封闭网络内无命令行时，移动设备如何访问部署的CouchDB？

Got it, let's break down how to get your mobile devices talking to the CouchDB instance on your closed-network server—no SSH tunnels needed, since mobile devices can't run those commands anyway.

Step 1: Configure CouchDB to Listen on the Server's Internal Network Interface #

By default, CouchDB only binds to 127.0.0.1 (localhost), which means it's only accessible from the server itself. We need to change this so it listens on the server's internal IP address (or all interfaces, if you prefer).

1. Locate CouchDB's configuration file. Depending on your installation, this is usually:
   • /opt/couchdb/etc/local.ini (for official binary installs)
   • /etc/couchdb/local.ini (for Debian/Ubuntu packages)
2. Open the file with a text editor (e.g., sudo nano /opt/couchdb/etc/local.ini).
3. Find the [chttpd] section, then modify the bind_address line:
   • To bind to a specific internal IP (e.g., 192.168.1.100, replace with your server's actual internal IP):

     [chttpd]
     bind_address = 192.168.1.100
     port = 5984
     

   • To bind to all available network interfaces (good if your server's IP might change, or you want it accessible via all interfaces):

     [chttpd]
     bind_address = 0.0.0.0
     port = 5984
     

4. For CouchDB 2.x and newer, also check the [httpd] section and update its bind_address to the same value—some core components use this setting.

Step 2: Restart CouchDB to Apply Changes #

You need to restart the CouchDB service for the new configuration to take effect:

• On systemd-based systems (Ubuntu 16.04+, RHEL/CentOS 7+):

  sudo systemctl restart couchdb
  

• If you're running CouchDB directly from its binary:

  # First stop the running instance (if it's running)
  /opt/couchdb/bin/couchdb stop
  # Then start it again
  /opt/couchdb/bin/couchdb start
  

Step 3: Open the CouchDB Port in the Server's Firewall #

Even if CouchDB is listening on the internal IP, your server's firewall might block incoming connections on port 5984. Let's open it for your internal network:

Using UFW (Ubuntu/Debian): #

Allow traffic only from your internal subnet (replace 192.168.1.0/24 with your actual network range):

sudo ufw allow from 192.168.1.0/24 to any port 5984

Using Firewalld (RHEL/CentOS/Fedora): #

Add the port to the internal zone and make the change permanent:

sudo firewall-cmd --add-port=5984/tcp --zone=internal --permanent
sudo firewall-cmd --reload

Step 4: Test Access from Mobile Devices #

1. First, verify the server can access itself via the internal IP:

   curl http://<your-server-internal-ip>:5984
   

   You should see a JSON response like {"couchdb":"Welcome","version":"x.x.x","git_sha":"...","uuid":"...","features":["access-ready","partitioned","pluggable-storage-engines","reshard","scheduler"],"vendor":{"name":"The Apache Software Foundation"}}
2. Now grab your mobile device (make sure it's connected to the same closed network) and open a browser or an HTTP client app. Navigate to http://<your-server-internal-ip>:5984—you should see the same welcome message.

Important Notes for Security #

• Enable Authentication: By default, CouchDB might allow unauthenticated access. To lock this down, go back to your local.ini file, add require_valid_user = true under the [chttpd] section, then create an admin user via the CouchDB web UI or the command line.
• Static IP: If your server uses a dynamic internal IP, set a static IP (via your router or server network settings) so mobile devices don't lose access when the IP changes.
• Avoid Exposing to Public Networks: Since this is a closed network, stick to binding to internal IPs only—never expose CouchDB directly to the public internet without proper security measures.

内容的提问来源于stack exchange，提问作者David J.