What problem would this solve?

Add configurable allowed-host setting for LAN access (STRATA_ALLOWED_HOSTS)

Problem

When running strata serve on a LAN-accessible interface using --addr 0.0.0.0:8080, requests using a local DNS hostname (e.g., http://ai-server.lan:8080) are rejected with:

{
  "error": {
    "message": "bad Host header",
    "type": "forbidden"
  }
}

The server is reachable, the port is listening, and requests to http://127.0.0.1:8080 work correctly. However, requests using the machine's LAN hostname fail.

Current behavior

The current host_ok() implementation in src/serve.rs permits:

• localhost
• 127.0.0.1
• [::1]
• The hostname matching the server's bound address.

When binding to 0.0.0.0, a hostname such as ai-server.lan does not match the bound address and is rejected.

This creates a limitation for users accessing RustingStrata through local DNS, reverse proxies, or other LAN hostnames.

Proposed solution

Introduce an optional environment variable or CLI argument for explicitly trusted hostnames.

For example:

STRATA_ALLOWED_HOSTS="ai-server.lan,ai-server.local"

Alternatively, a CLI option could be provided:

strata serve --allowed-hosts ai-server.lan,ai-server.local

Host validation should continue enforcing the existing DNS rebinding protection while permitting explicitly configured hostnames.

Expected behavior

With the following configuration:

strata serve --addr 0.0.0.0:8080

And:

STRATA_ALLOWED_HOSTS="ai-server.lan"

Requests to the following should work:

• http://127.0.0.1:8080
• http://localhost:8080
• http://ai-server.lan:8080

Unconfigured hostnames should continue to be rejected.

Environment

• OS: Ubuntu 26.04.1 LTS
• GPU: NVIDIA RTX 4070
• RustingStrata: Release build
• Server binding: 0.0.0.0:8080
• Client: OpenCode / macOS
• Access method: Local DNS (ai-server.lan)

Additional context

This is particularly useful for self-hosted inference servers accessed by multiple LAN clients.

Requiring users to modify the source code to permit their own local DNS hostname is not ideal.

An explicit allowlist would provide a straightforward configuration mechanism without requiring users to disable host validation entirely.

Proposed improvement

Requests to the following should work:

• http://127.0.0.1:8080
• http://localhost:8080
• http://ai-server.lan:8080

Alternatives and tradeoffs

No response