feat(docker): make the core NATS bind host configurable (#1411)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: FelixTJDietrich

.changeset/configurable-nats-bind.md

@@ -0,0 +1,10 @@
+---
+"hephaestus": minor
+---
+
+The core NATS port can now be exposed beyond localhost. It stays bound to `127.0.0.1` by default;
+set `NATS_BIND_HOST=0.0.0.0` (or a specific interface address) to let other hosts reach the bus — for
+example when a separate environment consumes events from this one's JetStream.
+
+**Operators:** only expose it on a trusted or firewalled network. The bus is unauthenticated, so a
+public bind puts its contents within reach of anyone who can route to the host.

docker/compose.core.yaml

@@ -107,7 +107,9 @@ services:
     image: nats:alpine
     restart: unless-stopped
     ports:
-      - "127.0.0.1:4222:4222"
+      # Loopback-only by default. Set NATS_BIND_HOST=0.0.0.0 (or a specific interface) to let other
+      # hosts reach the bus — only on a trusted or firewalled network, as NATS runs unauthenticated.
+      - "${NATS_BIND_HOST:-127.0.0.1}:4222:4222"
     command: ["--config", "/etc/nats/nats-server.conf"]
     volumes:
       - nats-data:/data