fix(compose): add LAN-only MCP binding

.github/actions/setup-rust-kache/action.yml

@@ -73,15 +73,15 @@ runs:
         components: ${{ inputs.components }}
         targets: ${{ inputs.targets }}
 
-    # Pinned exactly. The private fleet and hosted CI share the 0.12.0 S3
+    # Pinned exactly. The private fleet and hosted CI share the 0.13.0 S3
     # object layout and daemon protocol. Floating this version could split cache
     # epochs or layouts without an obvious workflow failure. Bump deliberately,
     # never via tag drift.
     - name: Install kache
       if: inputs.enable-cache == 'true' && runner.os == 'Linux'
       shell: bash
       env:
-        KACHE_VERSION: "0.12.0"
+        KACHE_VERSION: "0.13.0"
       run: |
         set -euo pipefail
         # Reuse any already-installed binary at the pinned version. Persistent

CHANGELOG.md

@@ -9,6 +9,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
                Format: ## [X.Y.Z] — YYYY-MM-DD
                Use Added / Changed / Deprecated / Removed / Fixed / Security headers. -->
 
+## [Unreleased]
+
+### Changed
+
+- Pin the shared Rust cache action to Kache 0.13.0 so hosted and self-hosted jobs use the same stabilized daemon protocol.
+- Add an explicit LAN-only production port binding while retaining the configurable primary bind address.
+
 ## [1.0.0](https://github.com/dinglebear-ai/synapse/compare/v0.6.2...v1.0.0) (2026-07-29)
 
 

docker-compose.prod.yml

@@ -55,6 +55,7 @@ services:
       # externally), override: SYNAPSE_MCP_BIND_HOST=0.0.0.0 in your .env and
       # change the mapping to: "${SYNAPSE_MCP_BIND_HOST:-127.0.0.1}:..."
       - "${SYNAPSE_MCP_BIND_HOST:-127.0.0.1}:${SYNAPSE_MCP_HOST_PORT:-40080}:40080/tcp"
+      - "10.1.0.6:${SYNAPSE_MCP_HOST_PORT:-40080}:40080/tcp"
     volumes:
       # Persistent appdata — config.toml, .env, auth.db, JWT key. The binary reads
       # config.toml / .env from here (it maps to /data inside the container).