Bind to loopback by default

Can be overriden using $HOST

Also advance nixpkgs

CHANGELOG.md

@@ -9,6 +9,7 @@
   - Re-add `<script>` tags on hot reload
   - Scroll to top on route switches
   - Use secure websockets when on HTTPS
+  - Bind to loopback (127.0.0.1) for security reasons
 - `Asset` type
   - Introduce the `Asset` type to distinguishing between static files and generated files. The later can be one of `Html` or `Other`, allowing the live server to handle them sensibly.
   - `Ema` typeclass: 

flake.lock

@@ -33,17 +33,17 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1630140382,
-        "narHash": "sha256-ntXepAHFlAEtaYIU5EzckRUODeeMgpu1u2Yug+4LFNc=",
+        "lastModified": 1630850248,
+        "narHash": "sha256-OzJi6Olf7mSVhGt3W7qOMVP5Qk1lH60zlHeCcITzfv0=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "08ef0f28e3a41424b92ba1d203de64257a9fca6a",
+        "rev": "23d5823337f4502dfa17e192d8c53a47cabcb6b4",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "08ef0f28e3a41424b92ba1d203de64257a9fca6a",
+        "rev": "23d5823337f4502dfa17e192d8c53a47cabcb6b4",
         "type": "github"
       }
     },

flake.nix

@@ -1,7 +1,7 @@
 {
   description = "Ema project";
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/08ef0f28e3a41424b92ba1d203de64257a9fca6a";
+    nixpkgs.url = "github:nixos/nixpkgs/23d5823337f4502dfa17e192d8c53a47cabcb6b4";
     flake-utils.url = "github:numtide/flake-utils";
     flake-compat = {
       url = "github:edolstra/flake-compat";

src/Ema/App.hs

@@ -118,7 +118,8 @@ runEmaWithCliInCwd cliAction model render = do
         Generate.generate dest val (render cliAction)
     CLI.Run -> do
       port <- liftIO $ fromMaybe 8000 . (readMaybe @Int =<<) <$> lookupEnv "PORT"
-      Server.runServerWithWebSocketHotReload port model (render cliAction)
+      host <- liftIO $ fromMaybe "127.0.0.1" <$> lookupEnv "HOST"
+      Server.runServerWithWebSocketHotReload host port model (render cliAction)
   where
     -- Temporarily use block buffering before calling an IO action that is
     -- known ahead to log rapidly, so as to not hamper serial processing speed.

src/Ema/Server.hs

@@ -32,16 +32,20 @@ runServerWithWebSocketHotReload ::
     MonadUnliftIO m,
     MonadLoggerIO m
   ) =>
+  String ->
   Int ->
   LVar model ->
   (model -> route -> Asset LByteString) ->
   m ()
-runServerWithWebSocketHotReload port model render = do
-  let settings = Warp.setPort port Warp.defaultSettings
+runServerWithWebSocketHotReload host port model render = do
+  let settings =
+        Warp.defaultSettings
+          & Warp.setPort port
+          & Warp.setHost (fromString host)
   logger <- askLoggerIO
 
   logInfoN "============================================"
-  logInfoN $ "Running live server at http://localhost:" <> show port
+  logInfoN $ "Running live server at http://" <> toText host <> ":" <> show port
   logInfoN "============================================"
   liftIO $
     Warp.runSettings settings $