Keep the admin surface local while serving tiles on the LAN

Binding to 0.0.0.0 used to demand credentials because the admin console and
the tile routes shared one listener. That forced a choice between keeping the
console off the network and letting other machines fetch tiles.

Admin routes are now loopback-only by default: the service can bind 0.0.0.0 so
/tiles, /vectors, the catalog and the probes reach the LAN, while /admin and
/api/v1/admin answer 403 to anything arriving from another host. Credentials
are only required when ADMIN_ALLOW_REMOTE=true actually opens the console up,
which is the case worth guarding.

Tests cover both sides: a remote admin request is refused, a remote tile
request still reaches the token check.

services/api-go/internal/basemapapi/security_test.go

@@ -277,3 +277,55 @@ func TestScanErrorStatusMapping(t *testing.T) {
 		}
 	}
 }
+
+func TestAdminIsLoopbackOnlyByDefault(t *testing.T) {
+	store := newTestStore(t, t.TempDir())
+	server, err := New(store, basemap.SystemInfo{ServiceName: "basemap-pusher"}, Options{})
+	if err != nil {
+		t.Fatalf("new server: %v", err)
+	}
+	handler := server.Handler()
+
+	call := func(path, remote string) int {
+		request := httptest.NewRequest(http.MethodGet, path, nil)
+		request.RemoteAddr = remote
+		recorder := httptest.NewRecorder()
+		handler.ServeHTTP(recorder, request)
+		return recorder.Code
+	}
+
+	if got := call("/api/v1/admin/basemaps", "127.0.0.1:5555"); got != http.StatusOK {
+		t.Fatalf("expected local admin access, got %d", got)
+	}
+	if got := call("/api/v1/admin/basemaps", "192.168.1.50:5555"); got != http.StatusForbidden {
+		t.Fatalf("expected a remote admin request to be refused, got %d", got)
+	}
+
+	// The point of the split: tile traffic still reaches the service from the
+	// LAN, it just has to carry a valid token.
+	if got := call("/tiles/demo/current/0/0/0.png", "192.168.1.50:5555"); got != http.StatusUnauthorized {
+		t.Fatalf("expected the tile route to stay reachable from the LAN (401), got %d", got)
+	}
+	if got := call("/health", "192.168.1.50:5555"); got != http.StatusOK {
+		t.Fatalf("expected health to stay reachable, got %d", got)
+	}
+}
+
+func TestAdminAllowRemoteOptIn(t *testing.T) {
+	store := newTestStore(t, t.TempDir())
+	server, err := New(store, basemap.SystemInfo{ServiceName: "basemap-pusher"}, Options{
+		Admin: AdminAuth{AllowRemote: true},
+	})
+	if err != nil {
+		t.Fatalf("new server: %v", err)
+	}
+
+	request := httptest.NewRequest(http.MethodGet, "/api/v1/admin/basemaps", nil)
+	request.RemoteAddr = "192.168.1.50:5555"
+	recorder := httptest.NewRecorder()
+	server.Handler().ServeHTTP(recorder, request)
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("expected ADMIN_ALLOW_REMOTE to permit remote admin calls, got %d", recorder.Code)
+	}
+}

services/api-go/internal/basemapapi/server.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"html/template"
 	"log"
+	"net"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -23,6 +24,9 @@ type AdminAuth struct {
 	Token    string
 	User     string
 	Password string
+	// AllowRemote permits admin requests from other hosts. Off by default: the
+	// service can then serve tiles to the LAN while the console stays local.
+	AllowRemote bool
 }
 
 func (a AdminAuth) enabled() bool {
@@ -348,6 +352,10 @@ func (s *Server) routes() {
 // service is only reachable on loopback, which main enforces at startup.
 func (s *Server) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		if !s.admin.AllowRemote && !isLoopbackRequest(r) {
+			writeError(w, http.StatusForbidden, errors.New("admin endpoints are loopback-only; set ADMIN_ALLOW_REMOTE=true to accept remote callers"))
+			return
+		}
 		if !s.admin.enabled() {
 			next(w, r)
 			return
@@ -361,6 +369,20 @@ func (s *Server) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
 	}
 }
 
+// isLoopbackRequest reports whether the request reached us over a loopback
+// address. RemoteAddr is the only trustworthy source here; X-Forwarded-For is
+// attacker-controlled unless a trusted proxy is in front.
+func isLoopbackRequest(r *http.Request) bool {
+	host, _, err := net.SplitHostPort(strings.TrimSpace(r.RemoteAddr))
+	if err != nil {
+		host = strings.TrimSpace(r.RemoteAddr)
+	}
+	ip := net.ParseIP(strings.Trim(host, "[]"))
+	if ip == nil {
+		return false
+	}
+	return ip.IsLoopback()
+}
 func (s *Server) adminAllows(r *http.Request) bool {
 	if token := strings.TrimSpace(s.admin.Token); token != "" {
 		header := strings.TrimSpace(r.Header.Get("Authorization"))

services/api-go/internal/config/config.go

@@ -28,6 +28,7 @@ type Config struct {
 	AdminToken         string
 	AdminUser          string
 	AdminPassword      string
+	AdminAllowRemote   bool
 	CORSAllowedOrigins []string
 	TokenDefaultTTL    time.Duration
 
@@ -50,6 +51,10 @@ func Load() (Config, error) {
 	if err != nil {
 		return Config{}, fmt.Errorf("parse AUTO_SCAN_ON_START: %w", err)
 	}
+	adminAllowRemote, err := boolEnv("ADMIN_ALLOW_REMOTE", false)
+	if err != nil {
+		return Config{}, fmt.Errorf("parse ADMIN_ALLOW_REMOTE: %w", err)
+	}
 	tokenDefaultTTL, err := durationEnv("TOKEN_DEFAULT_TTL", 720*time.Hour)
 	if err != nil {
 		return Config{}, fmt.Errorf("parse TOKEN_DEFAULT_TTL: %w", err)
@@ -76,6 +81,7 @@ func Load() (Config, error) {
 		AdminToken:          strings.TrimSpace(stringEnv("ADMIN_TOKEN", "")),
 		AdminUser:           strings.TrimSpace(stringEnv("ADMIN_USER", "")),
 		AdminPassword:       stringEnv("ADMIN_PASSWORD", ""),
+		AdminAllowRemote:    adminAllowRemote,
 		CORSAllowedOrigins:  listEnv("CORS_ALLOWED_ORIGINS"),
 		TokenDefaultTTL:     tokenDefaultTTL,
 		HealthCheckInterval: healthCheckInterval,