fix(gateway): keep production app ports private

2026-07-19 22:24:28 +05:30
parent 5ce45b4973
commit 33730c68ab
4 changed files with 30 additions and 1 deletions
@@ -646,6 +646,15 @@ const MIGRATIONS: Migration[] = [
      // Existing workspaces can invoke `wrnexus production` without generated-file changes.
    },
  },
+  {
+    version: "0.2.65",
+    id: "private-production-app-listeners",
+    description:
+      "Restricts workspace-managed production app servers to loopback so external clients must use the gateway.",
+    apply() {
+      // The production gateway applies the private bind address automatically.
+    },
+  },
 ];

 /** Release tooling uses this to require an explicit migration entry per version. */