Serve sites and DNS on a trusted network address (e.g. a tailnet) #49

What's missing

Flock serves sites and *.test DNS on 127.0.0.1 only. When the development box is a different machine than the browser, the sites can't be opened from the laptop. Common setups are a remote Linux box or a VM reached over Tailscale.

Approach

An optional listen list in config.json, empty by default:

{ "listen": ["100.94.14.19"] }

• Web: Caddy also binds the listed addresses. Requests that arrive on them are exempt from the remote-client check; everywhere else, remote clients are still refused.
• DNS: the DNS server also listens on the listed addresses. Each query is answered with the address it reached: 127.0.0.1 locally, the tailnet address over the tailnet.
• Validation: only IPv4 addresses that are on this machine are accepted. Anything else becomes a warning in flock status.
• Unchanged: without listen, nothing changes. The services (PostgreSQL, MySQL, …) stay on loopback.

Status

The implementation is ready as #13: tested end to end over Tailscale, independent of the Linux work. I opened it before the issue rule existed and will add Fixes #<this> once this is approved, along with a section in docs/configuration.md.