fix(config): bind metrics port to loopback by default

[sanjio3]

Summary

The metrics/tool API daemon binds cfg.MetricsPort, which defaulted to :2112 鈥?an empty host binds all interfaces (including IPv6), exposing the tools API beyond loopback. The main API daemon defaults BindAddress to 127.0.0.1, so the two listeners had inconsistent exposure.

Changes

• Change the default MetricsPort to 127.0.0.1:2112 so the tools API binds loopback by default, matching the main API
• Add a regression test asserting both BindAddress and MetricsPort default to loopback

Users who explicitly configure metrics_port: :2112 keep the ability to expose it; this only changes the default.

Fixes #1449

Summary by CodeRabbit

• Configuration

  • Metrics now bind by default to the local loopback address at 127.0.0.1:2112, limiting access to the host running the service.

• Tests

  • Added coverage to verify the default loopback binding for the API and metrics endpoint.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: acf35a48-619d-478e-b915-88c7318c9a52

📥 Commits

Reviewing files that changed from the base of the PR and between f7f7876 and f430a31.

📒 Files selected for processing (2)

• cmd/api/src/config/default.go
• cmd/api/src/config/default_test.go

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The default metrics address changed from :2112 to 127.0.0.1:2112. A test verifies the loopback bind address and metrics endpoint.

Changes

Metrics loopback binding

Layer / File(s)	Summary
Default metrics binding and validation cmd/api/src/config/default.go, cmd/api/src/config/default_test.go	The default metrics endpoint binds to 127.0.0.1:2112. The test verifies the loopback bind address and metrics address.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: mvlipka

Merge Risk: ⚪ Minimal · up to f430a

The metrics and diagnostic endpoints now default to loopback, reducing unintended network exposure without affecting explicit configurations.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the problem, the code changes, the regression test, and the issue reference. However, it does not follow the repository template because it omits the required Motivation and C…	Add the missing template sections. State the motivation and context, describe the test environment and commands run, select the applicable change type, and complete the checklist. Use the required issue-resolution format if applicable, such…
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: binding the metrics port to loopback by default.
Linked Issues check	✅ Passed	Issue #1449 requires the default metrics listener to bind only to 127.0.0.1. The PR changes MetricsPort from ":2112" to "127.0.0.1:2112" in NewDefaultConfiguration. BindAddress already defaults to "12…
Out of Scope Changes check	✅ Passed	The PR changes only the default metrics bind address and adds a focused regression test. These changes directly support issue #1449. No unrelated change is shown.

Full details: Description check

Explanation

The description explains the problem, the code changes, the regression test, and the issue reference. However, it does not follow the repository template because it omits the required Motivation and Context, How Has This Been Tested, Types of changes, and Checklist sections.

Resolution

Add the missing template sections. State the motivation and context, describe the test environment and commands run, select the applicable change type, and complete the checklist. Use the required issue-resolution format if applicable, such as "Resolves #1449".

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}