access.yaml
access.yaml sets the address Kraft binds to and the password that protects it. Kraft does not seed it: Settings › Access creates it on the first save.
bind: 127.0.0.1
port: 8765
password_hash: null
session_expiry_days: 7
allowed_hosts: []
kraft admin start --host and --port override KRAFT_HOST and KRAFT_PORT, which override bind and port in this file.
| Field | Type | Default | Meaning |
|---|---|---|---|
bind | string | 127.0.0.1 | The address kraft admin start binds. A non-loopback value is refused unless password_hash is set. |
port | integer | 8765 | The port kraft admin start binds. |
password_hash | string | null | The hash of the login password. Required for any non-loopback bind. See password_hash. |
session_expiry_days | integer | 7 | How long a browser session cookie stays valid after logging in. |
allowed_hosts | list | [] | The Host names a browser may use on a non-loopback bind; a password alone does not authorize an arbitrary hostname. See allowed_hosts. |
When a change takes effect
- A saved
bindorporttakes effect at the next start. Until then the header's apply chip reads Restart needed (GET /api/apply), unlessKRAFT_HOSTorKRAFT_PORTis set, which wins over the file. - A server a service manager started can be restarted from the apply chip. One started from a terminal has to be restarted in that terminal.
password_hash
The file holds a scrypt hash of the form scrypt$<salt>$<key>, never the password. Kraft computes it from the password you enter.
On 127.0.0.1, Settings › Access asks for a password when you pick Local network, with the host your phone will use, and saves both with the bind. PUT /api/access with {"password": "..."} also sets it. See Set a password.
allowed_hosts
A browser on the machine itself is always accepted at 127.0.0.1, localhost or [::1]. List the names other devices use. See Remote access.
How entries are normalized
Kraft keeps each entry as a bare name: it lowercases it and drops a scheme, a path, a port and a trailing dot, so http://Kraft.Local:8765/ is kept as kraft.local.
| You write | Kraft keeps |
|---|---|
| An IPv6 address | The address in brackets, as [fd00::5]. |
A Unicode name, faß.de | The punycode form a browser sends, xn--fa-hia.de. |
An IPv4 address written short or as a number, 127.1 or 0x7f.1 | The dotted form a browser sends, 127.0.0.1. |
Entries Kraft refuses
Settings › Access and PUT /api/access refuse a new entry that is not a host name or IP address, with a 422 that names it:
- A wildcard such as
*.ts.net. - A name ending in a number that is no IPv4 address, such as
256.1.1.1.
An entry already in the file stays, and kraft admin doctor names it.
Related
- Remote access: bind to the network, set a password and add the hosts your devices use.
- Environment variables:
KRAFT_HOSTandKRAFT_PORT.