Is UI reachable just from localhost?

[sadielpi]

UI can be reachable from others computers in the local network?

[DeusData]

Short answer: no — the UI is not reachable from other computers on your local network, and that is deliberate rather than a configuration gap.

The HTTP server binds IPv4 loopback only. It is hardcoded at src/ui/httpd.c:248:

addr.sin_addr.s_addr = htonl(0x7F000001); /* 127.0.0.1 */

and the invariant is stated in src/ui/httpd.h:12 — "Binds 127.0.0.1 only (IPv4 loopback). Never any other interface." Beyond the bind itself, incoming requests are validated against a literal loopback Origin/Host (src/ui/http_server.c:78, :91, :1636), which is what currently stands in for DNS-rebinding protection.

The reason it matters: there is no authentication layer in the server at all. Loopback is the access-control boundary — the UI exposes a queryable index of your source code, so anything that can reach the port can read it.

If you need it from another machine today, SSH port forwarding works precisely because the bind is loopback:

ssh -L 9749:127.0.0.1:9749 user@host

That terminates on the remote loopback interface and satisfies the origin check. A reverse proxy also works but needs proxy_set_header Host 127.0.0.1:9749 to pass the same validation.

Making the bind address configurable is an open request — see #1210, which asks for exactly this for VPS deployments. It is a genuine security-posture decision rather than a flag, so I have not pre-judged it there either; if this matters to you, that issue is the right place to add your use case.