Skip to content

DEPLOYMENT.md

Latest commit

 

History

History
27 lines (20 loc) · 955 Bytes

DEPLOYMENT.md

File metadata and controls

27 lines (20 loc) · 955 Bytes
Raw

DEPLOYMENT.md — Deployment Notes

Trusted Docker / Kubernetes Non-Local Binds

By default, saving OUROBOROS_SERVER_HOST=0.0.0.0 through the Settings UI requires OUROBOROS_NETWORK_PASSWORD in the same save. This keeps desktop and local-network launches from accidentally exposing the full Ouroboros HTTP and WebSocket surface without the built-in password gate.

Trusted container deployments may opt out with:

OUROBOROS_TRUST_NONLOCAL_BIND_WITHOUT_PASSWORD=1

Use this flag only when access is already restricted by external infrastructure, for example:

  • ingress authentication
  • VPN-only routing
  • private Kubernetes service/network policy
  • an authenticated reverse proxy

With the flag enabled, Ouroboros still warns when saving a non-localhost bind without OUROBOROS_NETWORK_PASSWORD, but the Settings UI no longer blocks ordinary settings saves such as API-key updates. Do not use this flag on an open LAN or public port.