Currently quartz build --serve binds to all interfaces (0.0.0.0/::). This causes a conflict when a reverse proxy (e.g. Tailscale Serve, nginx) needs to bind the same port on a specific interface to terminate TLS.
The failure mode: if Tailscale Serve is configured to proxy https://<tailnet-hostname>:7789 → localhost:7789, it needs to bind <tailnet-ip>:7789 to accept incoming TLS connections. Because Quartz has already claimed 0.0.0.0:7789, the OS hands all incoming SYNs to Quartz instead — Tailscale Serve exits 0 but its listener is silently non-functional. Clients get a TLS decode error (packet length too long) because they're speaking HTTPS to a server that expects HTTP.
Proposed fix: add a --host flag (default 0.0.0.0, preserving current behaviour) passed to both server.listen() and new WebSocketServer() in quartz/cli/handlers.js. Users who need localhost-only binding pass --host 127.0.0.1. The change is ~6 lines across args.js and handlers.js, following the same pattern as #272 (which added --wsPort for a similar Docker binding conflict).
Currently
quartz build --servebinds to all interfaces (0.0.0.0/::). This causes a conflict when a reverse proxy (e.g. Tailscale Serve, nginx) needs to bind the same port on a specific interface to terminate TLS.The failure mode: if Tailscale Serve is configured to proxy
https://<tailnet-hostname>:7789 → localhost:7789, it needs to bind<tailnet-ip>:7789to accept incoming TLS connections. Because Quartz has already claimed0.0.0.0:7789, the OS hands all incoming SYNs to Quartz instead — Tailscale Serve exits 0 but its listener is silently non-functional. Clients get a TLS decode error (packet length too long) because they're speaking HTTPS to a server that expects HTTP.Proposed fix: add a
--hostflag (default0.0.0.0, preserving current behaviour) passed to bothserver.listen()andnew WebSocketServer()inquartz/cli/handlers.js. Users who need localhost-only binding pass--host 127.0.0.1. The change is ~6 lines acrossargs.jsandhandlers.js, following the same pattern as #272 (which added--wsPortfor a similar Docker binding conflict).