docs: four env vars control the dashboard bind address, none of them documented

[xizhuomengcontin]

What

A comment at the dashboard's host/port resolution, naming the four environment variables it reads and what they interact with. Comment only — no code touched.

Why

astrbot/dashboard/server.py:513-522 reads DASHBOARD_PORT, ASTRBOT_DASHBOARD_PORT, DASHBOARD_HOST and ASTRBOT_DASHBOARD_HOST. A repo-wide search finds none of the four in any .md, .yml, .env or example file. The only dashboard variable written down anywhere is ASTRBOT_DASHBOARD_INITIAL_PASSWORD, and only in changelogs/v4.24.5.md.

Three things are not guessable from the code without reading it twice:

1. Each setting has two accepted names, and the unprefixed one wins. DASHBOARD_HOST beats ASTRBOT_DASHBOARD_HOST. Someone who sets only the prefixed name in a container that already exports the unprefixed one will not get what they set.
2. Environment beats config. A value in dashboard.host is overridden by either variable, so editing the config file has no effect while the variable is present.
3. Unset everywhere, the bind is 0.0.0.0:6185 — every interface, not loopback.

The interaction worth flagging

astrbot/dashboard/services/auth_service.py:485-490 resolves the host through the same chain to decide whether the default-password gate may be skipped:

host = (
    os.environ.get("DASHBOARD_HOST")
    or os.environ.get("ASTRBOT_DASHBOARD_HOST")
    or self.config["dashboard"].get("host", "")
)
return str(host).strip().lower() in LOCAL_DASHBOARD_HOSTS

So the same variable that moves the listener also feeds an authentication decision. The comment says so, because someone changing a bind address should know it is load-bearing elsewhere.

To be clear, I am not reporting a vulnerability. I checked before writing this:

• LOCAL_DASHBOARD_HOSTS is {"127.0.0.1", "localhost", "::1"} (auth_service.py:86), so the skip only applies to loopback.
• The two sites use different final fallbacks — "0.0.0.0" in server.py, "" in auth_service.py — and that divergence fails closed: "" is not in the set, so with nothing configured the gate is not skipped.
• The skip is additionally behind an explicit opt-in, ASTRBOT_DASHBOARD_SKIP_DEFAULT_PASSWORD_AUTH (auth_service.py:84).

All three of those are the right behaviour. I mention them so a reviewer does not have to re-derive them to be sure this PR is not fixing something silently.

Scope

One comment block in one file. No behaviour, no defaults, no new variable. Happy to shorten it, translate it, or move the content to a docs page instead if you would rather it lived there.

Summary by Sourcery

Enhancements:

• Document the dashboard bind-address environment variables, their precedence over configuration, default binding, and authentication implications.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="astrbot/dashboard/server.py" line_range="519" />
<code_context>
+        # then the ASTRBOT_-prefixed one -- so DASHBOARD_HOST wins over ASTRBOT_DASHBOARD_HOST if
+        # both are set. Unset everywhere, the dashboard binds 0.0.0.0:6185, i.e. every interface.
+        #
+        # The host chain is also read by AuthService.can_skip_default_password_auth, which only
+        # allows that skip when the resolved host is 127.0.0.1, localhost or ::1. So these
+        # variables decide where the dashboard listens and, indirectly, whether the default
+        # password gate can be waived.
         port = (
             os.environ.get("DASHBOARD_PORT")
</code_context>
<issue_to_address>
**nitpick:** The comment implies that all four bind-address variables can indirectly determine whether the default-password gate is waived, but AuthService reads only DASHBOARD_HOST and ASTRBOT_DASHBOARD_HOST; changing either port variable cannot affect that authentication decision.

**Suggested fix:** Say that the host variables, rather than all four variables, also influence the default-password gate.

```suggestion
        # host variables decide where the dashboard listens and, indirectly, whether the default
```
</issue_to_address>

Sourcery assessment

Approved.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[sourcery-ai]

nitpick: The comment implies that all four bind-address variables can indirectly determine whether the default-password gate is waived, but AuthService reads only DASHBOARD_HOST and ASTRBOT_DASHBOARD_HOST; changing either port variable cannot affect that authentication decision.

Suggested fix: Say that the host variables, rather than all four variables, also influence the default-password gate.

Suggested change

	# variables decide where the dashboard listens and, indirectly, whether the default
	# host variables decide where the dashboard listens and, indirectly, whether the default