security(gateway): keep health endpoint local by default

Bind the gateway health listener to localhost by default and reduce the probe response to a minimal status payload so accidental public exposure leaks less information. Made-with: Cursor
2026-04-14 07:19:38 +00:00
parent 4999e2f734
commit e4b3f9bd28
4 changed files with 14 additions and 33 deletions
@@ -1727,6 +1727,7 @@ Example config:
    }
  },
  "gateway": {
+    "host": "127.0.0.1",
    "port": 18790
  }
 }
@@ -1739,11 +1740,13 @@ nanobot gateway --config ~/.nanobot-telegram/config.json
 nanobot gateway --config ~/.nanobot-discord/config.json
 ```

-Each gateway instance also exposes a lightweight HTTP status endpoint on
-`gateway.host:gateway.port`:
+Each gateway instance also exposes a lightweight HTTP health endpoint on
+`gateway.host:gateway.port`. By default, the gateway binds to `127.0.0.1`,
+so the endpoint stays local unless you explicitly set `gateway.host` to a
+public or LAN-facing address.

- `GET /` returns `nanobot`
- `GET /health` returns JSON with service metadata, uptime, and enabled channels
+- `GET /health` returns `{"status":"ok"}`
+- Other paths return `404`

 Override workspace for one-off runs when needed: