Bind the desktop backend to the selected interface instead of 0.0.0.0 when network access is on

[prasta1]

Summary

When Network access is on, the desktop backend binds the wildcard address (0.0.0.0) — every interface — even though the advertised endpoint is a single address. I'd like the exposure setting to carry an interface choice that is used as the bind host, so "reachable from my tailnet" doesn't also mean "reachable from whatever Wi-Fi I'm on".

This is a surface-reduction request, not an auth bypass — see the measurements below, auth is correctly enforced on the exposed listener.

Current behaviour

resolveDesktopServerExposure returns bindHost: "0.0.0.0" (DESKTOP_LAN_BIND_HOST) for mode: "network-accessible", while the advertised URL comes from resolveLanAdvertisedHost, which returns the first usable non-internal IPv4 it iterates. So the advertised endpoint names one interface and the listener answers on all of them.

Measured on macOS desktop 0.0.42 (serverExposureMode: "network-accessible", tailscaleServeEnabled: false):

$ lsof -nP -iTCP:3773 -sTCP:LISTEN
T3\x20Cod  *:3773

$ curl -o /dev/null -w '%{http_code}' http://192.168.4.28:3773/     # Wi-Fi LAN
200
$ curl -o /dev/null -w '%{http_code}' http://100.68.81.83:3773/     # tailnet
200

Auth on the exposed listener behaves correctly, which is why I'm filing this as an idea rather than a bug:

GET /api/auth/session            -> {"authenticated":false,"auth":{"policy":"remote-reachable",...}}
GET /api/orchestration/snapshot  -> 401 auth_invalid / missing_credential
GET /ws                          -> 401

Why it matters

For anyone who enabled network access specifically to pair over Tailscale, port 3773 is also open on every untrusted network the laptop joins (coffee shop, hotel, conference Wi-Fi). Unauthenticated callers only reach the SPA shell and a 401, but the listener, its version surface, and the auth/pairing endpoints are still there to be probed. Narrowing the bind removes that entirely rather than defending it.

The headless path already accepts --host ("Host/interface to bind (for example 127.0.0.1, 0.0.0.0, or a Tailnet IP)"), so the capability exists — the desktop toggle just can't reach it.

Proposal

Extend the exposure state with the bind target the user picked, and pass it through to bootstrap.host instead of the DESKTOP_LAN_BIND_HOST constant:

• Tailscale only — bind the tailnet IPv4 (an isTailscaleIpv4Address helper already exists)
• A specific LAN interface — bind that address
• All interfaces — today's 0.0.0.0, still available for people who want it

"Tailscale only" is the case I'd use. Falling back to local-only when the chosen interface disappears would match how unavailable is already handled.

Related

• feat(desktop): choose the network interface used for LAN pairing URLs #10838 — choose the network interface used for LAN pairing URLs (the advertised URL, not the bind host)
• fix(desktop): separate LAN and Tailscale pairing endpoints #9882 (merged) — separate LAN and Tailscale pairing endpoints
• fix(desktop,web): advertise all usable network interfaces as selectable endpoints #5165 — advertise all usable network interfaces as selectable endpoints
• [Bug]: WSL backend binds 0.0.0.0 while "Network access" is off and the UI says "Limited to this machine" #9056 / fix(desktop): honor local-only exposure in the WSL backend bind host #9066 / fix(desktop): [upstream-bound] WSL backend binds the user's exposure host instead of 0.0.0.0 #10358 — WSL backend binding 0.0.0.0 regardless of the setting. Different path (a hardcoded host: "0.0.0.0" in the WSL bootstrap); this request is about the macOS/desktop path where 0.0.0.0 is the intended value for the mode.