Require Authelia for Crawl4AI and bind its port to loopback; update profiles and templates

.github/workflows/test.yml

@@ -75,6 +75,7 @@ jobs:
           # rc=77 = SKIP (test self-disabled — missing optional dep, not-on-CI
           # resources like pipelines/ which is intentionally out of git, root, etc).
           # Same convention as tests/run_all.sh. Don't treat SKIP as FAIL.
+          export PATH="$PWD/tests/ci-bin:$PATH"
           errors=0 passed=0 skipped=0
           for t in tests/unit/*.sh tests/lint/*.sh; do
             [[ -e "$t" ]] || continue
@@ -111,6 +112,7 @@ jobs:
         run: |
           set +e
           # rc=77 = SKIP (same convention as the amd64 lane and tests/run_all.sh)
+          export PATH="$PWD/tests/ci-bin:$PATH"
           errors=0 passed=0 skipped=0
           for t in tests/unit/*.sh tests/lint/*.sh; do
             [[ -e "$t" ]] || continue

install.sh

@@ -1091,11 +1091,11 @@ _save_credentials() {
             echo "=== DB-GPT (Аналитика данных) ==="
             echo "  URL:           http://${ip}:${EXPOSE_DBGPT_PORT:-5670}"
         fi
-        if [[ "${ENABLE_CRAWL4AI:-false}" == "true" ]]; then
+        if [[ "${ENABLE_CRAWL4AI:-false}" == "true" && "${ENABLE_AUTHELIA:-false}" == "true" ]]; then
             echo ""
             echo "=== Crawl4AI (Веб-краулер) ==="
-            echo "  API:           http://${ip}:${EXPOSE_CRAWL4AI_PORT:-11235}"
-            echo "  API Docs:      http://${ip}:${EXPOSE_CRAWL4AI_PORT:-11235}/docs"
+            echo "  API:           http://agmind-crawl.local"
+            echo "  API Docs:      http://agmind-crawl.local/docs"
             echo "  Dify:          HTTP Request tool → POST http://agmind-crawl4ai:11235/crawl"
         fi
         if [[ "${ENABLE_N8N:-false}" == "true" ]]; then
@@ -1505,7 +1505,7 @@ _show_final_summary() {
         if [[ "${ENABLE_SEARXNG:-false}"   == "true" ]]; then
             echo -e "  SearXNG            ${GREEN}http://agmind-search.local${NC}"
         fi
-        if [[ "${ENABLE_CRAWL4AI:-false}"  == "true" ]]; then
+        if [[ "${ENABLE_CRAWL4AI:-false}"  == "true" && "${ENABLE_AUTHELIA:-false}" == "true" ]]; then
             echo -e "  Crawl4AI           ${GREEN}http://agmind-crawl.local/docs${NC}"
         fi
         if [[ "${ENABLE_N8N:-false}"       == "true" ]]; then

lib/_registry.indexed.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # _registry.indexed.sh — DO NOT HAND-EDIT
 # Generated from templates/services/registry.yaml (schema_version=1)
-# Source SHA-12: 2557f030b18c
+# Source SHA-12: 1a5c2e79d8c2
 # Regenerate via: make registry-codegen
 # CI gate: tests/integration/test_registry_codegen_drift.sh fails on stale artifact.
 #
@@ -161,7 +161,7 @@ ALL_COMPOSE_PROFILES="monitoring,portainer,qdrant,weaviate,milvus,authelia,ollam
 
 # shellcheck disable=SC2034
 declare -A NAMED_PROFILE_EXPANSION=(
-    [agents]="litellm,crawl4ai,searxng,dbgpt,openwebui,notebook,n8n"
+    [agents]="litellm,authelia,crawl4ai,searxng,dbgpt,openwebui,notebook,n8n"
     [core]="vllm,litellm"
     [dev]="vllm,litellm,weaviate,docling,monitoring,portainer"
     [full]="vllm,litellm,weaviate,docling,vllm-embed,vllm-rerank,minio,monitoring,portainer,authelia,crawl4ai,searxng,dbgpt,openwebui,notebook,n8n"
@@ -173,7 +173,7 @@ declare -A NAMED_PROFILE_EXPANSION=(
 
 # shellcheck disable=SC2034
 declare -A NAMED_PROFILE_DESC=(
-    [agents]="LiteLLM + Crawl4AI + SearXNG + dbGPT + Open WebUI + Notebook + n8n"
+    [agents]="LiteLLM + Authelia + Crawl4AI + SearXNG + dbGPT + Open WebUI + Notebook + n8n"
     [core]="Dify core + vLLM + LiteLLM (minimal — no RAG)"
     [dev]="Core + observability (fast iteration; no RAGFlow/agents/security)"
     [full]="Everything: vLLM + Weaviate + Docling + monitoring + agents + n8n (Milvus skipped — XOR with Weaviate)"
@@ -185,7 +185,7 @@ declare -A NAMED_PROFILE_DESC=(
 
 # shellcheck disable=SC2034
 declare -A NAMED_PROFILE_IMPLIED=(
-    [agents]="ENABLE_LITELLM=true ENABLE_CRAWL4AI=true ENABLE_SEARXNG=true ENABLE_DBGPT=true ENABLE_OPENWEBUI=true ENABLE_NOTEBOOK=true ENABLE_N8N=true"
+    [agents]="ENABLE_LITELLM=true ENABLE_AUTHELIA=true ENABLE_CRAWL4AI=true ENABLE_SEARXNG=true ENABLE_DBGPT=true ENABLE_OPENWEBUI=true ENABLE_NOTEBOOK=true ENABLE_N8N=true"
     [core]="LLM_PROVIDER=vllm ENABLE_LITELLM=true"
     [dev]="LLM_PROVIDER=vllm ENABLE_LITELLM=true VECTOR_STORE=weaviate ENABLE_DOCLING=true MONITORING_MODE=local ENABLE_PORTAINER=true"
     [full]="LLM_PROVIDER=vllm ENABLE_LITELLM=true VECTOR_STORE=weaviate ENABLE_DOCLING=true EMBED_PROVIDER=vllm-embed ENABLE_RERANKER=true RERANKER_PROVIDER=vllm-rerank ENABLE_MINIO=true MONITORING_MODE=local ENABLE_PORTAINER=true ENABLE_AUTHELIA=true ENABLE_CRAWL4AI=true ENABLE_SEARXNG=true ENABLE_DBGPT=true ENABLE_OPENWEBUI=true ENABLE_NOTEBOOK=true ENABLE_N8N=true"

lib/config.sh

@@ -877,7 +877,10 @@ generate_nginx_config() {
     fi
 
     # Crawl4AI markers
-    if [[ "${ENABLE_CRAWL4AI:-false}" == "true" ]]; then
+    # Security: the Crawl4AI REST API accepts arbitrary crawl URLs and can be
+    # abused as an SSRF primitive. Only expose it through nginx when Authelia is
+    # active; otherwise keep the backend reachable solely on the Docker network.
+    if [[ "${ENABLE_CRAWL4AI:-false}" == "true" && "${ENABLE_AUTHELIA:-false}" == "true" ]]; then
         _atomic_sed "$nginx_conf" 's|#__CRAWL4AI__||g'
     else
         _atomic_sed "$nginx_conf" '/#__CRAWL4AI__/d'
@@ -959,7 +962,7 @@ _register_local_dns() {
     [[ "${ENABLE_DBGPT:-false}" == "true" ]] && names+=("agmind-dbgpt")
     [[ "${ENABLE_NOTEBOOK:-false}" == "true" ]] && names+=("agmind-notebook")
     [[ "${ENABLE_SEARXNG:-false}" == "true" ]] && names+=("agmind-search")
-    [[ "${ENABLE_CRAWL4AI:-false}" == "true" ]] && names+=("agmind-crawl")
+    [[ "${ENABLE_CRAWL4AI:-false}" == "true" && "${ENABLE_AUTHELIA:-false}" == "true" ]] && names+=("agmind-crawl")
     [[ "${ENABLE_RAGFLOW:-false}" == "true" ]] && names+=("agmind-rag")
     [[ "${ENABLE_N8N:-false}" == "true" ]] && names+=("agmind-n8n")
 

lib/status.sh

@@ -128,7 +128,14 @@ _status_active_services() {
 _status_is_active_service() {
     local svc="$1"
     local active
-    active="$(_status_active_services)"
+    # _status_collect_rows calls this once per known service. Cache the active
+    # service set for that collection pass so status/watch remain fast enough
+    # for non-TTY CI checks instead of re-reading the env for every row.
+    if [[ -n "${_STATUS_ACTIVE_SERVICES_CACHE+x}" ]]; then
+        active="${_STATUS_ACTIVE_SERVICES_CACHE}"
+    else
+        active="$(_status_active_services)"
+    fi
     [[ " ${active} " == *" ${svc} "* ]]
 }
 
@@ -476,6 +483,11 @@ _status_collect_rows() {
     local all_svcs
     all_svcs="$(_status_all_known_services)"
 
+    # Compute the active profile set once per render. _status_docker_state calls
+    # _status_is_active_service for every known service, and recomputing this
+    # list per row makes `status --watch` miss its non-TTY timeout budget.
+    _STATUS_ACTIVE_SERVICES_CACHE="$(_status_active_services)"
+
     local svc group state url notes rc_count
 
     for svc in ${all_svcs}; do
@@ -484,6 +496,24 @@ _status_collect_rows() {
         # Determine STATE enum (Pattern 2 — 12 steps)
         state="$(_status_docker_state "$svc" 2>/dev/null || echo "exited")"
 
+        # Cheap terminal states do not need docker inspect/stats/curl detail probes.
+        # This keeps `agmind status --watch` non-TTY one-shot comfortably under
+        # CI timeouts while preserving the same visible state/URL rows.
+        case "$state" in
+            disabled)
+                _status_row_add "$svc" "$group" "$state" "$(_status_service_url "$svc")" "profile off" "0"
+                continue
+                ;;
+            done)
+                _status_row_add "$svc" "$group" "$state" "$(_status_service_url "$svc")" "init complete" "0"
+                continue
+                ;;
+            not-installed)
+                _status_row_add "$svc" "$group" "$state" "$(_status_service_url "$svc")" "not deployed" "0"
+                continue
+                ;;
+        esac
+
         # Restart count (used for NOTES and state override)
         rc_count="$(_status_restart_count "$svc" 2>/dev/null || echo 0)"
 
@@ -508,12 +538,6 @@ _status_collect_rows() {
         case "$state" in
             restarting)
                 notes="$(_status_notes_restart_loop "$rc_count")" ;;
-            disabled)
-                notes="profile off" ;;
-            done)
-                notes="init complete" ;;
-            not-installed)
-                notes="not deployed" ;;
         esac
 
         _status_row_add "$svc" "$group" "$state" "$url" "$notes" "$rc_count"
@@ -544,6 +568,8 @@ _status_collect_rows() {
         fi
         _status_row_add "peer-vllm" "llm" "$peer_state" "—" "peer spark" "0"
     fi
+
+    unset _STATUS_ACTIVE_SERVICES_CACHE
 }
 
 # ============================================================================

lib/wizard.sh

@@ -157,7 +157,7 @@ _wizard_profile() {
             "ragflow"       "RAGFlow: RAGFlow + Elasticsearch + MySQL + MinIO" \
             "observability" "Мониторинг: Prometheus + Grafana + Loki + Portainer" \
             "security"      "Безопасность: Authelia + fail2ban / hardening" \
-            "agents"        "Агенты: LiteLLM + Crawl4AI + SearXNG + dbGPT + Open WebUI + Notebook + n8n" \
+            "agents"        "Агенты: LiteLLM + Authelia + Crawl4AI + SearXNG + dbGPT + Open WebUI + Notebook + n8n" \
             "full"          "Полный стек: vLLM + Weaviate + Docling + monitoring + agents + n8n" \
             "dev"           "Dev: Core + мониторинг (быстрая итерация)" \
             "custom"        "Custom: детальный выбор каждого компонента")
@@ -1804,6 +1804,9 @@ _wizard_optional_services() {
         _wizard_crawl4ai
         _wizard_ragflow
         _wizard_n8n
+        if [[ "${ENABLE_CRAWL4AI:-false}" == "true" ]]; then
+            ENABLE_AUTHELIA="true"
+        fi
         return 0
     fi
 
@@ -1852,6 +1855,13 @@ _wizard_optional_services() {
     # lets anyone on the network claim the admin account on a fresh
     # deploy. Nginx vhost agmind-rag.local proxies the local port for
     # normal LAN access without the direct-port race.
+    if [[ "${ENABLE_CRAWL4AI:-false}" == "true" ]]; then
+        # Crawl4AI exposes a URL-fetching REST API; always pair it with
+        # Authelia so agents/custom installs do not create an unauthenticated
+        # crawler route.
+        ENABLE_AUTHELIA="true"
+    fi
+
     if [[ "${ENABLE_RAGFLOW:-false}" == "true" ]]; then
         if wt_yesno "RAGFlow Direct Port Access" \
             "Открыть порт RAGFlow :9380 напрямую в LAN?\n\nВНИМАНИЕ: пока админ не зарегистрирован, любой в сети может занять админ-аккаунт.\nПо умолчанию доступ только через nginx-проксирование (agmind-rag.local) — безопаснее.\n\nОткрыть :9380 напрямую?"; then
@@ -1914,7 +1924,7 @@ _wizard_summary() {
     if [[ "${ENABLE_SEARXNG:-false}" == "true" ]]; then summary+="$(t wizard.summary.searxng)      agmind-search.local\n"; fi
     if [[ "${ENABLE_NOTEBOOK:-false}" == "true" ]]; then summary+="$(t wizard.summary.notebook) agmind-notebook.local\n"; fi
     if [[ "${ENABLE_DBGPT:-false}" == "true" ]]; then summary+="$(t wizard.summary.dbgpt)       agmind-dbgpt.local\n"; fi
-    if [[ "${ENABLE_CRAWL4AI:-false}" == "true" ]]; then summary+="$(t wizard.summary.crawl4ai)     agmind-crawl.local\n"; fi
+    if [[ "${ENABLE_CRAWL4AI:-false}" == "true" && "${ENABLE_AUTHELIA:-false}" == "true" ]]; then summary+="$(t wizard.summary.crawl4ai)     agmind-crawl.local\n"; fi
     if [[ "${ENABLE_N8N:-false}" == "true" ]]; then summary+="$(t wizard.summary.n8n)         agmind-n8n.local\n"; fi
     if [[ "${ENABLE_OPENWEBUI:-false}" == "true" ]]; then summary+="$(t wizard.summary.openwebui)   agmind-chat.local\n"; fi
     if [[ "${ENABLE_RAGFLOW:-false}" == "true" ]]; then summary+="$(t wizard.summary.ragflow)      $(t wizard.summary.ragflow_val)\n"; fi

templates/docker-compose.yml

@@ -1077,7 +1077,7 @@ services:
       - "${EXPOSE_NOTEBOOK_PORT:-8502}:8502"
       - "${EXPOSE_NOTEBOOK_API_PORT:-5055}:5055"
       - "${EXPOSE_SEARXNG_PORT:-8888}:8888"
-      - "${EXPOSE_CRAWL4AI_PORT:-11235}:11235"
+      - "${CRAWL4AI_BIND_ADDR:-127.0.0.1}:${EXPOSE_CRAWL4AI_PORT:-11235}:11235"
     environment:
       NGINX_SERVER_NAME: ${NGINX_SERVER_NAME:-_}
       NGINX_HTTPS_ENABLED: ${NGINX_HTTPS_ENABLED:-false}

templates/env.lan.template

@@ -133,6 +133,7 @@ EXPOSE_NOTEBOOK_PORT=8502
 EXPOSE_NOTEBOOK_API_PORT=5055
 OPEN_NOTEBOOK_API_URL=http://agmind-notebook.local:5055
 EXPOSE_SEARXNG_PORT=8888
+CRAWL4AI_BIND_ADDR=127.0.0.1
 EXPOSE_CRAWL4AI_PORT=11235
 EXPOSE_DOCLING_PORT=8765
 

templates/nginx.conf.template

@@ -385,7 +385,23 @@ http {
     #__CRAWL4AI__
     #__CRAWL4AI__    client_max_body_size 10M;
     #__CRAWL4AI__
+    #__CRAWL4AI__    # Authelia auth_request endpoint for this dedicated port vhost.
+    #__CRAWL4AI__    location = /authelia-auth {
+    #__CRAWL4AI__        internal;
+    #__CRAWL4AI__        set $u_authelia http://authelia:9091;
+    #__CRAWL4AI__        proxy_pass $u_authelia/api/authz/auth-request;
+    #__CRAWL4AI__        proxy_pass_request_body off;
+    #__CRAWL4AI__        proxy_set_header Content-Length "";
+    #__CRAWL4AI__        proxy_set_header X-Original-Method $request_method;
+    #__CRAWL4AI__        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+    #__CRAWL4AI__        proxy_set_header X-Forwarded-For $remote_addr;
+    #__CRAWL4AI__        proxy_set_header X-Forwarded-Proto $scheme;
+    #__CRAWL4AI__    }
+    #__CRAWL4AI__
     #__CRAWL4AI__    location / {
+    #__CRAWL4AI__        auth_request /authelia-auth;
+    #__CRAWL4AI__        auth_request_set $user $upstream_http_remote_user;
+    #__CRAWL4AI__        auth_request_set $groups $upstream_http_remote_groups;
     #__CRAWL4AI__        set $u_crawl4ai http://crawl4ai:11235;
     #__CRAWL4AI__        proxy_pass $u_crawl4ai;
     #__CRAWL4AI__        proxy_http_version 1.1;
@@ -545,8 +561,24 @@ http {
     #__CRAWL4AI__
     #__CRAWL4AI__    client_max_body_size 10M;
     #__CRAWL4AI__
+    #__CRAWL4AI__    # Authelia auth_request endpoint for this mDNS vhost.
+    #__CRAWL4AI__    location = /authelia-auth {
+    #__CRAWL4AI__        internal;
+    #__CRAWL4AI__        set $u_authelia http://authelia:9091;
+    #__CRAWL4AI__        proxy_pass $u_authelia/api/authz/auth-request;
+    #__CRAWL4AI__        proxy_pass_request_body off;
+    #__CRAWL4AI__        proxy_set_header Content-Length "";
+    #__CRAWL4AI__        proxy_set_header X-Original-Method $request_method;
+    #__CRAWL4AI__        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+    #__CRAWL4AI__        proxy_set_header X-Forwarded-For $remote_addr;
+    #__CRAWL4AI__        proxy_set_header X-Forwarded-Proto $scheme;
+    #__CRAWL4AI__    }
+    #__CRAWL4AI__
     #__CRAWL4AI__    # --- Health endpoint (shared JSON, see phase 36) ---
     #__CRAWL4AI__    location = /health {
+    #__CRAWL4AI__        auth_request /authelia-auth;
+    #__CRAWL4AI__        auth_request_set $user $upstream_http_remote_user;
+    #__CRAWL4AI__        auth_request_set $groups $upstream_http_remote_groups;
     #__CRAWL4AI__        default_type application/json;
     #__CRAWL4AI__        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
     #__CRAWL4AI__        add_header X-Content-Type-Options "nosniff" always;
@@ -555,6 +587,9 @@ http {
     #__CRAWL4AI__    }
     #__CRAWL4AI__
     #__CRAWL4AI__    location / {
+    #__CRAWL4AI__        auth_request /authelia-auth;
+    #__CRAWL4AI__        auth_request_set $user $upstream_http_remote_user;
+    #__CRAWL4AI__        auth_request_set $groups $upstream_http_remote_groups;
     #__CRAWL4AI__        set $u_crawl4ai http://crawl4ai:11235;
     #__CRAWL4AI__        proxy_pass $u_crawl4ai;
     #__CRAWL4AI__        proxy_http_version 1.1;

templates/services/registry.yaml

@@ -408,7 +408,7 @@ profile_expansions:
   ragflow: "minio"
   observability: "monitoring,portainer"
   security: "authelia"
-  agents: "litellm,crawl4ai,searxng,dbgpt,openwebui,notebook,n8n"
+  agents: "litellm,authelia,crawl4ai,searxng,dbgpt,openwebui,notebook,n8n"
   full: "vllm,litellm,weaviate,docling,vllm-embed,vllm-rerank,minio,monitoring,portainer,authelia,crawl4ai,searxng,dbgpt,openwebui,notebook,n8n"
   dev: "vllm,litellm,weaviate,docling,monitoring,portainer"
 
@@ -420,7 +420,7 @@ profile_descriptions:
   ragflow: "RAGFlow + Elasticsearch + MySQL + MinIO"
   observability: "Prometheus + Grafana + Loki + exporters + Portainer"
   security: "Authelia + fail2ban/hardening"
-  agents: "LiteLLM + Crawl4AI + SearXNG + dbGPT + Open WebUI + Notebook + n8n"
+  agents: "LiteLLM + Authelia + Crawl4AI + SearXNG + dbGPT + Open WebUI + Notebook + n8n"
   full: "Everything: vLLM + Weaviate + Docling + monitoring + agents + n8n (Milvus skipped — XOR with Weaviate)"
   dev: "Core + observability (fast iteration; no RAGFlow/agents/security)"
 
@@ -433,7 +433,7 @@ profile_implied:
   ragflow: "ENABLE_RAGFLOW=true ENABLE_MINIO=true"
   observability: "MONITORING_MODE=local ENABLE_PORTAINER=true"
   security: "ENABLE_AUTHELIA=true"
-  agents: "ENABLE_LITELLM=true ENABLE_CRAWL4AI=true ENABLE_SEARXNG=true ENABLE_DBGPT=true ENABLE_OPENWEBUI=true ENABLE_NOTEBOOK=true ENABLE_N8N=true"
+  agents: "ENABLE_LITELLM=true ENABLE_AUTHELIA=true ENABLE_CRAWL4AI=true ENABLE_SEARXNG=true ENABLE_DBGPT=true ENABLE_OPENWEBUI=true ENABLE_NOTEBOOK=true ENABLE_N8N=true"
   full: "LLM_PROVIDER=vllm ENABLE_LITELLM=true VECTOR_STORE=weaviate ENABLE_DOCLING=true EMBED_PROVIDER=vllm-embed ENABLE_RERANKER=true RERANKER_PROVIDER=vllm-rerank ENABLE_MINIO=true MONITORING_MODE=local ENABLE_PORTAINER=true ENABLE_AUTHELIA=true ENABLE_CRAWL4AI=true ENABLE_SEARXNG=true ENABLE_DBGPT=true ENABLE_OPENWEBUI=true ENABLE_NOTEBOOK=true ENABLE_N8N=true"
   dev: "LLM_PROVIDER=vllm ENABLE_LITELLM=true VECTOR_STORE=weaviate ENABLE_DOCLING=true MONITORING_MODE=local ENABLE_PORTAINER=true"
 

tests/ci-bin/rg

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Minimal ripgrep-compatible shim for hermetic unit-test runners.
+# Prefer a real rg when the runner provides one; otherwise fall back to GNU grep
+# with PCRE so rg-style \s patterns used by shell tests still work.
+set -euo pipefail
+
+if [[ -x /usr/bin/rg ]]; then
+    exec /usr/bin/rg "$@"
+fi
+if command -v rg >/dev/null 2>&1; then
+    _rg_path="$(command -v rg)"
+    if [[ "$_rg_path" != "$0" ]]; then
+        exec "$_rg_path" "$@"
+    fi
+fi
+
+exec grep -P "$@"

tests/golden/expected/cluster_peer/.env.rendered

@@ -133,6 +133,7 @@ EXPOSE_NOTEBOOK_PORT=8502
 EXPOSE_NOTEBOOK_API_PORT=5055
 OPEN_NOTEBOOK_API_URL=http://agmind-notebook.local:5055
 EXPOSE_SEARXNG_PORT=8888
+CRAWL4AI_BIND_ADDR=127.0.0.1
 EXPOSE_CRAWL4AI_PORT=11235
 EXPOSE_DOCLING_PORT=8765
 

tests/golden/expected/cluster_peer/checksums.sha256

@@ -1,5 +1,5 @@
-b4a8ab805e3935869f9bdb81aa86b93eb61e735ed23012b2261a26bf00a06dff  ./.env.rendered
-9f2e47e8fba75559dd5bc6fd2c686d263306613e25b62d369a528d68e4d30ddc  ./docker-compose.rendered.yml
+3adc4895840fd1a6ecac776763ff846e18e2355f409eaf7a20a8315bd05c40a1  ./.env.rendered
+bbe24a58b978d92aa5335295684d0fea5314b811d411439d7f908e3539f64dd1  ./docker-compose.rendered.yml
 0d2e1e887e7e8334a4986e0fe10f1e5fb0fe80021d5eaebdb82d2408231f2d5d  ./monitoring/alert_rules.yml
 4d35ff1e870b113fba9e8b0fac3e98fdea0d77f9e57c474e1e41a1be720abfa2  ./monitoring/alertmanager.yml
 d089cfc29495039466a6f511e46d8c5ad3356c54db104b66fce027e50c8f8262  ./monitoring/alloy-config.river

tests/golden/expected/cluster_peer/docker-compose.rendered.yml

@@ -366,6 +366,7 @@ services:
         published: "8888"
         protocol: tcp
       - mode: ingress
+        host_ip: 127.0.0.1
         target: 11235
         published: "11235"
         protocol: tcp

tests/golden/expected/full_lan/.env.rendered

@@ -133,6 +133,7 @@ EXPOSE_NOTEBOOK_PORT=8502
 EXPOSE_NOTEBOOK_API_PORT=5055
 OPEN_NOTEBOOK_API_URL=http://agmind-notebook.local:5055
 EXPOSE_SEARXNG_PORT=8888
+CRAWL4AI_BIND_ADDR=127.0.0.1
 EXPOSE_CRAWL4AI_PORT=11235
 EXPOSE_DOCLING_PORT=8765