Development commonly runs inside an isolated code-server host reached over Tailscale rather than on the browser's local machine. The current app dev-server behavior is inconsistent:
@webnet/test-app uses Vite defaults, so it listens on localhost and rejects proxied/Tailnet hostnames;
@webnet/example-app already binds ordinary dev to 0.0.0.0 with all hosts allowed;
the Tailshare branches in #28/#55 do the same and additionally configure the HMR websocket.
The first behavior prevents remote development even when the port is safely proxied. The latter behavior makes the broad network exposure implicit in the default command.
Requested change
Give each development app two intentional modes:
dev: local-only/default-safe behavior;
dev:host: bind to non-loopback interfaces and accept hostnames used through Tailscale, code-server port forwarding, or another trusted reverse proxy.
Apply this consistently to Vite and webpack-dev-server apps, including:
@webnet/test-app;
@webnet/example-app;
@webnet/tailshare once #28/#55 are ready;
future development apps via a documented convention.
The hosted mode should make HMR websocket URLs work through a reverse proxy without hard-coding localhost or the container's bind address. Prefer CLI flags or environment-driven config so the two scripts share one configuration.
Security and documentation
The broad-bind script is intended only for trusted development networks such as a Tailnet. Document that it may expose source maps, development endpoints, and application credentials/state to hosts that can reach the port. Keep host-header protection in the default mode; only relax or configure it explicitly in dev:host.
Add a short workspace-level note with example commands such as:
npm run dev:host --workspace=packages/test-app
Also document any proxy requirement for websocket forwarding.
## Motivation
Development commonly runs inside an isolated code-server host reached over Tailscale rather than on the browser's local machine. The current app dev-server behavior is inconsistent:
- `@webnet/test-app` uses Vite defaults, so it listens on localhost and rejects proxied/Tailnet hostnames;
- `@webnet/example-app` already binds ordinary `dev` to `0.0.0.0` with all hosts allowed;
- the Tailshare branches in #28/#55 do the same and additionally configure the HMR websocket.
The first behavior prevents remote development even when the port is safely proxied. The latter behavior makes the broad network exposure implicit in the default command.
## Requested change
Give each development app two intentional modes:
- `dev`: local-only/default-safe behavior;
- `dev:host`: bind to non-loopback interfaces and accept hostnames used through Tailscale, code-server port forwarding, or another trusted reverse proxy.
Apply this consistently to Vite and webpack-dev-server apps, including:
- `@webnet/test-app`;
- `@webnet/example-app`;
- `@webnet/tailshare` once #28/#55 are ready;
- future development apps via a documented convention.
The hosted mode should make HMR websocket URLs work through a reverse proxy without hard-coding localhost or the container's bind address. Prefer CLI flags or environment-driven config so the two scripts share one configuration.
## Security and documentation
The broad-bind script is intended only for trusted development networks such as a Tailnet. Document that it may expose source maps, development endpoints, and application credentials/state to hosts that can reach the port. Keep host-header protection in the default mode; only relax or configure it explicitly in `dev:host`.
Add a short workspace-level note with example commands such as:
```sh
npm run dev:host --workspace=packages/test-app
```
Also document any proxy requirement for websocket forwarding.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Motivation
Development commonly runs inside an isolated code-server host reached over Tailscale rather than on the browser's local machine. The current app dev-server behavior is inconsistent:
@webnet/test-appuses Vite defaults, so it listens on localhost and rejects proxied/Tailnet hostnames;@webnet/example-appalready binds ordinarydevto0.0.0.0with all hosts allowed;The first behavior prevents remote development even when the port is safely proxied. The latter behavior makes the broad network exposure implicit in the default command.
Requested change
Give each development app two intentional modes:
dev: local-only/default-safe behavior;dev:host: bind to non-loopback interfaces and accept hostnames used through Tailscale, code-server port forwarding, or another trusted reverse proxy.Apply this consistently to Vite and webpack-dev-server apps, including:
@webnet/test-app;@webnet/example-app;@webnet/tailshareonce #28/#55 are ready;The hosted mode should make HMR websocket URLs work through a reverse proxy without hard-coding localhost or the container's bind address. Prefer CLI flags or environment-driven config so the two scripts share one configuration.
Security and documentation
The broad-bind script is intended only for trusted development networks such as a Tailnet. Document that it may expose source maps, development endpoints, and application credentials/state to hosts that can reach the port. Keep host-header protection in the default mode; only relax or configure it explicitly in
dev:host.Add a short workspace-level note with example commands such as:
Also document any proxy requirement for websocket forwarding.