fix(deploy): 默认关闭沙箱公网访问

start.ps1

@@ -173,6 +173,8 @@ function Setup-EnvFiles {
     $content = Upsert-Env $content "NUXT_PUBLIC_BASE_APIURL" $publicApiBaseUrl
     $content = Upsert-Env $content "NUXT_PUBLIC_BASE_SOCKETURL" "ws://$($script:DeployIP):3002"
     $content = Upsert-Env $content "NUXT_PUBLIC_SG_APIURL" "http://$($script:DeployIP):3003"
+    $serverBindIp = if ($script:DeployIP -eq "127.0.0.1" -or $script:DeployIP -eq "localhost") { "127.0.0.1" } else { "0.0.0.0" }
+    $content = Upsert-Env $content "SERVER_HTTP_BIND_IP" $serverBindIp
     $webPortMatch = [regex]::Match($content, '(?m)^WEB_PORT=(\d+)$')
     $webPort = if ($webPortMatch.Success) { $webPortMatch.Groups[1].Value } else { "3010" }
     $content = Upsert-Env $content "CONFIG_SECURITY_ORIGIN" "http://$($script:DeployIP):$webPort"
@@ -386,6 +388,18 @@ function Main {
         Ensure-FileFromSample ".env.AMS" ".env.AMS.sample"
     }
 
+    . (Join-Path $script:Root "scripts\Initialize-ServerHttpBindIp.ps1")
+    $serverBindOverride = if ($script:SkipDeployQuestions) {
+        ""
+    } elseif ($script:DeployIP -eq "127.0.0.1" -or $script:DeployIP -eq "localhost") {
+        "127.0.0.1"
+    } else {
+        "0.0.0.0"
+    }
+    Initialize-ServerHttpBindIp `
+        -Path (Join-Path $script:Root ".env") `
+        -Override $serverBindOverride
+
     . (Join-Path $script:Root "scripts\Initialize-SecurityEnv.ps1")
     Initialize-SecurityEnv -Path (Join-Path $script:Root ".env") -Mode $script:SecurityEnvMode