adam/potato-mesh
1
0 Fork 0
mirror of https://github.com/l5yth/potato-mesh.git synced 2026-10-30 19:41:58 +01:00
Code Issues 8 Packages Projects Releases Wiki Activity

Host not permitted #55

New Issue
Closed
opened 2026-10-04 22:58:20 +02:00 by adam · 5 comments
adam commented 2026-10-04 22:58:20 +02:00
Owner
Copy link
Copy source

Hi,

i have the following problem...

my router have a static ip address and my server where i run my apps have a local ip and just forwarding the ports but potato don't want to work with port forwarding and i get this error "Host not permitted".

what do i need to change?
Thank's
Aurel.

i have found in logs this: WARN -- : attack prevented by Rack::Protection::HostAuthorization

Hi, i have the following problem... my router have a static ip address and my server where i run my apps have a local ip and just forwarding the ports but potato don't want to work with port forwarding and i get this error "Host not permitted". what do i need to change? Thank's Aurel. ------- i have found in logs this: WARN -- : attack prevented by Rack::Protection::HostAuthorization <!-- github-sync-id:3498349767 -->
adam closed this issue 2026-10-04 22:58:20 +02:00
adam commented 2026-10-04 22:58:21 +02:00
Author
Owner
Copy link
Copy source

for the moment i resolved with

configure do
set :host_authorization, { permitted_hosts: [] } # effectively disables the check
end

in app.rb

for the moment i resolved with configure do set :host_authorization, { permitted_hosts: [] } # effectively disables the check end in app.rb <!-- github-comment-id:3388552622 -->
adam commented 2026-10-04 22:58:21 +02:00
Author
Owner
Copy link
Copy source

Thank you for reporting. I can look into this.

Do I understand correctly your server is behind a router with port forwarding and the Sinatra web app rejects requests for "security reasons"? I can prepare a patch.

Thank you for reporting. I can look into this. Do I understand correctly your server is behind a router with port forwarding and the Sinatra web app rejects requests for "security reasons"? I can prepare a patch. <!-- github-comment-id:3393010975 -->
adam commented 2026-10-04 22:58:22 +02:00
Author
Owner
Copy link
Copy source

It seems to be because the Sinatra application is in "development" mode by default. By the behavior below, it seems to only accept connections from RFC1918 IP-addresses but not from the internet when in development.

I used the variable export APP_ENV="production" to change it into accepting external requests.

My instance is running behind a reverse proxy (HAproxy) working great serving the internet.

== Sinatra (v4.1.1) has taken the stage on 41447 for development with backup from Puma
Puma starting in single mode...

  • Puma version: 7.0.4 ("Romantic Warrior")
  • Ruby version: ruby 3.2.3 (2024-01-18 revision 52bb2ac0a6) [x86_64-linux-gnu]
  • Min threads: 0
  • Max threads: 5
  • Environment: development
  •      PID: 319005
  • Listening on http://0.0.0.0:41447
    Use Ctrl-C to stop
    W, [2025-10-11T14:39:19.963428 #319005] WARN -- : attack prevented by Rack::Protection::HostAuthorization
    183.156.162.222 - - [11/Oct/2025:14:39:19 +0000] "POST /api/telemetry HTTP/1.1" 403 - 0.0009
    W, [2025-10-11T14:39:23.757813 #319005] WARN -- : attack prevented by Rack::Protection::HostAuthorization
    183.156.162.222 - - [11/Oct/2025:14:39:23 +0000] "GET /api/nodes?limit=1000 HTTP/1.1" 403 - 0.0007
    W, [2025-10-11T14:39:23.760013 #319005] WARN -- : attack prevented by Rack::Protection::HostAuthorization
    183.156.162.222 - - [11/Oct/2025:14:39:23 +0000] "GET /api/neighbors?limit=1000 HTTP/1.1" 403 - 0.0038
    W, [2025-10-11T14:39:23.763348 #319005] WARN -- : attack prevented by Rack::Protection::HostAuthorization
    183.156.162.222 - - [11/Oct/2025:14:39:23 +0000] "GET /api/messages?limit=1000 HTTP/1.1" 403 - 0.0013
    W, [2025-10-11T14:39:23.762089 #319005] WARN -- : attack prevented by Rack::Protection::HostAuthorization
    183.156.162.222 - - [11/Oct/2025:14:39:23 +0000] "GET /api/telemetry?limit=1000 HTTP/1.1" 403 - 0.0029
    W, [2025-10-11T14:39:23.763934 #319005] WARN -- : attack prevented by Rack::Protection::HostAuthorization
    188.148.17.242 - - [11/Oct/2025:14:39:23 +0000] "GET /api/positions?limit=1000 HTTP/1.1" 403 - 0.0015
    192.168.2.103 - - [11/Oct/2025:14:39:29 +0000] "GET / HTTP/1.1" 200 103675 0.1048
    192.168.2.103 - - [11/Oct/2025:14:39:29 +0000] "GET / HTTP/1.1" 200 103675 0.1053
    192.168.2.103 - - [11/Oct/2025:14:39:29 +0000] "GET /potatomesh-logo.svg HTTP/1.1" 304 - 0.0004
    192.168.2.103 - - [11/Oct/2025:14:39:29 +0000] "GET /potatomesh-logo.svg HTTP/1.1" 304 - 0.0008
    192.168.2.103 - - [11/Oct/2025:14:39:29 +0000] "GET /api/neighbors?limit=1000 HTTP/1.1" 200 2 0.0675
    192.168.2.103 - - [11/Oct/2025:14:39:29 +0000] "GET /api/neighbors?limit=1000 HTTP/1.1" 200 2 0.0687
It seems to be because the Sinatra application is in "development" mode by default. By the behavior below, it seems to only accept connections from RFC1918 IP-addresses but not from the internet when in development. I used the variable **export APP_ENV="production"** to change it into accepting external requests. My instance is running behind a reverse proxy (HAproxy) working great serving the internet. == Sinatra (v4.1.1) has taken the stage on 41447 for development with backup from Puma Puma starting in single mode... * Puma version: 7.0.4 ("Romantic Warrior") * Ruby version: ruby 3.2.3 (2024-01-18 revision 52bb2ac0a6) [x86_64-linux-gnu] * Min threads: 0 * Max threads: 5 * Environment: development * PID: 319005 * Listening on http://0.0.0.0:41447 Use Ctrl-C to stop W, [2025-10-11T14:39:19.963428 #319005] WARN -- : attack prevented by Rack::Protection::HostAuthorization 183.156.162.222 - - [11/Oct/2025:14:39:19 +0000] "POST /api/telemetry HTTP/1.1" 403 - 0.0009 W, [2025-10-11T14:39:23.757813 #319005] WARN -- : attack prevented by Rack::Protection::HostAuthorization 183.156.162.222 - - [11/Oct/2025:14:39:23 +0000] "GET /api/nodes?limit=1000 HTTP/1.1" 403 - 0.0007 W, [2025-10-11T14:39:23.760013 #319005] WARN -- : attack prevented by Rack::Protection::HostAuthorization 183.156.162.222 - - [11/Oct/2025:14:39:23 +0000] "GET /api/neighbors?limit=1000 HTTP/1.1" 403 - 0.0038 W, [2025-10-11T14:39:23.763348 #319005] WARN -- : attack prevented by Rack::Protection::HostAuthorization 183.156.162.222 - - [11/Oct/2025:14:39:23 +0000] "GET /api/messages?limit=1000 HTTP/1.1" 403 - 0.0013 W, [2025-10-11T14:39:23.762089 #319005] WARN -- : attack prevented by Rack::Protection::HostAuthorization 183.156.162.222 - - [11/Oct/2025:14:39:23 +0000] "GET /api/telemetry?limit=1000 HTTP/1.1" 403 - 0.0029 W, [2025-10-11T14:39:23.763934 #319005] WARN -- : attack prevented by Rack::Protection::HostAuthorization 188.148.17.242 - - [11/Oct/2025:14:39:23 +0000] "GET /api/positions?limit=1000 HTTP/1.1" 403 - 0.0015 192.168.2.103 - - [11/Oct/2025:14:39:29 +0000] "GET / HTTP/1.1" 200 103675 0.1048 192.168.2.103 - - [11/Oct/2025:14:39:29 +0000] "GET / HTTP/1.1" 200 103675 0.1053 192.168.2.103 - - [11/Oct/2025:14:39:29 +0000] "GET /potatomesh-logo.svg HTTP/1.1" 304 - 0.0004 192.168.2.103 - - [11/Oct/2025:14:39:29 +0000] "GET /potatomesh-logo.svg HTTP/1.1" 304 - 0.0008 192.168.2.103 - - [11/Oct/2025:14:39:29 +0000] "GET /api/neighbors?limit=1000 HTTP/1.1" 200 2 0.0675 192.168.2.103 - - [11/Oct/2025:14:39:29 +0000] "GET /api/neighbors?limit=1000 HTTP/1.1" 200 2 0.0687 <!-- github-comment-id:3393393180 -->
adam commented 2026-10-04 22:58:23 +02:00
Author
Owner
Copy link
Copy source

I added a Production section to the readme.

https://github.com/l5yth/potato-mesh?tab=readme-ov-file#production

This also works behind nginx reverse proxy.

I added a **Production** section to the readme. https://github.com/l5yth/potato-mesh?tab=readme-ov-file#production This also works behind nginx reverse proxy. <!-- github-comment-id:3393395748 -->
adam commented 2026-10-04 22:58:23 +02:00
Author
Owner
Copy link
Copy source

Minimal production example:

#!/usr/bin/env bash

set -euo pipefail

export RACK_ENV=production
export APP_ENV=production
export API_TOKEN="super-secure-do-not-use"
export INSTANCE_DOMAIN="https://example.com"
export DEBUG=0
export FEDERATION=1
export PRIVATE=0

while true; do
  ruby app.rb -p 41447 -o 0.0.0.0
  sleep 60
done
Minimal production example: ``` #!/usr/bin/env bash set -euo pipefail export RACK_ENV=production export APP_ENV=production export API_TOKEN="super-secure-do-not-use" export INSTANCE_DOMAIN="https://example.com" export DEBUG=0 export FEDERATION=1 export PRIVATE=0 while true; do ruby app.rb -p 41447 -o 0.0.0.0 sleep 60 done ``` <!-- github-comment-id:3394040934 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/potato-mesh#55