Fix issue 2017: setting localhost as default in docker-compose based setups

cluster/compose/localnet/compose.yaml

@@ -70,9 +70,9 @@ services:
       - ${LOCALNET_DIR}/conf/nginx/sv.conf:/etc/nginx/templates/sv.c${SV_PROFILE}f.template
       - ${LOCALNET_DIR}/conf/nginx/swagger-ui:/etc/nginx/includes
     ports:
-      - "${SV_UI_PORT}:${SV_UI_PORT}"
-      - "${APP_PROVIDER_UI_PORT}:${APP_PROVIDER_UI_PORT}"
-      - "${APP_USER_UI_PORT}:${APP_USER_UI_PORT}"
+      - "${HOST_BIND_IP:-127.0.0.1}:${SV_UI_PORT}:${SV_UI_PORT}"
+      - "${HOST_BIND_IP:-127.0.0.1}:${APP_PROVIDER_UI_PORT}:${APP_PROVIDER_UI_PORT}"
+      - "${HOST_BIND_IP:-127.0.0.1}:${APP_USER_UI_PORT}:${APP_USER_UI_PORT}"
     depends_on:
       wallet-web-ui-sv:
         condition: service_healthy

cluster/compose/sv/compose.yaml

@@ -338,7 +338,7 @@ services:
     volumes:
       - ./nginx.conf:/etc/nginx/nginx.conf
     ports:
-      - 8080:80
+      - "${HOST_BIND_IP:-127.0.0.1}:8080:80"
     depends_on:
       - validator
       - scan

cluster/compose/sv/start.sh

@@ -8,9 +8,10 @@ set -euo pipefail
 script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 
 function usage() {
-  echo "Usage: $0 -[h] [-w]"
+  echo "Usage: $0 -[h] [-w] [-E]"
   echo "  -h: Show this help message"
   echo "  -w: Wait for the SV node to be ready"
+  echo "  -E: Use this flag to bind the Nginx proxy to 0.0.0.0 (external access) instead of 127.0.0.1 (default)."
 }
 
 # issue a user friendly red error
@@ -29,7 +30,9 @@ function _info(){
 }
 
 wait=0
-while getopts "hw" opt; do
+HOST_BIND_IP="127.0.0.1"
+
+while getopts "hwE" opt; do
   case ${opt} in
     h)
       usage
@@ -38,6 +41,9 @@ while getopts "hw" opt; do
     w)
       wait=1
       ;;
+    E)
+      HOST_BIND_IP="0.0.0.0"
+      ;;
     ?)
       usage
       exit 1
@@ -60,4 +66,7 @@ extra_args=()
 if [ $wait -eq 1 ]; then
   extra_args+=("--wait" "--wait-timeout" "600")
 fi
+
+export HOST_BIND_IP
+
 docker compose -f "${script_dir}/compose.yaml" up -d "${extra_args[@]}"

cluster/compose/sv/stop.sh

@@ -17,6 +17,7 @@ function _info(){
 script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 
 export IMAGE_TAG=""
+export HOST_BIND_IP=""
 
 docker compose -f "$script_dir/compose.yaml" down
 

cluster/compose/validator/compose.yaml

@@ -160,7 +160,7 @@ services:
       - ./nginx.conf:/etc/nginx/nginx.conf
       - ./nginx:/etc/nginx/includes
     ports:
-      - 80:80
+      - "${HOST_BIND_IP:-127.0.0.1}:80:80"
     depends_on:
       - ans-web-ui
       - wallet-web-ui

cluster/compose/validator/start.sh

@@ -21,7 +21,7 @@ function _info(){
 }
 
 function usage() {
-  echo "Usage: $0 -s <sponsor_sv_address> -o <onboarding_secret> -p <party_hint> -m <migration_id> [-a] [-b] [-c <scan_address>] [-C <host_scan_address>] [-q <sequencer_address>] [-n <network_name>] [-M] [-i <identities_dump>] [-P <participant_id>] [-w] [-l]"
+  echo "Usage: $0 -s <sponsor_sv_address> -o <onboarding_secret> -p <party_hint> -m <migration_id> [-a] [-b] [-c <scan_address>] [-C <host_scan_address>] [-q <sequencer_address>] [-n <network_name>] [-M] [-i <identities_dump>] [-P <participant_id>] [-w] [-l] [-E]"
   echo "  -s <sponsor_sv_address>: The full URL of the sponsor SV"
   echo "  -o <onboarding_secret>: The onboarding secret to use. May be empty (\"\") if you are already onboarded."
   echo "  -p <party_hint>: The party hint to use for the validator operator, by default also your participant identifier."
@@ -43,6 +43,7 @@ function usage() {
   echo "  -b: Disable BFT reads&writes and trust a single SV."
   echo "  -c <scan_address>: The full URL of a Scan app. If not provided, it will be derived from the sponsor SV address."
   echo "  -q <sequencer_address>: The full URL of the sequencer. Must be provided if BFT reads&writes are disabled."
+  echo "  -E: Use this flag to bind the Nginx proxy to 0.0.0.0 (external access) instead of 127.0.0.1 (default)."
 }
 
 script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
@@ -62,7 +63,9 @@ participant_id=""
 restore_identities_dump=""
 local_compose_sv=0
 wait=0
-while getopts 'has:c:C:t:o:n:bq:m:Mp:P:i:wl' arg; do
+HOST_BIND_IP="127.0.0.1"
+
+while getopts 'has:c:C:t:o:n:bq:m:Mp:P:i:wlE' arg; do
   case ${arg} in
     h)
       usage
@@ -113,6 +116,9 @@ while getopts 'has:c:C:t:o:n:bq:m:Mp:P:i:wl' arg; do
     l)
       local_compose_sv=1
       ;;
+    E)
+      HOST_BIND_IP="0.0.0.0"
+      ;;
     ?)
       usage
       exit 1
@@ -264,4 +270,7 @@ extra_args=()
 if [ $wait -eq 1 ]; then
   extra_args+=("--wait" "--wait-timeout" "600")
 fi
+
+export HOST_BIND_IP
+
 docker compose -f "${script_dir}/compose.yaml" "${extra_compose_files[@]}" up -d "${extra_args[@]}"

cluster/compose/validator/stop.sh

@@ -31,6 +31,7 @@ export SPLICE_APP_UI_NAME_SERVICE_NAME=""
 export SPLICE_APP_UI_NAME_SERVICE_NAME_ACRONYM=""
 export VALIDATOR_PARTICIPANT_IDENTITIES_DUMP="v" # A non-empty dummy value, just to make the docker-compose spec valid
 export VALIDATOR_NEW_PARTICIPANT_IDENTIFIER=""
+export HOST_BIND_IP=""
 
 # We include also compose-restore-from-id.yaml, so that if that was included in the start and created the init container,
 # that container is also included in the down and removed

docs/src/release_notes.rst

@@ -17,6 +17,8 @@ Upcoming
 
     - Replace ``-Dscala.concurrent.context.minThreads=8`` with ``-Dscala.concurrent.context.numThreads=8`` and set ``-XX:ActiveProcessorCount=8``  in the ``defaultJvmOptions`` for all the helm charts that deploy scala apps. This should ensure that the internal execution contexts spawn 8 threads to handle processing and that the JVM is configured for 8 CPUs as well. The previous behavior would spawn up to number of available processors, which can be up to the number of CPUs on the actual node if no CPU limit is set. This should avoid overloading the nodes during heavy processing.
 
+    - Docker-compose based deployment of LocalNet, Validator, and SuperValidator expose only to 127.0.0.1 by default. If you want to expose externally, use ``-E`` in Validator and SuperValidator ``start.sh``. For LocalNet, ``export HOST_BIND_IP=0.0.0.0`` manually.
+
   - SV
 
     - UI