How to bind Artifactory to localhost only?

According to Artifactory documentation,

For best security, when using Artifactory behind a reverse proxy, it must be co-located on the same machine as the web server, and Artifactory should be explicitly and exclusively bound to localhost.

How can I configure Artifactory so that it is bound to localhost only?

Solution

As of Artifactory version 7.12.x, there are two endpoints exposed for accessing the application:

Port 8082 - all the Artifactory services (UI + API) via the JFrog router
Port 8081 - direct to the Artifactory service API running on Tomcat (for better performance)

The JFrog Router does not support specific binding configuration today.
Tomcat can controlled with setting a custom address="127.0.0.1" on the relevant connector.

Your best bet would be to simply close all ports on the server running your Artifactory and allow only entry to the web server's port. This is best practice anyway for security aware systems.

IMPORTANT:

If using other JFrog products like JFrog Xray or JFrog Pipelines, they rely on direct access to the Artifactory router, so your security rules should take that into consideration.

You can find a map of all JFrog platform ports on the official Wiki page.

EDIT:

As of Artifactory 7.37.0, it's also possible to bind JFrog Router's port 8082 to localhost only with the system.yaml config

router:
  entrypoints:
    externalHost: localhost

You can see the official Artifactory system.yaml docs.