Interface: DashboardServerConfig
Defined in: nestlens.config.ts:125
A listener of NestLens's own, instead of a mount on the application's server.
Everything under AuthorizationConfig decides who is allowed through;
this decides who can reach the door at all. Mounted on the host application —
the default, and unchanged — the dashboard shares that application's socket,
so whatever reaches the application reaches /nestlens too and only the
checks in front of it say otherwise. A reverse proxy that forgets to exclude
the path, or excludes it in a location block that never matches, publishes
every recorded Authorization header and request body to the internet, and
nothing inside the application can tell that it happened.
Given a server, NestLens binds its own socket to the address named here and
registers no dashboard route on the application at all. On a private
interface — a VPN address, a container network, 127.0.0.1 behind an SSH
tunnel — the dashboard is then not merely protected from the internet but
absent from it, which does not depend on a second component staying correct.
The address is not optional and there is no default. 0.0.0.0 is a fine
answer where the network is the boundary; it just has to be the answer
somebody wrote down.
Authorization is unaffected: allowedEnvironments, allowedIps, canAccess
and requiredRoles are enforced on this listener exactly as they are on the
mounted one.
Properties
host
host:
string
Defined in: nestlens.config.ts:133
Address to bind, e.g. '127.0.0.1', a tailnet address, or '0.0.0.0'.
The socket is bound to this address alone — this is not a filter applied after listening on everything, so an address the host does not hold fails at startup rather than falling back.
port
port:
number
Defined in: nestlens.config.ts:136
Port to bind. 0 asks the operating system for a free one.