feat(sites): load bind addresses from host interfaces

Author: lukyrys

AGENTS.md

@@ -31,7 +31,9 @@ Recent history follows Conventional Commits, for example `fix(cloudflare): local
 
 ## Agent Workflow Notes
 
-Before cross-repo, infrastructure, CI, or architecture work, load MCP memory for WDC context and read `CLAUDE.md` if present; fall back to `C:\work\sources\CLAUDE.md`. The active master roadmap is `docs/plans/2026-05-04-wdc-master-refactor-redesign-plan.md`; related plans include `docs/plans/2026-05-04-ui-ux-refactor-redesign.md`, `docs/plans/2026-05-04-postgresql-platform-support.md`, and `docs/plans/2026-05-04-binaries-catalog-ci.md`. Do not run `tools/pre-push-check.sh` autonomously because prior WDC sessions observed interactive prompts; run the individual gates instead: `npx vue-tsc --noEmit`, `npx playwright test --reporter=line`, `npx electron-vite build`, plus relevant .NET tests. Do not start privileged daemon, hosts, firewall, certificate, or lifecycle checks as a normal local process; use CI or an approved noninteractive elevated path for admin-only verification.
+Before cross-repo, infrastructure, CI, or architecture work, load MCP memory for WDC context and read `CLAUDE.md` if present; fall back to `C:\work\sources\CLAUDE.md`. If a local roadmap exists under `docs/plans/`, read it before coding; do not recreate deleted plan artifacts unless explicitly requested. Do not run `tools/pre-push-check.sh` autonomously because prior WDC sessions observed interactive prompts; run the individual gates instead: `npx vue-tsc --noEmit`, `npx playwright test --reporter=line`, `npx electron-vite build`, plus relevant .NET tests. Do not start privileged daemon, hosts, firewall, certificate, or lifecycle checks as a normal local process; use CI or an approved noninteractive elevated path for admin-only verification.
+
+For UI changes, capture Playwright screenshots for every changed screen/state and review layout, readability, contrast, responsiveness, and visual regressions before signoff. Store temporary screenshots under `output/playwright/` and do not commit them.
 
 ## Security & Configuration Tips
 

src/daemon/NKS.WebDevConsole.Daemon/Program.cs

@@ -1,4 +1,6 @@
 using System.Text.Json;
+using System.Net;
+using System.Net.NetworkInformation;
 using Dapper;
 using NKS.WebDevConsole.Daemon.Plugin;
 using NKS.WebDevConsole.Daemon.Services;
@@ -5760,6 +5762,8 @@ await InvokeNodeMethodAsync(nodeModule, "StartSiteAsync",
 
 app.MapGet("/api/sites", (SiteManager sm) => Results.Ok(sm.Sites.Values));
 
+app.MapGet("/api/sites/bind-addresses", () => Results.Ok(GetBindAddressOptions()));
+
 app.MapGet("/api/sites/{domain}", (string domain, SiteManager sm) =>
 {
     var site = sm.Get(domain);
@@ -10937,6 +10941,62 @@ await ws.SendAsync(new ArraySegment<byte>(bytes),
 
 await app.RunAsync();
 
+static IReadOnlyList<BindAddressOption> GetBindAddressOptions()
+{
+    var options = new List<BindAddressOption>
+    {
+        new("*", "*",
+            "Name-based virtual host on every Apache listener. Use only when hostnames are unique across all sites on the same ports.",
+            true, false, null),
+        new(IPAddress.Loopback.ToString(), IPAddress.Loopback.ToString(),
+            "Loopback-only. Good default for localhost and private local sites.",
+            false, true, "Loopback"),
+        new(IPAddress.IPv6Loopback.ToString(), IPAddress.IPv6Loopback.ToString(),
+            "IPv6 loopback-only. Use when the site should be reachable on ::1.",
+            false, true, "Loopback"),
+    };
+    var seen = new HashSet<string>(options.Select(o => o.Value), StringComparer.OrdinalIgnoreCase);
+
+    foreach (var ni in NetworkInterface.GetAllNetworkInterfaces()
+                 .Where(i => i.OperationalStatus == OperationalStatus.Up))
+    {
+        IPInterfaceProperties props;
+        try { props = ni.GetIPProperties(); }
+        catch { continue; }
+
+        foreach (var unicast in props.UnicastAddresses)
+        {
+            var ip = unicast.Address;
+            if (ip.AddressFamily is not (System.Net.Sockets.AddressFamily.InterNetwork
+                or System.Net.Sockets.AddressFamily.InterNetworkV6))
+                continue;
+            if (ip.IsIPv6LinkLocal || ip.IsIPv6Multicast || IPAddress.IsLoopback(ip))
+                continue;
+            var value = ip.ToString();
+            if (!seen.Add(value))
+                continue;
+
+            options.Add(new BindAddressOption(
+                value,
+                $"{value} - {ni.Name}",
+                "Bind this site only on this device address. Requests on other addresses cannot fall through to this vhost.",
+                false,
+                false,
+                ni.Name));
+        }
+    }
+
+    return options;
+}
+
+record BindAddressOption(
+    string Value,
+    string Label,
+    string Description,
+    bool Wildcard,
+    bool Loopback,
+    string? InterfaceName);
+
 record GrantCreateBody(
     string ScopeType,
     string? ScopeValue,

src/daemon/NKS.WebDevConsole.Daemon/Sites/SiteManager.cs

@@ -189,6 +189,36 @@ public static void ValidateBindAddress(string? bindAddress)
             throw new ArgumentException("BindAddress must be an IP address or '*'");
     }
 
+    public void ValidateBindConflicts(SiteConfig site, string? existingDomain = null)
+    {
+        var candidateHosts = HostnamesFor(site).ToArray();
+        var candidateHttpPort = site.HttpPort > 0 ? site.HttpPort : 80;
+        var candidateHttpsPort = site.HttpsPort > 0 ? site.HttpsPort : 443;
+        foreach (var other in Sites.Values)
+        {
+            if (!other.Enabled)
+                continue;
+            if (!string.IsNullOrWhiteSpace(existingDomain)
+                && string.Equals(other.Domain, existingDomain, StringComparison.OrdinalIgnoreCase))
+                continue;
+            if (!BindScopesOverlap(site.BindAddress, other.BindAddress))
+                continue;
+
+            var httpOverlaps = candidateHttpPort == (other.HttpPort > 0 ? other.HttpPort : 80);
+            var httpsOverlaps = site.SslEnabled && other.SslEnabled
+                && candidateHttpsPort == (other.HttpsPort > 0 ? other.HttpsPort : 443);
+            if (!httpOverlaps && !httpsOverlaps)
+                continue;
+
+            var duplicateHost = candidateHosts.FirstOrDefault(h => HostnamesFor(other).Contains(h, StringComparer.OrdinalIgnoreCase));
+            if (duplicateHost is not null)
+            {
+                throw new ArgumentException(
+                    $"Host '{duplicateHost}' already belongs to site '{other.Domain}' on an overlapping bind address and port.");
+            }
+        }
+    }
+
     public async Task<SiteConfig> CreateAsync(SiteConfig site)
     {
         ValidateDomain(site.Domain);
@@ -197,6 +227,7 @@ public async Task<SiteConfig> CreateAsync(SiteConfig site)
         if (site.Aliases is { Length: > 0 })
             foreach (var alias in site.Aliases)
                 ValidateAlias(alias);
+        ValidateBindConflicts(site);
 
         var toml = TomlSerializer.Serialize(site);
 
@@ -230,6 +261,7 @@ public async Task<SiteConfig> UpdateAsync(SiteConfig site)
         if (site.Aliases is { Length: > 0 })
             foreach (var alias in site.Aliases)
                 ValidateAlias(alias);
+        ValidateBindConflicts(site, site.Domain);
 
         var toml = TomlSerializer.Serialize(site);
         var sitesRoot = Path.GetFullPath(_sitesDir);
@@ -445,6 +477,30 @@ public static string FormatApacheBindAddress(string? bindAddress)
         return value.Contains(':') ? $"[{value}]" : value;
     }
 
+    private static IEnumerable<string> HostnamesFor(SiteConfig site)
+    {
+        yield return site.Domain;
+        foreach (var alias in NormalizeAliases(site.Domain, site.Aliases))
+            yield return alias;
+    }
+
+    private static bool BindScopesOverlap(string? left, string? right)
+    {
+        var a = NormalizeBindScope(left);
+        var b = NormalizeBindScope(right);
+        return a == "*" || b == "*" || string.Equals(a, b, StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static string NormalizeBindScope(string? bindAddress)
+    {
+        if (string.IsNullOrWhiteSpace(bindAddress) || bindAddress.Trim() == "*")
+            return "*";
+        var value = bindAddress.Trim();
+        if (value.StartsWith('[') && value.EndsWith(']'))
+            value = value[1..^1];
+        return System.Net.IPAddress.TryParse(value, out var ip) ? ip.ToString() : value;
+    }
+
     /// <summary>
     /// Detects the PHP framework powering a site by inspecting its document root
     /// and parent directory (Laravel/Symfony/Nette typically have docroot=public/ or www/).

src/frontend/electron/main.ts

@@ -292,7 +292,8 @@ async function isDaemonAlive(): Promise<boolean> {
       // option is to kill it and spawn the one bundled with this app.
       const appVersion = app.getVersion()
       const daemonVersion = (parsed.version || '').split('+')[0].trim()
-      if (daemonVersion && daemonVersion !== appVersion) {
+      const daemonBaseVersion = daemonVersion.split('-')[0].trim()
+      if (daemonBaseVersion && daemonBaseVersion !== appVersion) {
         console.warn(`[daemon] version skew — app=${appVersion} daemon=${daemonVersion} — stopping stale daemon`)
         try {
           await new Promise<void>((resolve) => {

src/frontend/src/api/daemon.ts

@@ -530,6 +530,17 @@ export interface SystemInfo {
 }
 export const fetchSystem = (): Promise<SystemInfo> => json('/api/system')
 
+export interface BindAddressOption {
+  value: string
+  label: string
+  description: string
+  wildcard: boolean
+  loopback: boolean
+  interfaceName?: string | null
+}
+export const fetchBindAddressOptions = (): Promise<BindAddressOption[]> =>
+  json('/api/sites/bind-addresses')
+
 // Settings store — flat "category.key" → string map the daemon persists
 // in SQLite. Used by Settings.vue (read + write + sync compare) and by
 // Login.vue (read-only, to pre-fill the catalog URL). Several pages and

src/frontend/src/components/pages/SiteDetailSimple.vue

@@ -71,13 +71,21 @@
       <div class="sd-row sd-row-stack">
         <span class="sd-label">{{ $t('sites.bindIp') }}</span>
         <div class="sd-control-wrap sd-bind-control">
-          <el-input
+          <el-select
             v-model="bindAddress"
             size="small"
-            clearable
-            placeholder="* or 127.0.0.1"
+            filterable
+            :loading="bindAddressOptionsLoading"
+            :disabled="bindAddressOptionsLoading || bindAddressOptions.length === 0"
             @change="onBindAddressChange"
-          />
+          >
+            <el-option
+              v-for="opt in bindAddressOptions"
+              :key="opt.value"
+              :label="opt.label"
+              :value="opt.value"
+            />
+          </el-select>
           <Transition name="flash">
             <span v-if="savedBind" class="sd-saved">{{ $t('sites.detail.simple.saved') }}</span>
           </Transition>
@@ -181,7 +189,7 @@ import { useSitesStore } from '../../stores/sites'
 import { useDaemonStore } from '../../stores/daemon'
 import { useServicesStore } from '../../stores/services'
 import { useI18n } from 'vue-i18n'
-import { daemonBaseUrl, fetchPhpVersions } from '../../api/daemon'
+import { daemonBaseUrl, fetchBindAddressOptions, fetchPhpVersions, type BindAddressOption } from '../../api/daemon'
 import { errorMessage } from '../../utils/errors'
 
 const props = defineProps<{ domain: string }>()
@@ -200,6 +208,8 @@ const site = computed(() => sitesStore.sites.find(s => s.domain === props.domain
 const phpVersion = ref('')
 const sslEnabled = ref(false)
 const bindAddress = ref('')
+const bindAddressOptions = ref<BindAddressOption[]>([])
+const bindAddressOptionsLoading = ref(false)
 const tunnelEnabled = ref(false)
 
 const savedPhp = ref(false)
@@ -324,7 +334,7 @@ watch(site, (s) => {
   if (!s) return
   phpVersion.value = s.phpVersion ?? ''
   sslEnabled.value = s.sslEnabled ?? false
-  bindAddress.value = s.bindAddress ?? ''
+  bindAddress.value = s.bindAddress || '*'
   tunnelEnabled.value = s.cloudflare?.enabled ?? false
 }, { immediate: true })
 
@@ -337,6 +347,27 @@ async function loadPhpVersions() {
   }
 }
 
+async function loadBindAddressOptions() {
+  bindAddressOptionsLoading.value = true
+  try {
+    bindAddressOptions.value = await fetchBindAddressOptions()
+    const current = bindAddress.value || '*'
+    if (!bindAddressOptions.value.some(o => o.value === current)) {
+      bindAddressOptions.value.push({
+        value: current,
+        label: `${current} (saved, unavailable)`,
+        description: 'Saved site value that is not present on this device right now.',
+        wildcard: current === '*',
+        loopback: false,
+      })
+    }
+  } catch {
+    bindAddressOptions.value = []
+  } finally {
+    bindAddressOptionsLoading.value = false
+  }
+}
+
 function flashSaved(flag: { value: boolean }) {
   flag.value = true
   setTimeout(() => { flag.value = false }, 1500)
@@ -370,7 +401,7 @@ async function onBindAddressChange(v: string) {
     flashSaved(savedBind)
   } catch (e) {
     ElMessage.error(`Update failed: ${errorMessage(e)}`)
-    bindAddress.value = site.value.bindAddress ?? ''
+    bindAddress.value = site.value.bindAddress || '*'
   }
 }
 
@@ -434,6 +465,7 @@ onMounted(async () => {
   try {
     await sitesStore.load()
     await loadPhpVersions()
+    await loadBindAddressOptions()
     await loadRecentActivity()
   } finally {
     loading.value = false

src/frontend/src/components/pages/SiteEdit.vue

@@ -65,14 +65,21 @@
                     </el-input>
                   </el-form-item>
                   <el-form-item :label="$t('sites.bindIp')">
-                    <el-input
+                    <el-select
                       v-model="site.bindAddress"
-                      clearable
-                      placeholder="* or 127.0.0.1"
-                      @input="markDirty"
+                      style="width: 100%"
+                      filterable
+                      :loading="bindAddressOptionsLoading"
+                      :disabled="bindAddressOptionsLoading || bindAddressOptions.length === 0"
+                      @change="markDirty"
                     >
-                      <template #prepend><el-icon><Link /></el-icon></template>
-                    </el-input>
+                      <el-option
+                        v-for="opt in bindAddressOptions"
+                        :key="opt.value"
+                        :label="opt.label"
+                        :value="opt.value"
+                      />
+                    </el-select>
                     <div class="hint">{{ $t('sites.bindIpHint') }}</div>
                   </el-form-item>
                   <el-form-item :label="$t('sites.documentRoot')" required>
@@ -663,8 +670,10 @@ import {
   fetchDockerComposeStatus, type DockerComposeStatus,
   composeUp, composeDown, composeRestart, composePs,
   getHistoricalMetrics,
+  fetchBindAddressOptions,
   fetchPhpVersions,
   daemonBaseUrl,
+  type BindAddressOption,
 } from '../../api/daemon'
 import { errorMessage } from '../../utils/errors'
 import { use } from 'echarts/core'
@@ -702,6 +711,8 @@ const renameNewDomain = ref('')
 const composeInfo = ref<DockerComposeStatus | null>(null)
 const composeLoading = ref(false)
 const composeOutput = ref('')
+const bindAddressOptions = ref<BindAddressOption[]>([])
+const bindAddressOptionsLoading = ref(false)
 
 async function runCompose(action: 'up' | 'down' | 'restart' | 'ps') {
   if (!site.value) return
@@ -1053,6 +1064,7 @@ async function load() {
     await sitesStore.load()
     const found = sitesStore.sites.find(s => s.domain === domain.value)
     site.value = found ? { ...found, aliases: [...(found.aliases ?? [])] } : null
+    if (site.value && !site.value.bindAddress) site.value.bindAddress = '*'
     dirty.value = false
 
     // PHP versions — authoritative list from daemon. Leave the array
@@ -1073,6 +1085,25 @@ async function load() {
       })
     } catch { phpVersions.value = [] }
 
+    bindAddressOptionsLoading.value = true
+    try {
+      bindAddressOptions.value = await fetchBindAddressOptions()
+      const current = site.value?.bindAddress || '*'
+      if (site.value && current && !bindAddressOptions.value.some(o => o.value === current)) {
+        bindAddressOptions.value.push({
+          value: current,
+          label: `${current} (saved, unavailable)`,
+          description: 'Saved site value that is not present on this device right now.',
+          wildcard: current === '*',
+          loopback: false,
+        })
+      }
+    } catch {
+      bindAddressOptions.value = []
+    } finally {
+      bindAddressOptionsLoading.value = false
+    }
+
     // history
     try {
       const res = await fetch(`${daemonBaseUrl()}/api/sites/${domain.value}/history`, {