Decide the default bind address for switchyard-server

[afourniernv]

Problem

switchyard-server currently binds to 0.0.0.0 when --host is omitted. #584 proposes changing that default to 127.0.0.1 to reduce accidental network exposure.

This is more than a one-line security fix. It changes how the standalone server is deployed:

• dev-server/switchyard.service relies on the current default and would stop accepting remote traffic.
• The root Docker image exposes port 4000, but a published container port cannot reach a process bound to container-local loopback.
• Existing remote users would need to add --host 0.0.0.0.

Both behaviors are already available through --host. The decision is which one should be the default.

Decision needed

Should the standalone server default to local-only access, or should it remain network-reachable by default?

Loopback reduces accidental exposure, but it is not authentication. Keeping 0.0.0.0 better matches a deployable proxy, but requires users to secure the surrounding network appropriately.

If we change the default, the CLI, systemd service, Docker path, documentation, migration note, and a focused regression test should be updated together.

Related: #584

[aaronjmars]

Vote for 127.0.0.1 as the default, with the deployable paths opting into all-interfaces explicitly. Rationale:

• Secure-by-default matters most for the case the maintainers do not control: a first-run user who does switchyard-server with no flags. Binding every interface silently is the surprising outcome, and it is exactly what the PSIRT ticket is about. Loopback is not authentication, agreed, but it removes the accidental-exposure footgun without taking anything away.
• The deployment paths already set config on purpose, so they should set the host on purpose too:
  • dev-server/switchyard.service: add --host 0.0.0.0 to the ExecStart. Intentional and visible in the unit.
  • Docker: set --host 0.0.0.0 in the image CMD/entrypoint. A published -p still gates host exposure at the daemon, so this keeps published ports working while the naked binary stays loopback. (This is the one case where loopback genuinely breaks things, and it is fixed by the image being explicit, not by the binary default.)
• Existing remote users adding --host 0.0.0.0 is a one-line migration and a reasonable ask for opting back into network exposure.

Happy to redo #584 as the full change set you listed (CLI default, systemd unit, Docker CMD, docs, migration note, and a regression test asserting the default bind is loopback) if that direction works for you.

[grahamking]

I second the vote for 127.0.0.1. Secure by default is good.