Make RPC bind to localhost by default (#3746)

* Make RPC bind to localhost by default

* Add CHANGELOG_PENDING entry

* Allow testnet command to override RPC listen address

* Update localnet test to bind RPC to 0.0.0.0

* Update p2p test to bind RPC to 0.0.0.0

* Remove rpc-laddr parameter

* Update localnet to use config template with RPC listen address override

* Use config template override method for RPC listen address

* Build config template into localnode image

* Build localnode image locally before starting localnet

* Move testnet config overrides into templates

* Revert deletion of config overrides

* Remove extraneous config parameter overrides

CHANGELOG_PENDING.md

@@ -36,6 +36,7 @@
 - [p2p] \#3666 Add per channel telemetry to improve reactor observability
 - [rpc] [\#3686](https://github.com/tendermint/tendermint/pull/3686) `HTTPClient#Call` returns wrapped errors, so a caller could use `errors.Cause` to retrieve an error code. (@wooparadog)
 - [abci/examples] \#3659 Change validator update tx format (incl. expected pubkey format, which is base64 now) (@needkane)
+- [rpc] \#3724 RPC now binds to `127.0.0.1` by default instead of `0.0.0.0`
 
 ### BUG FIXES:
 - [libs/db] \#3717 Fixed the BoltDB backend's Batch.Delete implementation (@Yawning)

Makefile

@@ -275,8 +275,8 @@ build-docker-localnode:
 	@cd networks/local && make
 
 # Run a 4-node testnet locally
-localnet-start: localnet-stop
-	@if ! [ -f build/node0/config/genesis.json ]; then docker run --rm -v $(CURDIR)/build:/tendermint:Z tendermint/localnode testnet --v 4 --o . --populate-persistent-peers --starting-ip-address 192.167.10.2 ; fi
+localnet-start: localnet-stop build-docker-localnode
+	@if ! [ -f build/node0/config/genesis.json ]; then docker run --rm -v $(CURDIR)/build:/tendermint:Z tendermint/localnode testnet --config /etc/tendermint/config-template.toml --v 4 --o . --populate-persistent-peers --starting-ip-address 192.167.10.2; fi
 	docker-compose up
 
 # Stop testnet

config/config.go

@@ -369,7 +369,7 @@ type RPCConfig struct {
 // DefaultRPCConfig returns a default configuration for the RPC server
 func DefaultRPCConfig() *RPCConfig {
 	return &RPCConfig{
-		ListenAddress:          "tcp://0.0.0.0:26657",
+		ListenAddress:          "tcp://127.0.0.1:26657",
 		CORSAllowedOrigins:     []string{},
 		CORSAllowedMethods:     []string{"HEAD", "GET", "POST"},
 		CORSAllowedHeaders:     []string{"Origin", "Accept", "Content-Type", "X-Requested-With", "X-Server-Time"},

networks/local/localnode/Dockerfile

@@ -13,4 +13,4 @@ CMD ["node", "--proxy_app", "kvstore"]
 STOPSIGNAL SIGTERM
 
 COPY wrapper.sh /usr/bin/wrapper.sh
-
+COPY config-template.toml /etc/tendermint/config-template.toml

networks/local/localnode/config-template.toml

@@ -0,0 +1,2 @@
+[rpc]
+laddr = "tcp://0.0.0.0:26657"

test/docker/Dockerfile

@@ -27,7 +27,12 @@ RUN make install_abci
 # install Tendermint
 RUN make install
 
-RUN tendermint testnet --node-dir-prefix="mach" --v=4 --populate-persistent-peers=false --o=$REPO/test/p2p/data
+RUN tendermint testnet \
+        --config $REPO/test/docker/config-template.toml \
+        --node-dir-prefix="mach" \
+        --v=4 \
+        --populate-persistent-peers=false \
+        --o=$REPO/test/p2p/data
 
 # Now copy in the code
 # NOTE: this will overwrite whatever is in vendor/

test/docker/config-template.toml

@@ -0,0 +1,2 @@
+[rpc]
+laddr = "tcp://0.0.0.0:26657"