Skip to content

feat(docker): make the core NATS bind host configurable #1411

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
FelixTJDietrich merged 2 commits into from
Jul 21, 2026
Merged

feat(docker): make the core NATS bind host configurable #1411

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
543eb7b
feat(docker): make the core NATS bind host configurable
FelixTJDietrich Jul 20, 2026
3f19275
Merge branch 'main' into feat/configurable-nats-bind
FelixTJDietrich Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .changeset/configurable-nats-bind.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
---
"hephaestus": minor
---

The core NATS port can now be exposed beyond localhost. It stays bound to `127.0.0.1` by default;
set `NATS_BIND_HOST=0.0.0.0` (or a specific interface address) to let other hosts reach the bus — for
example when a separate environment consumes events from this one's JetStream.

**Operators:** only expose it on a trusted or firewalled network. The bus is unauthenticated, so a
public bind puts its contents within reach of anyone who can route to the host.
4 changes: 3 additions & 1 deletion docker/compose.core.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,9 @@ services:
image: nats:alpine
restart: unless-stopped
ports:
- "127.0.0.1:4222:4222"
# Loopback-only by default. Set NATS_BIND_HOST=0.0.0.0 (or a specific interface) to let other
# hosts reach the bus — only on a trusted or firewalled network, as NATS runs unauthenticated.
- "${NATS_BIND_HOST:-127.0.0.1}:4222:4222"
command: ["--config", "/etc/nats/nats-server.conf"]
volumes:
- nats-data:/data
Expand Down
Loading