feat(sites): add per-site bind address

Author: lukyrys

src/daemon/NKS.WebDevConsole.Core/Models/SiteConfig.cs

@@ -8,6 +8,11 @@ public class SiteConfig
     public bool SslEnabled { get; set; }
     public int HttpPort { get; set; } = 80;
     public int HttpsPort { get; set; } = 443;
+    /// <summary>
+    /// Optional IP address used by generated per-site vhosts. Empty or "*"
+    /// means bind on every Apache listener address.
+    /// </summary>
+    public string BindAddress { get; set; } = "";
 
     /// <summary>
     /// Task 31: soft enable/disable flag. When false, the site's TOML

src/daemon/NKS.WebDevConsole.Daemon/Program.cs

@@ -7343,6 +7343,7 @@ await File.WriteAllTextAsync(indexPath,
                 PhpVersion = "",
                 SslEnabled = true,
                 Enabled = true,
+                Aliases = new[] { "127.0.0.1" },
             });
             await siteOrch.ApplyAsync(created, CancellationToken.None);
         }

src/daemon/NKS.WebDevConsole.Daemon/Sites/SiteManager.cs

@@ -175,10 +175,25 @@ public static void ValidateDocumentRoot(string documentRoot)
                 throw new ArgumentException($"DocumentRoot contains forbidden character: '{c}'");
     }
 
+    public static void ValidateBindAddress(string? bindAddress)
+    {
+        if (string.IsNullOrWhiteSpace(bindAddress) || bindAddress.Trim() == "*")
+            return;
+        if (bindAddress.Length > 64)
+            throw new ArgumentException("BindAddress too long (max 64 chars)");
+        var value = bindAddress.Trim();
+        if (value.Any(c => char.IsWhiteSpace(c) || c is '"' or '\'' or ';' or '|' or '&' or '`' or '<' or '>' or '\0'))
+            throw new ArgumentException("BindAddress contains forbidden characters");
+        var unwrapped = value.StartsWith('[') && value.EndsWith(']') ? value[1..^1] : value;
+        if (!System.Net.IPAddress.TryParse(unwrapped, out _))
+            throw new ArgumentException("BindAddress must be an IP address or '*'");
+    }
+
     public async Task<SiteConfig> CreateAsync(SiteConfig site)
     {
         ValidateDomain(site.Domain);
         ValidateDocumentRoot(site.DocumentRoot);
+        ValidateBindAddress(site.BindAddress);
         if (site.Aliases is { Length: > 0 })
             foreach (var alias in site.Aliases)
                 ValidateAlias(alias);
@@ -211,6 +226,7 @@ public async Task<SiteConfig> UpdateAsync(SiteConfig site)
         // via crafted PUT body). Same treatment as Delete/Create.
         ValidateDomain(site.Domain);
         ValidateDocumentRoot(site.DocumentRoot);
+        ValidateBindAddress(site.BindAddress);
         if (site.Aliases is { Length: > 0 })
             foreach (var alias in site.Aliases)
                 ValidateAlias(alias);
@@ -334,13 +350,15 @@ public async Task GenerateVhostAsync(SiteConfig site)
         catch { /* ignore */ }
 
         var apacheSettings = site.ApacheSettings;
+        var aliases = NormalizeAliases(site.Domain, site.Aliases);
 
         var model = new
         {
             site = new
             {
                 domain = site.Domain,
-                aliases = site.Aliases,
+                aliases = aliases,
+                bind_address = FormatApacheBindAddress(site.BindAddress),
                 root = site.DocumentRoot,
                 root_parent = rootParent,
                 php_ini_path = sitePhpIni,
@@ -399,6 +417,34 @@ public async Task GenerateVhostAsync(SiteConfig site)
         return candidates.FirstOrDefault(File.Exists);
     }
 
+    public static string[] NormalizeAliases(string domain, IEnumerable<string>? aliases)
+    {
+        var result = new List<string>();
+        var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        foreach (var alias in aliases ?? Array.Empty<string>())
+        {
+            var value = alias.Trim();
+            if (!string.IsNullOrWhiteSpace(value) && seen.Add(value))
+                result.Add(value);
+        }
+        if (string.Equals(domain, "localhost", StringComparison.OrdinalIgnoreCase)
+            && seen.Add("127.0.0.1"))
+        {
+            result.Add("127.0.0.1");
+        }
+        return result.ToArray();
+    }
+
+    public static string FormatApacheBindAddress(string? bindAddress)
+    {
+        if (string.IsNullOrWhiteSpace(bindAddress) || bindAddress.Trim() == "*")
+            return "*";
+        var value = bindAddress.Trim();
+        if (value.StartsWith('[') && value.EndsWith(']'))
+            return value;
+        return value.Contains(':') ? $"[{value}]" : value;
+    }
+
     /// <summary>
     /// Detects the PHP framework powering a site by inspecting its document root
     /// and parent directory (Laravel/Symfony/Nette typically have docroot=public/ or www/).

src/frontend/src/api/types.ts

@@ -56,6 +56,8 @@ export interface SiteInfo {
   sslEnabled: boolean
   httpPort: number
   httpsPort: number
+  /** Empty or "*" binds on every Apache listener address; use an IP such as 127.0.0.1 for loopback-only sites. */
+  bindAddress?: string
   aliases: string[]
   /** Task 31: soft enable/disable. When false, httpd vhosts are removed
    *  on apply; the TOML config stays on disk. Default true for backward

src/frontend/src/components/pages/SiteDetailSimple.vue

@@ -67,6 +67,23 @@
         </div>
       </div>
 
+      <!-- Bind IP -->
+      <div class="sd-row sd-row-stack">
+        <span class="sd-label">{{ $t('sites.bindIp') }}</span>
+        <div class="sd-control-wrap sd-bind-control">
+          <el-input
+            v-model="bindAddress"
+            size="small"
+            clearable
+            placeholder="* or 127.0.0.1"
+            @change="onBindAddressChange"
+          />
+          <Transition name="flash">
+            <span v-if="savedBind" class="sd-saved">{{ $t('sites.detail.simple.saved') }}</span>
+          </Transition>
+        </div>
+      </div>
+
       <!-- Cloudflare tunnel switch -->
       <div class="sd-row">
         <span class="sd-label">{{ $t('sites.detail.simple.tunnel') }}</span>
@@ -182,10 +199,12 @@ const site = computed(() => sitesStore.sites.find(s => s.domain === props.domain
 
 const phpVersion = ref('')
 const sslEnabled = ref(false)
+const bindAddress = ref('')
 const tunnelEnabled = ref(false)
 
 const savedPhp = ref(false)
 const savedSsl = ref(false)
+const savedBind = ref(false)
 const savedTunnel = ref(false)
 
 const startStopLoading = ref(false)
@@ -305,6 +324,7 @@ watch(site, (s) => {
   if (!s) return
   phpVersion.value = s.phpVersion ?? ''
   sslEnabled.value = s.sslEnabled ?? false
+  bindAddress.value = s.bindAddress ?? ''
   tunnelEnabled.value = s.cloudflare?.enabled ?? false
 }, { immediate: true })
 
@@ -343,6 +363,17 @@ async function onSslChange(v: boolean) {
   }
 }
 
+async function onBindAddressChange(v: string) {
+  if (!site.value) return
+  try {
+    await sitesStore.update(props.domain, { ...site.value, bindAddress: v.trim() })
+    flashSaved(savedBind)
+  } catch (e) {
+    ElMessage.error(`Update failed: ${errorMessage(e)}`)
+    bindAddress.value = site.value.bindAddress ?? ''
+  }
+}
+
 async function onTunnelChange(v: boolean) {
   if (!site.value) return
   const existing = site.value.cloudflare ?? { enabled: false, subdomain: '', zoneId: '', zoneName: '', localService: 'localhost:80', protocol: 'http' as const }
@@ -445,6 +476,10 @@ onMounted(async () => {
   padding: 10px 0;
 }
 
+.sd-row-stack {
+  align-items: flex-start;
+}
+
 .sd-status-row {
   padding: 12px 0;
 }
@@ -485,6 +520,10 @@ onMounted(async () => {
   gap: 10px;
 }
 
+.sd-bind-control {
+  width: min(260px, 100%);
+}
+
 .sd-status-dot {
   width: 10px;
   height: 10px;

src/frontend/src/components/pages/SiteEdit.vue

@@ -64,6 +64,17 @@
                       <template #prepend><el-icon><Link /></el-icon></template>
                     </el-input>
                   </el-form-item>
+                  <el-form-item :label="$t('sites.bindIp')">
+                    <el-input
+                      v-model="site.bindAddress"
+                      clearable
+                      placeholder="* or 127.0.0.1"
+                      @input="markDirty"
+                    >
+                      <template #prepend><el-icon><Link /></el-icon></template>
+                    </el-input>
+                    <div class="hint">{{ $t('sites.bindIpHint') }}</div>
+                  </el-form-item>
                   <el-form-item :label="$t('sites.documentRoot')" required>
                     <el-input
                       v-model="site.documentRoot"

src/frontend/src/components/pages/Sites.vue

@@ -59,6 +59,12 @@
                 effect="dark"
                 class="runtime-tag runtime-php"
               >{{ rowRuntimeLabel(site) }}</el-tag>
+              <el-tag
+                v-if="site.bindAddress"
+                size="small"
+                effect="plain"
+                class="cell-tag"
+              >{{ site.bindAddress }}</el-tag>
               <span v-if="site.aliases?.length" class="alias-dot">+{{ site.aliases.length }}</span>
               <span v-if="site.aliases?.length" class="site-mobile-alias mono">
                 {{ site.aliases[0] }}
@@ -122,6 +128,13 @@
                     ? `:${row.httpPort || 80}/:${row.httpsPort || 443}`
                     : `:${row.httpPort || 80}`
                 }}</span>
+                <el-tag
+                  v-if="row.bindAddress"
+                  size="small"
+                  effect="plain"
+                  class="cell-tag"
+                  :title="$t('sites.bindIp')"
+                >{{ row.bindAddress }}</el-tag>
                 <el-tag
                   v-if="row.sslEnabled"
                   size="small"
@@ -282,6 +295,13 @@
               <el-option :label="$t('sites.phpNone')" value="none" />
             </el-select>
           </el-form-item>
+          <el-form-item :label="$t('sites.bindIp')">
+            <el-input
+              v-model="newSite.bindAddress"
+              clearable
+              placeholder="* or 127.0.0.1"
+            />
+          </el-form-item>
           <!-- F91.2: new-site toggles hidden when their plugin is disabled. -->
           <el-form-item v-if="pluginsStore.isUiVisible('sites-badge:cloudflare-tunnel')" :label="$t('sites.simple.cloudflareTunnel')">
             <el-switch v-model="newSite.cloudflareTunnel" />
@@ -337,6 +357,14 @@
           <el-form-item :label="$t('sites.aliases')">
             <el-input v-model="newSite.aliases" placeholder="www.myapp.loc" />
           </el-form-item>
+          <el-form-item :label="$t('sites.bindIp')">
+            <el-input
+              v-model="newSite.bindAddress"
+              clearable
+              placeholder="* or 127.0.0.1"
+            />
+            <div class="form-hint">{{ $t('sites.bindIpHint') }}</div>
+          </el-form-item>
           <el-form-item :label="$t('sites.ssl')">
             <el-switch v-model="newSite.sslEnabled" />
           </el-form-item>
@@ -514,6 +542,7 @@ const newSite = reactive({
   // binds v-model to a non-existent option and renders blank.
   phpVersion: '',
   aliases: '',
+  bindAddress: '',
   createDb: false,
   dbName: '',
   // SSL on by default so users opting out is the conscious choice — fresh
@@ -645,6 +674,7 @@ async function createSite() {
       phpVersion: newSite.phpVersion,
       sslEnabled: newSite.sslEnabled,
       aliases: newSite.aliases ? newSite.aliases.split(',').map(s => s.trim()).filter(Boolean) : [],
+      bindAddress: newSite.bindAddress.trim(),
       ...(newSite.cloudflareTunnel ? { cloudflareTunnel: true } : {}),
     }
     const created = await sitesStore.create(payload)
@@ -687,7 +717,7 @@ async function createSite() {
     // again (set once by loadPhpVersions on dialog open) instead of a
     // hardcoded literal that may not exist on this machine.
     const defaultPhp = phpVersions.value.find(p => p.isActive)?.value ?? phpVersions.value[0]?.value ?? ''
-    Object.assign(newSite, { domain: '', documentRoot: '', phpVersion: defaultPhp, aliases: '', sslEnabled: true, createDb: false, dbName: '', cloudflareTunnel: false, template: '' })
+    Object.assign(newSite, { domain: '', documentRoot: '', phpVersion: defaultPhp, aliases: '', bindAddress: '', sslEnabled: true, createDb: false, dbName: '', cloudflareTunnel: false, template: '' })
   } catch (e) {
     ElMessage.error(`Create failed: ${errorMessage(e)}`)
   } finally {
@@ -1256,6 +1286,13 @@ function handleRowAction(cmd: string, row: SiteInfo) {
   line-height: 1.5;
 }
 
+.form-hint {
+  margin-top: 4px;
+  color: var(--wdc-text-3);
+  font-size: 12px;
+  line-height: 1.35;
+}
+
 .simple-advanced-link {
   margin-top: 12px;
   text-align: center;

src/frontend/src/locales/cs.json

@@ -428,6 +428,8 @@
     "filterPlaceholder": "Filtrovat podle domény nebo docrootu…",
     "ssl": "SSL",
     "aliases": "Aliasy",
+    "bindIp": "IP vazba",
+    "bindIpHint": "Prazdne pole navaze vhost na vsechny Apache listen adresy. Pro loopback-only pouzij 127.0.0.1.",
     "create": "Nový web",
     "openHosts": "Otevřít hosts",
     "additionalDomains": "{n} dalších domén",

src/frontend/src/locales/en.json

@@ -428,6 +428,8 @@
     "filterPlaceholder": "Filter by domain or docroot…",
     "ssl": "SSL",
     "aliases": "Aliases",
+    "bindIp": "Bind IP",
+    "bindIpHint": "Leave empty to bind this vhost on every Apache listener. Use 127.0.0.1 for loopback-only.",
     "create": "New Site",
     "openHosts": "Open hosts",
     "additionalDomains": "{n} additional domains",