opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(gateway): clarify dual-stack wildcard fallback

Browse source
This commit is contained in:
Sakurapainting 2026-04-02 19:28:28 +08:00
parent 193cb44514
commit 4b52718fb6
3 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -242,7 +242,7 @@ docker compose -f docker/docker-compose.yml --profile launcher up -d
# Open http://localhost:18800 # Open http://localhost:18800
``` ```
> **Docker / VM users:** The Gateway listens on `127.0.0.1` by default. Set `PICOCLAW_GATEWAY_HOST=0.0.0.0` or use the `-public` flag to make it accessible from the host. If loopback bind fails at runtime, PicoClaw may fallback to `0.0.0.0` with CIDR restrictions; configure `gateway.allowed_cidrs` to keep exposure limited. > **Docker / VM users:** The Gateway listens on `127.0.0.1` by default. Set `PICOCLAW_GATEWAY_HOST=0.0.0.0` or use the `-public` flag to make it accessible from the host. If loopback bind fails at runtime, PicoClaw may fallback to wildcard bind addresses (`0.0.0.0` for IPv4 or `::` for IPv6) with CIDR restrictions; configure `gateway.allowed_cidrs` to keep exposure limited.
```bash ```bash
# Check logs # Check logs

2
docs/configuration.md
View file

@ -55,7 +55,7 @@ You can also override this with the environment variable `PICOCLAW_LOG_LEVEL`.
When `gateway.host` is a loopback address (`127.0.0.1`, `::1`, or `localhost`) and bind fails (for example, on boards where loopback is unavailable), PicoClaw automatically: When `gateway.host` is a loopback address (`127.0.0.1`, `::1`, or `localhost`) and bind fails (for example, on boards where loopback is unavailable), PicoClaw automatically:
1. Falls back to bind on `0.0.0.0`. 1. Falls back to a wildcard bind on all interfaces, using either `0.0.0.0` (IPv4) or `::` (IPv6), depending on whether the configured loopback host is IPv4/IPv6/`localhost` and which wildcard bind succeeds.
2. Enforces a CIDR allowlist for gateway HTTP endpoints. 2. Enforces a CIDR allowlist for gateway HTTP endpoints.
3. Discovers private local interface CIDRs only when `gateway.allowed_cidrs` is empty. 3. Discovers private local interface CIDRs only when `gateway.allowed_cidrs` is empty.

2
docs/docker.md
View file

@ -27,7 +27,7 @@ docker compose -f docker/docker-compose.yml --profile gateway up -d
> **Docker Users**: By default, the Gateway listens on `127.0.0.1` which is not accessible from the host. If you need to access the health endpoints or expose ports, set `PICOCLAW_GATEWAY_HOST=0.0.0.0` in your environment or update `config.json`. > **Docker Users**: By default, the Gateway listens on `127.0.0.1` which is not accessible from the host. If you need to access the health endpoints or expose ports, set `PICOCLAW_GATEWAY_HOST=0.0.0.0` in your environment or update `config.json`.
> [!TIP] > [!TIP]
> If `gateway.host` is loopback and bind fails at runtime (for example, loopback unavailable on some boards), PicoClaw will fallback to `0.0.0.0` and enforce CIDR restrictions. Configure `gateway.allowed_cidrs` to keep exposure limited to trusted networks. > If `gateway.host` is loopback and bind fails at runtime (for example, loopback unavailable on some boards), PicoClaw may fall back to `0.0.0.0` and/or `::` (IPv4/IPv6 wildcard) and will enforce CIDR restrictions. Configure `gateway.allowed_cidrs` to keep exposure limited to trusted networks.
> [!NOTE] > [!NOTE]
> The `gateway` profile only serves the webhook handlers (including Pico when enabled) and health endpoints on the gateway port, so it does not expose generic REST chat endpoints such as `/chat` or `/a2a`. Launcher mode adds the browser UI plus `/api/pico/token` and a `/pico/ws` proxy on the launcher port, but `/pico/ws` is also available directly on the gateway whenever the Pico channel is enabled. > The `gateway` profile only serves the webhook handlers (including Pico when enabled) and health endpoints on the gateway port, so it does not expose generic REST chat endpoints such as `/chat` or `/a2a`. Launcher mode adds the browser UI plus `/api/pico/token` and a `/pico/ws` proxy on the launcher port, but `/pico/ws` is also available directly on the gateway whenever the Pico channel is enabled.