fix(proxy): bind listener to loopback by default with MITM_PROXY_HOST override

apps/api/src/config.ts

@@ -33,6 +33,11 @@ export const residentialProxyPool =
 // Cloudflare clearances. See proxy/server.ts for the full rationale.
 export const MITM_PROXY_ENABLED = /^(1|true|yes)$/i.test(process.env.MITM_PROXY_ENABLED ?? "")
 export const MITM_PROXY_PORT = Number(process.env.MITM_PROXY_PORT ?? "8192")
+// Default 127.0.0.1 so the README's "private interface only" guarantee holds by default —
+// the proxy can impersonate any host to anyone who trusts its CA, so it should only ever
+// be reachable by the trusted client (a localhost-bound Prowlarr/Jackett in the same
+// docker network). Override only if you intentionally want a non-local client to use it.
+export const MITM_PROXY_HOST = process.env.MITM_PROXY_HOST ?? "127.0.0.1"
 // CA cert + key live here (persist across restarts so the CA is installed once).
 export const MITM_PROXY_CA_DIR = process.env.MITM_PROXY_CA_DIR ?? "/data/proxy-ca"
 // Cap the tier the proxy will escalate to (e.g. keep it off residential Tier 4).

apps/api/src/index.ts

@@ -3,6 +3,7 @@ import {
   MITM_PROXY_CA_DIR,
   MITM_PROXY_DEBUG,
   MITM_PROXY_ENABLED,
+  MITM_PROXY_HOST,
   MITM_PROXY_MAX_TIER,
   MITM_PROXY_PORT,
   POOL_SIZE,
@@ -34,6 +35,7 @@ initPool()
     if (MITM_PROXY_ENABLED) {
       startMitmProxy({
         port: MITM_PROXY_PORT,
+        host: MITM_PROXY_HOST,
         caDir: MITM_PROXY_CA_DIR,
         deps: getDeps(),
         maxTier: MITM_PROXY_MAX_TIER,

apps/api/src/proxy/server.ts

@@ -27,6 +27,9 @@ export interface MitmProxyOptions {
   port: number
   caDir: string
   deps: OrchestratorDeps
+  // Defaults to 127.0.0.1 in caller code so the proxy is unreachable from anything but
+  // the local host (the per-host loopback TLS terminators stay on 127.0.0.1 unconditionally).
+  host?: string
   maxTier?: 1 | 2 | 3 | 4
   maxTimeout?: number
   debug?: boolean
@@ -80,8 +83,11 @@ export function startMitmProxy(opts: MitmProxyOptions): {
   })
 
   server.on("error", (err) => console.error("[proxy] server error:", err instanceof Error ? err.message : err))
-  server.listen(opts.port, () => {
-    console.log(`[proxy] MITM forward proxy on :${opts.port}  (CA: ${ca.caCertPath})`)
+  // Bind to loopback by default — a MITM proxy trusts whoever installs its CA, so it must
+  // never be exposed off-host unless the operator explicitly opts in via MITM_PROXY_HOST.
+  // The per-host internal TLS terminators (above) stay on 127.0.0.1 unconditionally.
+  server.listen(opts.port, opts.host ?? "127.0.0.1", () => {
+    console.log(`[proxy] MITM forward proxy on ${opts.host ?? "127.0.0.1"}:${opts.port}  (CA: ${ca.caCertPath})`)
   })
 
   return { ca, server }