Feature idea: optional trusted-network allowlist for the Mobile Access gate (Home Assistant's trusted_networks pattern)

[jp-cruz]

Given the Docker networking issue in #297, containerized deployments are stuck permanently in the mobile-shell/pairing flow with no way to get frictionless local-network access. Home Assistant's trusted_networks auth provider solves this well for a very similar risk profile (home-automation agent with real device control): configurable trusted local IP/CIDR ranges get passwordless access, everything else still requires normal auth.

Proposing something similar here as an opt-in, off-by-default env var (e.g. ROW_BOT_TRUSTED_NETWORKS=192.168.1.0/24,10.0.0.0/8) extending the existing loopback check, clearly documented as a trust/convenience trade-off for segmented homelabs — not a default behavior change. Happy to share a working reference implementation if useful (built and running in production here).

[jp-cruz]

Adding the concrete business driver behind this, now written up in more detail on the companion issue (#297): I run Row-Bot in Docker to evaluate multiple agent tech stacks side by side, running multiple instances at once and experimenting with multi-agent collaboration patterns (similar in spirit to how Linear coordinates multiple agents/workflows). That use case needs the full desktop Web UI reachable over LAN/Tailscale, not just the mobile companion shell — which is what led to building and verifying the trusted-network approach proposed here. Fully stand behind this idea; happy to share the reference implementation.

[jp-cruz]

Reference implementation is now public: https://github.com/jp-cruz/trusted-networks-addon-for-row-bot — the trust-check pattern (env-var-configured CIDR allowlist), integration notes for the three existing call sites, Docker Compose-specific gotchas (bridge subnet pinning, the restart-vs-recreate env var caveat), a security-considerations section, and a full test suite. Apache 2.0, matching this project. Open to feedback on the approach before this goes any further.

[siddsachar]

Thanks you for this. We are looking into this now and plan to extend this to a proper server/docker/remote access implementation for the next release. Will provide an update soon.