# 0059 — LAN exposure is opt-in and serves only the bootstrap surface

Status: accepted (2026-09-06 WEBSERVE grill round 1, releases#272 / #266)

## Context

The docs server is ruled loopback-only (REQ-DOCS-LOCAL-SERVER): a non-loopback bind would
re-publish what privating the docs hid. #266 wants a fresh machine with no spt installed to
fetch the binary from a peer (`hfenduleam:5474/bin/spt.exe`) — a fresh node has no Iroh
identity yet, so only plain LAN HTTP can reach it. The two collide.

## Decision

**A separate, opt-in LAN listener that serves ONLY the bootstrap surface** — the binaries and an
install page — started explicitly (`spt serve lan --bootstrap`), off by default, and loud
while active. The docs and the serving registry stay loopback-only; the ruling stands
unchanged. Licensing lines up with the split: the binary is redistributable, the docs are
private.

## Alternatives rejected

- **Drop #266; bootstrap stays "copy the binary by hand".** Safe, but the whole reason a fresh
  box wants a peer is that hand-copying is what people get wrong. Rejected as scope cut, kept
  as the fallback if the listener is ever found leaking.
- **Relax loopback-only generally.** Rejected outright: it silently re-publishes the privated
  docs. The ruling is not being revisited.

## Consequences

- Two listeners with two audiences: loopback for the node's own surfaces, LAN for strangers
  who are not yet nodes. Anything served on the LAN one is by definition public on that LAN.
- Listener mechanics (port, allowlist placement, the now-signal line that says it is up) are
  round-2 decisions; the boundary — bootstrap only, opt-in, loud — is fixed here.