feat(script): Auto bind WebUI to 0.0.0.0 in headless mode #696
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
审阅者指南（在小型 PR 上默认折叠）审阅者指南在无头（xvfb）模式下，启动脚本现在会将 WebUI 绑定到 0.0.0.0，并向用户警告潜在的暴露风险，同时进行了少量空白字符清理。 无头启动时将 WebUI 绑定到 0_0_0_0 的时序图sequenceDiagram
actor User
participant start_linux_sh
participant xvfb_run
participant LLBOT_CLI
participant WebUI_Client
User->>start_linux_sh: run start_linux_sh
start_linux_sh->>start_linux_sh: detect_headless_mode USE_XVFB=1
start_linux_sh->>User: warn Headless mode will listen on 0.0.0.0
start_linux_sh->>User: warn Restrict access via firewall or SSH tunnel
start_linux_sh->>xvfb_run: exec xvfb_run -a LLBOT_CLI_BIN --host=0.0.0.0
xvfb_run->>LLBOT_CLI: start WebUI bound to 0.0.0.0
WebUI_Client->>LLBOT_CLI: HTTP request to WebUI on 0.0.0.0
LLBOT_CLI-->>WebUI_Client: WebUI response
文件级变更
提示与命令与 Sourcery 交互
自定义你的体验访问你的 控制面板 以：
获取帮助Original review guide in EnglishReviewer's guide (collapsed on small PRs)Reviewer's GuideIn headless (xvfb) mode the startup script now binds the WebUI to 0.0.0.0 and warns the user about potential exposure, while also doing minor whitespace cleanups. Sequence diagram for headless startup binding WebUI to 0_0_0_0sequenceDiagram
actor User
participant start_linux_sh
participant xvfb_run
participant LLBOT_CLI
participant WebUI_Client
User->>start_linux_sh: run start_linux_sh
start_linux_sh->>start_linux_sh: detect_headless_mode USE_XVFB=1
start_linux_sh->>User: warn Headless mode will listen on 0.0.0.0
start_linux_sh->>User: warn Restrict access via firewall or SSH tunnel
start_linux_sh->>xvfb_run: exec xvfb_run -a LLBOT_CLI_BIN --host=0.0.0.0
xvfb_run->>LLBOT_CLI: start WebUI bound to 0.0.0.0
WebUI_Client->>LLBOT_CLI: HTTP request to WebUI on 0.0.0.0
LLBOT_CLI-->>WebUI_Client: WebUI response
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - 我在这里给出了一些总体反馈：
- 与其硬编码
--host=0.0.0.0，不如考虑从一个可配置变量中读取绑定地址（例如使用默认值为0.0.0.0的LLBOT_WEB_HOST），这样在无头运行时，用户可以选择使用更受限制的绑定地址。 - 这一行
env $IM_ENV xvfb-run -a "$LLBOT_CLI_BIN" --host=0.0.0.0可以通过显式导出变量并避免单词拆分来变得更健壮（例如将IM_ENV用作在env调用之前的KEY=VALUE形式的导出，或者改用LLBOT_WEB_HOST=${LLBOT_WEB_HOST:-0.0.0.0}，并显式传递该变量）。
给 AI 代理的提示
Please address the comments from this code review:
## Overall Comments
- Instead of hardcoding `--host=0.0.0.0`, consider reading the bind address from a configurable variable (e.g. `LLBOT_WEB_HOST` with a default of `0.0.0.0`) so users can opt into a more restrictive binding when running headless.
- The `env $IM_ENV xvfb-run -a "$LLBOT_CLI_BIN" --host=0.0.0.0` line could be made more robust by explicitly exporting variables and avoiding word-splitting (e.g. using `IM_ENV` as `KEY=VALUE` exports before the `env` call or switching to `LLBOT_WEB_HOST=${LLBOT_WEB_HOST:-0.0.0.0}` and passing that variable explicitly).帮我变得更有用！请在每条评论上点 👍 或 👎，我会根据你的反馈改进之后的评审。
Original comment in English
Hey - I've left some high level feedback:
- Instead of hardcoding
--host=0.0.0.0, consider reading the bind address from a configurable variable (e.g.LLBOT_WEB_HOSTwith a default of0.0.0.0) so users can opt into a more restrictive binding when running headless. - The
env $IM_ENV xvfb-run -a "$LLBOT_CLI_BIN" --host=0.0.0.0line could be made more robust by explicitly exporting variables and avoiding word-splitting (e.g. usingIM_ENVasKEY=VALUEexports before theenvcall or switching toLLBOT_WEB_HOST=${LLBOT_WEB_HOST:-0.0.0.0}and passing that variable explicitly).
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Instead of hardcoding `--host=0.0.0.0`, consider reading the bind address from a configurable variable (e.g. `LLBOT_WEB_HOST` with a default of `0.0.0.0`) so users can opt into a more restrictive binding when running headless.
- The `env $IM_ENV xvfb-run -a "$LLBOT_CLI_BIN" --host=0.0.0.0` line could be made more robust by explicitly exporting variables and avoiding word-splitting (e.g. using `IM_ENV` as `KEY=VALUE` exports before the `env` call or switching to `LLBOT_WEB_HOST=${LLBOT_WEB_HOST:-0.0.0.0}` and passing that variable explicitly).Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Contributor
Author
|
不对，我好像理解错了。 |
Collaborator
|
这里的 host 是 pmhq 的 host，如果想要默认开放 webui 到 0.0.0.0，那么要像 Docker script 一样强制让用户输入设置 webui 密码，然后修改 |
Contributor
Author
|
对，我理解错了（
在 2026-01-31 12:44:07，"linyuchen" ***@***.***> 写道：
linyuchen left a comment (LLOneBot/LuckyLilliaBot#696)
这里的 host 是 pmhq 的 host，如果想要默认开放 webui 到 0.0.0.0，那么要像 Docker script 一样强制让用户输入设置 webui 密码，然后修改 default_config.json 或者 config_<qq>.json 中的 webui.host
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you modified the open/close state.Message ID: ***@***.***>
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary by Sourcery
在无头模式下运行时将 WebUI 绑定到 0.0.0.0，并显示有关潜在暴露风险的安全警告。
新功能：
增强内容：
Original summary in English
Summary by Sourcery
Bind the WebUI to 0.0.0.0 when running in headless mode and surface security warnings about potential exposure.
New Features:
Enhancements: