11",
     "scripts": {
         "start": "node server.js",
+        "debug": "node server.js --inspect",
         "start:deno": "deno run --allow-run --allow-net --allow-read --allow-write --allow-sys --allow-env server.js",
         "start:bun": "bun server.js",
         "start:no-csrf": "node server.js --disableCsrf",

server.js+23 -8 Viewed

 // net related library imports
 import fetch from 'node-fetch';
+import ipRegex from 'ip-regex';
 // Unrestrict console logs display limit
 util.inspect.defaultOptions.maxArrayLength = null;

 const DEFAULT_PORT = 8000;
 const DEFAULT_AUTORUN = false;
 const DEFAULT_LISTEN = false;
+const DEFAULT_LISTEN_ADDRESS_IPV6 = '[::]';
+const DEFAULT_LISTEN_ADDRESS_IPV4 = '0.0.0.0';
 const DEFAULT_CORS_PROXY = false;
 const DEFAULT_WHITELIST = true;
 const DEFAULT_ACCOUNTS = false;

         type: 'boolean',
         default: null,
         describe: `SillyTavern is listening on all network interfaces (Wi-Fi, LAN, localhost). If false, will limit it only to internal localhost (127.0.0.1).\nIf not provided falls back to yaml config 'listen'.\n[config default: ${DEFAULT_LISTEN}]`,
+    }).option('listenAddressIPv6', {
+        type: 'string',
+        default: null,
+        describe: 'Set SillyTavern to listen to a specific IPv6 address. If not set, it will fallback to listen to all.\n[config default: [::] ]',
+    }).option('listenAddressIPv4', {
+        type: 'string',
+        default: null,
+        describe: 'Set SillyTavern to listen to a specific IPv4 address. If not set, it will fallback to listen to all.\n[config default: 0.0.0.0 ]',
     }).option('corsProxy', {
         type: 'boolean',
         default: null,

 const autorun = (cliArguments.autorun ?? getConfigValue('autorun', DEFAULT_AUTORUN)) && !cliArguments.ssl;
 /** @type {boolean} */
 const listen = cliArguments.listen ?? getConfigValue('listen', DEFAULT_LISTEN);
+/** @type {string} */
+const listenAddressIPv6 = cliArguments.listenAddressIPv6 ?? getConfigValue('listenAddress.ipv6', DEFAULT_LISTEN_ADDRESS_IPV6);
+/** @type {string} */
+const listenAddressIPv4 = cliArguments.listenAddressIPv4 ?? getConfigValue('listenAddress.ipv4', DEFAULT_LISTEN_ADDRESS_IPV4);
 /** @type {boolean} */
 const enableCorsProxy = cliArguments.corsProxy ?? getConfigValue('enableCorsProxy', DEFAULT_CORS_PROXY);
 const enableWhitelist = cliArguments.whitelist ?? getConfigValue('whitelistMode', DEFAULT_WHITELIST);

 const tavernUrlV6 = new URL(
     (cliArguments.ssl ? 'https://' : 'http://') +
-    (listen ? '[::]' : '[::1]') +
+    (listen ? (ipRegex.v6({ exact: true }).test(listenAddressIPv6) ? listenAddressIPv6 : '[::]') : '[::1]') +
     (':' + server_port),
 );
 const tavernUrl = new URL(
     (cliArguments.ssl ? 'https://' : 'http://') +
-    (listen ? '0.0.0.0' : '127.0.0.1') +
+    (listen ? (ipRegex.v4({ exact: true }).test(listenAddressIPv4) ? listenAddressIPv4 : '0.0.0.0') : '127.0.0.1') +
     (':' + server_port),
 );

     const plainGoToLog = removeColorFormatting(goToLog);
     console.log(logListen);
+    if (listen) {
+        console.log();
+        console.log('To limit connections to internal localhost only ([::1] or 127.0.0.1), change the setting in config.yaml to "listen: false".');
+        console.log('Check the "access.log" file in the SillyTavern directory to inspect incoming connections.');
+    }
     console.log('\n' + getSeparator(plainGoToLog.length) + '\n');
     console.log(goToLog);
     console.log('\n' + getSeparator(plainGoToLog.length) + '\n');
-    if (listen) {
-        console.log(
-            '[::] or 0.0.0.0 means SillyTavern is listening on all network interfaces (Wi-Fi, LAN, localhost). If you want to limit it only to internal localhost ([::1] or 127.0.0.1), change the setting in config.yaml to "listen: false". Check "access.log" file in the SillyTavern directory if you want to inspect incoming connections.\n',
-        );
-    }
     if (basicAuthMode) {
         if (perUserBasicAuth && !enableAccounts) {

@@ -1083,7 +1098,7 @@ async function verifySecuritySettings() {
1083	}	1098	}
1084		1099
1085	if (!enableAccounts) {	1100	if (!enableAccounts) {
1086	logSecurityAlert('Your SillyTavern is currently insecurely open to the public. Enable whitelisting, basic authentication or user accounts.');	1101	logSecurityAlert('Your current SillyTavern configuration is insecure (listening to non-localhost). Enable whitelisting, basic authentication or user accounts.');
1087	}	1102	}
1088		1103
1089	const users = await getAllEnabledUsers();	1104	const users = await getAllEnabledUsers();