fix(restream): bind web server to 127.0.0.1 instead of 0.0.0.0

[louzt]

Summary

The restream HLS server was binding to all interfaces (0.0.0.0), exposing the stream to LAN/WAN without authentication. Now binds to localhost only (127.0.0.1).

What Changed

• src-tauri/src/restream.rs:94 — changed bind address from [0,0,0,0] to [127,0,0,1]

Why

Reported as #424 — Unauthenticated restream server bound to 0.0.0.0.

Compatibility Note

No breaking changes for local playback. Restream sharing across LANs will need a different mechanism (future work).

Validation

cargo check passes.

[louzt]

Architectural Validation & Core Reasoning

Binding the local HTTP/HLS server to [0, 0, 0, 0] introduces a critical network exposure vector. Because the backend writes transient .ts media segments into a cache directory served dynamically via warp::fs::dir, an unauthenticated socket on 0.0.0.0 broadcasts the active playback stream to all physical and virtual interfaces (LAN, Wi-Fi, active VPNs, and local bridge interfaces).

Mutating this assignment to [127, 0, 0, 1] safely restricts the transport layer to the host's loopback interface, ensuring traffic containment at the kernel level.

flowchart TD
    subgraph Exposed ["Exposed Architecture: 0.0.0.0"]
        Tauri1["Tauri Frontend"] -->|Loopback Traffic| Warp1["Warp HLS Server"]
        LAN1["LAN Scraper / Rogue Node"] -->|Wi-Fi / VPN / LAN| Warp1
        Warp1 -->|Unauthenticated Stream Leak| LAN1
    end

    subgraph Hardened ["Hardened Perimeter: 127.0.0.1"]
        Tauri2["Tauri Frontend"] -->|Loopback Traffic| Warp2["Warp HLS Server"]
        LAN2["LAN Scraper / Rogue Node"] --x|Connection Refused| Warp2
    end

Loading

[louzt]

Low-Level Operational Edge Cases Handled:

Dual-Stack IPv6 Resolution Gotcha (::1 vs 127.0.0.1): Forcing an explicit IPv4 byte array ([127, 0, 0, 1]) limits warp strictly to the IPv4 stack. To prevent connection timeouts or infinite hangs on modern Linux/macOS nodes where localhost resolves natively to ::1, the frontend IPC mechanism must explicitly route media requests to http://127.0.0.1:[port] instead of using the localhost string abstraction.

LAN Casting Trade-off (Secure-by-Default): Local loopback isolation inherently prevents smart TVs or local streaming sticks (e.g., Chromecast) from scraping media segments directly from this node. This is an intentional architectural boundary to prioritize zero-trust local operation. Any future local network file-sharing or casting capability must rely on authenticated reverse proxies or token-gated tunnels rather than dropping global network interface guards. IMO, ofc.