ip.bind: bind outbound connections to the configured address (#9834)

* ip.bind: bind outbound connections to the configured address

-ip.bind only governed listeners; outbound gRPC and HTTP connections let
the OS pick the source IP, which may not even be able to reach the
target. Mirror the bind address into a process-global source address and
apply it to outbound TCP dials: the gRPC context dialer, the per-client
HTTP transports, and the default transport. Loopback targets and unix
sockets keep the OS-chosen source so same-host traffic still works.

* ip.bind: first-write-wins source IP, skip on address-family mismatch

Make SetOutboundLocalIP first-write-wins so a `weed server` component's own
bind setting (run in its goroutine) can't clobber the process-wide source
address the top-level -ip.bind already established for the other components.

Skip source binding when the target is a literal IP of a different family
than the bind address, since forcing a mismatched source fails the dial.

weed/command/filer.go

@@ -335,6 +335,7 @@ func (fo *FilerOptions) startFiler() {
 	if *fo.bindIp == "" {
 		*fo.bindIp = *fo.ip
 	}
+	util.SetOutboundLocalIP(*fo.bindIp)
 	if *fo.allowedOrigins == "" {
 		*fo.allowedOrigins = "*"
 	}

weed/command/master.go

@@ -188,6 +188,7 @@ func startMaster(masterOption MasterOptions, masterWhiteList []string) {
 	if *masterOption.ipBind == "" {
 		*masterOption.ipBind = *masterOption.ip
 	}
+	util.SetOutboundLocalIP(*masterOption.ipBind)
 
 	myMasterAddress, peers := checkPeers(*masterOption.ip, *masterOption.port, *masterOption.portGrpc, *masterOption.peers)
 

weed/command/s3.go

@@ -324,6 +324,7 @@ func (s3opt *S3Options) startS3Server() bool {
 	if *s3opt.bindIp == "" {
 		*s3opt.bindIp = "0.0.0.0"
 	}
+	util.SetOutboundLocalIP(*s3opt.bindIp)
 
 	defaultFileMode, fileModeErr := s3opt.parseDefaultFileMode()
 	if fileModeErr != nil {

weed/command/server.go

@@ -274,6 +274,9 @@ func runServer(cmd *Command, args []string) bool {
 	if *serverBindIp == "" {
 		serverBindIp = serverIp
 	}
+	// Bind outbound connections to the same address up front so every
+	// component started below inherits it, before any of them dials.
+	util.SetOutboundLocalIP(*serverBindIp)
 
 	if *serverMetricsHttpIp == "" {
 		*serverMetricsHttpIp = *serverBindIp

weed/command/sftp.go

@@ -110,6 +110,7 @@ func (sftpOpt *SftpOptions) startSftpServer() bool {
 	if *sftpOpt.bindIp == "" {
 		*sftpOpt.bindIp = "0.0.0.0"
 	}
+	util.SetOutboundLocalIP(*sftpOpt.bindIp)
 	filerAddress := pb.ServerAddress(*sftpOpt.filer)
 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client")
 

weed/command/volume.go

@@ -380,6 +380,7 @@ func (v VolumeServerOptions) startVolumeServer(volumeFolders, maxVolumeCounts, v
 	if *v.bindIp == "" {
 		*v.bindIp = *v.ip
 	}
+	util.SetOutboundLocalIP(*v.bindIp)
 
 	if *v.publicPort == 0 {
 		*v.publicPort = *v.port

weed/command/webdav.go

@@ -89,6 +89,8 @@ func (wo *WebDavOption) resolvePaths() {
 
 func (wo *WebDavOption) startWebDav() bool {
 
+	util.SetOutboundLocalIP(*wo.ipBind)
+
 	// detect current user
 	uid, gid := uint32(0), uint32(0)
 	if u, err := user.Current(); err == nil {