jb/paseo
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: rename allowedHosts to hostnames (#413)

Browse Source 
* refactor: rename allowedHosts to hostnames for DNS rebinding config

The old name confused users who thought it was related to CORS.
"hostnames" communicates that you're declaring the daemon's own
hostnames, not granting access to external parties.

Backward compatible: old config files (daemon.allowedHosts), env var
(PASEO_ALLOWED_HOSTS), CLI flag (--allowed-hosts), and Nix option
(allowedHosts) all still work as deprecated aliases.

* fix(nix): update npmDepsHash to match current package-lock.json
This commit is contained in:
Mohamed Boudra
2026-04-15 12:47:49 +08:00
committed by GitHub
parent 89b87c0235
commit 7a8f65805d
25 changed files with 223 additions and 133 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/website/src/routes/docs/configuration.tsx
+14 -6
View File
@@ -51,8 +51,7 @@ function Configuration() {
<li>CLI flags</li>
</ol>
<p className="text-white/60 leading-relaxed">
Lists append across sources (for example, <code className="font-mono">allowedHosts</code>{" "}
and
Lists append across sources (for example, <code className="font-mono">hostnames</code> and
<code className="font-mono">cors.allowedOrigins</code>).
</p>
</section>
@@ -60,7 +59,7 @@ function Configuration() {
<section className="space-y-4">
<h2 className="text-xl font-medium">Example</h2>
<p className="text-white/60 leading-relaxed">
Minimal example that configures listening address, host allowlist, provider keys, and MCP:
Minimal example that configures listening address, hostnames, provider keys, and MCP:
</p>
<pre className="bg-card border border-border rounded-lg p-4 font-mono text-sm overflow-x-auto text-white/80">
{`{
@@ -71,11 +70,16 @@ function Configuration() {
},
"daemon": {
"listen": "127.0.0.1:6767",
"allowedHosts": ["localhost", ".localhost"],
"hostnames": ["localhost", ".localhost"],
"mcp": { "enabled": true }
}
}`}
</pre>
<p className="text-white/60 leading-relaxed">
<code className="font-mono">daemon.hostnames</code> is the primary field. The old{" "}
<code className="font-mono">daemon.allowedHosts</code> name still works as a deprecated
alias for backward compatibility.
</p>
</section>
<section className="space-y-4">
@@ -229,8 +233,12 @@ docker run --rm -i \\
<code className="font-mono">daemon.listen</code>
</li>
<li>
<code className="font-mono">PASEO_ALLOWED_HOSTS</code> — override/extend{" "}
<code className="font-mono">daemon.allowedHosts</code>
<code className="font-mono">PASEO_HOSTNAMES</code> — override/extend{" "}
<code className="font-mono">daemon.hostnames</code>
</li>
<li>
<code className="font-mono">PASEO_ALLOWED_HOSTS</code> — deprecated alias for{" "}
<code className="font-mono">PASEO_HOSTNAMES</code>
</li>
<li>
<code className="font-mono">PASEO_LOG_CONSOLE_LEVEL</code> — override{" "}
packages/website/src/routes/docs/security.tsx
+3 -3
View File
@@ -185,7 +185,7 @@ function Security() {
<code className="font-mono">100.x.y.z:6767</code>)
</li>
<li>
Add your Tailscale hostname to <code className="font-mono">allowedHosts</code> and{" "}
Add your Tailscale hostname to <code className="font-mono">hostnames</code> and{" "}
<code className="font-mono">cors.allowedOrigins</code>
</li>
<li>
@@ -199,7 +199,7 @@ function Security() {
daemon reachable on all network interfaces, including public Wi-Fi and local networks.
This can expose your daemon to unauthorized access. If you must bind to all interfaces,
ensure you have proper firewall rules and review your{" "}
<code className="font-mono">allowedHosts</code> configuration.
<code className="font-mono">hostnames</code> configuration.
</div>
</section>
@@ -216,7 +216,7 @@ function Security() {
on incoming requests. Requests with unrecognized hosts are rejected.
</p>
<p className="text-white/60 leading-relaxed">
Configure via <code className="font-mono">daemon.allowedHosts</code> in{" "}
Configure via <code className="font-mono">daemon.hostnames</code> in{" "}
<code className="font-mono">config.json</code>:
</p>
<ul className="text-white/60 space-y-2 list-disc list-inside">