From 0cfe364567ddd478c63fefabec72fb4fe4f1c0b9 Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Wed, 5 Aug 2026 13:09:34 +0000
Subject: [PATCH 1/5] Use 4973 as the default port

---
 .env.darwin.example                        |  4 ++--
 .env.example                               |  2 +-
 DEVELOPMENT.md                             |  6 +++---
 README.md                                  |  2 +-
 cli.example.yaml                           |  2 +-
 cmd/api/config/config.go                   |  4 ++--
 cmd/api/config/config_test.go              | 11 +++++++++++
 config.example.darwin.yaml                 |  4 ++--
 config.example.yaml                        |  2 +-
 deploy/README.md                           |  4 ++--
 deploy/aws/cloudformation/template.yaml    |  2 +-
 deploy/aws/cloudformation/template_test.go |  2 +-
 lib/builds/README.md                       | 10 +++++-----
 lib/builds/manager.go                      |  2 +-
 lib/devices/GPU.md                         | 14 +++++++-------
 lib/devices/README.md                      | 14 +++++++-------
 lib/providers/providers.go                 |  4 ++--
 openapi.yaml                               |  2 +-
 scripts/e2e-install-test.sh                |  2 +-
 scripts/install.sh                         |  2 +-
 scripts/utm/README.md                      |  2 +-
 stainless.yaml                             |  2 +-
 22 files changed, 55 insertions(+), 44 deletions(-)

diff --git a/.env.darwin.example b/.env.darwin.example
index 6c7f5f875..a6a01b855 100644
--- a/.env.darwin.example
+++ b/.env.darwin.example
@@ -19,7 +19,7 @@ JWT_SECRET=dev-secret-change-me
 DATA_DIR=~/Library/Application Support/hypeman
 
 # Server configuration
-PORT=8080
+PORT=4973
 
 # Logging
 LOG_LEVEL=debug
@@ -63,7 +63,7 @@ CADDY_STOP_ON_SHUTDOWN=false
 # Desktop-specific hostname. Use the NAT gateway IP instead.
 #
 # Registry URL (the host's hypeman API, accessible from VMs)
-REGISTRY_URL=192.168.64.1:8080
+REGISTRY_URL=192.168.64.1:4973
 # Use HTTP (not HTTPS) since hypeman's internal registry uses plaintext
 REGISTRY_INSECURE=true
 
diff --git a/.env.example b/.env.example
index eecbc081c..ca6ef08ef 100644
--- a/.env.example
+++ b/.env.example
@@ -5,7 +5,7 @@ JWT_SECRET=
 DATA_DIR=/var/lib/hypeman
 
 # Server configuration
-# PORT=8080
+# PORT=4973
 
 # Network configuration
 # BRIDGE_NAME=vmbr0
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
index 82c8bedf8..b60e6baaa 100644
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -100,7 +100,7 @@ Common settings:
 
 | Key | Description | Default |
 |-----|-------------|---------|
-| `port` | HTTP server port | `8080` |
+| `port` | HTTP server port | `4973` |
 | `data_dir` | Data directory for VM images, volumes, etc. | `/var/lib/hypeman` |
 | `jwt_secret` | Secret key for JWT authentication (required) | _(empty)_ |
 | `env` | Deployment environment (filters telemetry) | `unset` |
@@ -200,7 +200,7 @@ acme:
 2. Create an ingress with TLS enabled:
 
 ```bash
-curl -X POST http://localhost:8080/v1/ingresses \
+curl -X POST http://localhost:4973/v1/ingresses \
   -H "Content-Type: application/json" \
   -d '{
     "name": "my-https-app",
@@ -261,7 +261,7 @@ make gen-jwt
 make dev
 ```
 
-The server will start on port 8080 (configurable via `port` in config.yaml).
+The server will start on port 4973 (configurable via `port` in config.yaml).
 
 ### Shared-Machine Local Config
 
diff --git a/README.md b/README.md
index 8afa5b2f4..23fe064e3 100644
--- a/README.md
+++ b/README.md
@@ -79,7 +79,7 @@ go install 'github.com/kernel/hypeman-cli/cmd/hypeman@latest'
 Then create a CLI config file at `~/.config/hypeman/cli.yaml`:
 
 ```yaml
-base_url: http://<server-host>:8080
+base_url: http://<server-host>:4973
 api_key: "<token>"
 ```
 
diff --git a/cli.example.yaml b/cli.example.yaml
index c0007e631..d152afef1 100644
--- a/cli.example.yaml
+++ b/cli.example.yaml
@@ -13,7 +13,7 @@
 # =============================================================================
 
 # Hypeman API URL
-base_url: http://localhost:8080
+base_url: http://localhost:4973
 
 # API authentication token (generated by hypeman-token)
 api_key: ""
diff --git a/cmd/api/config/config.go b/cmd/api/config/config.go
index 366fb4962..8f7f2a852 100644
--- a/cmd/api/config/config.go
+++ b/cmd/api/config/config.go
@@ -308,7 +308,7 @@ func GetDefaultConfigPaths() []string {
 // defaultConfig returns a Config struct with all default values set.
 func defaultConfig() *Config {
 	return &Config{
-		Port:      "8080",
+		Port:      "4973",
 		DataDir:   "/var/lib/hypeman",
 		JwtSecret: "",
 		Env:       "unset",
@@ -403,7 +403,7 @@ func defaultConfig() *Config {
 		},
 
 		Registry: RegistryConfig{
-			URL:        "localhost:8080",
+			URL:        "localhost:4973",
 			Insecure:   false,
 			CACertFile: "",
 		},
diff --git a/cmd/api/config/config_test.go b/cmd/api/config/config_test.go
index 93c236c3e..2f1994952 100644
--- a/cmd/api/config/config_test.go
+++ b/cmd/api/config/config_test.go
@@ -10,6 +10,17 @@ import (
 	"github.com/kernel/hypeman/lib/guestmemory"
 )
 
+func TestDefaultConfigUsesHypemanPort(t *testing.T) {
+	cfg := defaultConfig()
+
+	if cfg.Port != "4973" {
+		t.Fatalf("expected default port to be 4973, got %q", cfg.Port)
+	}
+	if cfg.Registry.URL != "localhost:4973" {
+		t.Fatalf("expected default registry URL to use port 4973, got %q", cfg.Registry.URL)
+	}
+}
+
 func TestDefaultConfigIncludesMetricsSettings(t *testing.T) {
 	cfg := defaultConfig()
 
diff --git a/config.example.darwin.yaml b/config.example.darwin.yaml
index 29f2f7509..b888cc6c5 100644
--- a/config.example.darwin.yaml
+++ b/config.example.darwin.yaml
@@ -25,7 +25,7 @@ jwt_secret: dev-secret-change-me
 data_dir: ~/Library/Application Support/hypeman
 
 # Server configuration
-port: "8080"
+port: "4973"
 
 # =============================================================================
 # Hypervisor Configuration (IMPORTANT FOR MACOS)
@@ -104,7 +104,7 @@ caddy:
 # IMPORTANT: "host.docker.internal" does NOT work in vz VMs - that's a Docker
 # Desktop-specific hostname. Use the NAT gateway IP instead.
 registry:
-  url: 192.168.64.1:8080
+  url: 192.168.64.1:4973
   insecure: true
 
 build:
diff --git a/config.example.yaml b/config.example.yaml
index 410fd8b22..a60224277 100644
--- a/config.example.yaml
+++ b/config.example.yaml
@@ -17,7 +17,7 @@ jwt_secret: ""
 data_dir: /var/lib/hypeman
 
 # Server configuration
-# port: 8080
+# port: 4973
 
 # =============================================================================
 # Hypervisor Configuration
diff --git a/deploy/README.md b/deploy/README.md
index a7e2bc32b..92807fe69 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -42,7 +42,7 @@ curl -fsSL https://get.hypeman.sh/cli | bash
 
 mkdir -p ~/.config/hypeman
 cat > ~/.config/hypeman/cli.yaml <<EOF
-base_url: http://<public-ip>:8080
+base_url: http://<public-ip>:4973
 api_key: "<jwt-from-hypeman-create-token>"
 EOF
 
@@ -92,7 +92,7 @@ https://kernel-hypeman-cloudformation-prod.s3.us-east-1.amazonaws.com/v1/hypeman
 | --- | --- |
 | Region | `us-east-1` |
 | Instance type | `c8i.2xlarge` |
-| Hypeman API port | `8080` |
+| Hypeman API port | `4973` |
 | Admin access | AWS Systems Manager Session Manager |
 | SSH | Disabled unless explicitly enabled |
 | Root volume | 30 GiB encrypted EBS |
diff --git a/deploy/aws/cloudformation/template.yaml b/deploy/aws/cloudformation/template.yaml
index 076d971b6..d1d3c3814 100644
--- a/deploy/aws/cloudformation/template.yaml
+++ b/deploy/aws/cloudformation/template.yaml
@@ -94,7 +94,7 @@ Parameters:
     AllowedPattern: "^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$"
   ApiPort:
     Type: Number
-    Default: 8080
+    Default: 4973
     MinValue: 1
     MaxValue: 65535
     Description: Hypeman API port exposed to AllowedApiCidr.
diff --git a/deploy/aws/cloudformation/template_test.go b/deploy/aws/cloudformation/template_test.go
index 69cafd7fa..d606bd56e 100644
--- a/deploy/aws/cloudformation/template_test.go
+++ b/deploy/aws/cloudformation/template_test.go
@@ -15,7 +15,7 @@ func TestQuickstartParameters(t *testing.T) {
 	parameters := requireMapping(t, requireField(t, root, "Parameters"))
 	assertDefault(t, parameters, "InstanceType", "c8i.2xlarge")
 	assertDefault(t, parameters, "AllowedApiCidr", "127.0.0.1/32")
-	assertDefault(t, parameters, "ApiPort", "8080")
+	assertDefault(t, parameters, "ApiPort", "4973")
 	assertDefault(t, parameters, "EnableHttpIngress", "false")
 	assertDefault(t, parameters, "EnableHttpsIngress", "false")
 	assertDefault(t, parameters, "AllowedIngressCidr", "127.0.0.1/32")
diff --git a/lib/builds/README.md b/lib/builds/README.md
index 1ca63b5b3..f7ec2844f 100644
--- a/lib/builds/README.md
+++ b/lib/builds/README.md
@@ -105,10 +105,10 @@ Registry-based caching with tenant isolation:
 ```
 
 ```go
-gen := NewCacheKeyGenerator("localhost:8080")
+gen := NewCacheKeyGenerator("localhost:4973")
 key, _ := gen.GenerateCacheKey("my-tenant", "myapp", lockfileHashes)
-// key.ImportCacheArg() → "type=registry,ref=localhost:8080/cache/my-tenant/myapp/abc123"
-// key.ExportCacheArg() → "type=registry,ref=localhost:8080/cache/my-tenant/myapp/abc123,mode=max"
+// key.ImportCacheArg() → "type=registry,ref=localhost:4973/cache/my-tenant/myapp/abc123"
+// key.ExportCacheArg() → "type=registry,ref=localhost:4973/cache/my-tenant/myapp/abc123,mode=max"
 ```
 
 ### Registry Token System (`registry_token.go`)
@@ -207,7 +207,7 @@ CMD [\"node\", \"index.js\"]" \
 |---------------------|---------|-------------|
 | `MAX_CONCURRENT_SOURCE_BUILDS` | `2` | Max parallel builds |
 | `BUILDER_IMAGE` | `hypeman/builder:latest` | Builder VM image |
-| `REGISTRY_URL` | `localhost:8080` | Registry for built images |
+| `REGISTRY_URL` | `localhost:4973` | Registry for built images |
 | `BUILD_TIMEOUT` | `600` | Default timeout (seconds) |
 
 ### Registry URL Configuration
@@ -419,7 +419,7 @@ go test ./lib/builds/registry_token_test.go ./lib/builds/registry_token.go -v
 | `image not found` | Builder image not imported | Import image using `POST /images` endpoint |
 | `no cgroup mount found` | Cgroups not mounted in VM | Update init script to mount cgroups |
 | `http: server gave HTTP response to HTTPS client` | BuildKit using HTTPS for HTTP registry | Add `registry.insecure=true` to output flags |
-| `connection refused` to localhost:8080 | Registry URL not accessible from VM | Use gateway IP (10.102.0.1) instead of localhost |
+| `connection refused` to localhost:4973 | Registry URL not accessible from VM | Use gateway IP (10.102.0.1) instead of localhost |
 | `401 Unauthorized` | Registry auth issue | Check registry_token in config.json; verify middleware handles Basic auth |
 | `No space left on device` | Instance memory too small for image | Use at least 1GB RAM for Node.js images |
 | `can't enable NoProcessSandbox without Rootless` | Wrong BUILDKITD_FLAGS | Use empty flags or remove the flag |
diff --git a/lib/builds/manager.go b/lib/builds/manager.go
index 87f21dfec..2e2fe1bcf 100644
--- a/lib/builds/manager.go
+++ b/lib/builds/manager.go
@@ -95,7 +95,7 @@ type Config struct {
 func DefaultConfig() Config {
 	return Config{
 		MaxConcurrentBuilds: 2,
-		RegistryURL:         "localhost:8080",
+		RegistryURL:         "localhost:4973",
 		DefaultTimeout:      600, // 10 minutes
 	}
 }
diff --git a/lib/devices/GPU.md b/lib/devices/GPU.md
index 549dad76f..54a19c472 100644
--- a/lib/devices/GPU.md
+++ b/lib/devices/GPU.md
@@ -40,7 +40,7 @@ vGPU mode uses NVIDIA's SR-IOV technology to create Virtual Functions (VFs), eac
 Query available profiles via the resources API:
 
 ```bash
-curl -s http://localhost:8080/resources | jq .gpu
+curl -s http://localhost:4973/resources | jq .gpu
 ```
 
 ```json
@@ -61,7 +61,7 @@ curl -s http://localhost:8080/resources | jq .gpu
 Request a vGPU by specifying the profile name:
 
 ```bash
-curl -X POST http://localhost:8080/instances \
+curl -X POST http://localhost:4973/instances \
   -H "Content-Type: application/json" \
   -d '{
     "name": "ml-training",
@@ -108,7 +108,7 @@ Passthrough mode assigns entire physical GPUs to instances via VFIO.
 ### Checking Available GPUs
 
 ```bash
-curl -s http://localhost:8080/resources | jq .gpu
+curl -s http://localhost:4973/resources | jq .gpu
 ```
 
 ```json
@@ -129,11 +129,11 @@ For whole-GPU passthrough, use the devices API (see [README.md](README.md)):
 
 ```bash
 # Register GPU
-curl -X POST http://localhost:8080/devices \
+curl -X POST http://localhost:4973/devices \
   -d '{"pci_address": "0000:82:00.0", "name": "gpu-0"}'
 
 # Create instance with GPU
-curl -X POST http://localhost:8080/instances \
+curl -X POST http://localhost:4973/instances \
   -d '{"name": "ml-job", "image": "nvidia/cuda:12.4", "devices": ["gpu-0"]}'
 ```
 
@@ -253,7 +253,7 @@ To upgrade the NVIDIA driver version:
 
 The requested profile may require more VRAM than available. Check:
 ```bash
-curl -s http://localhost:8080/resources | jq '.gpu.profiles'
+curl -s http://localhost:4973/resources | jq '.gpu.profiles'
 ```
 
 ### nvidia-smi fails in guest
@@ -262,7 +262,7 @@ curl -s http://localhost:8080/resources | jq '.gpu.profiles'
 2. Check driver version compatibility with vGPU Manager
 3. Inspect guest boot logs:
    ```bash
-   curl http://localhost:8080/instances/<id>/logs?source=app
+   curl http://localhost:4973/instances/<id>/logs?source=app
    ```
 
 ### mdev creation fails
diff --git a/lib/devices/README.md b/lib/devices/README.md
index 3621b04db..457c530ba 100644
--- a/lib/devices/README.md
+++ b/lib/devices/README.md
@@ -37,10 +37,10 @@ lib/devices/
 
 ```bash
 # Check available profiles
-curl localhost:8080/resources | jq .gpu
+curl localhost:4973/resources | jq .gpu
 
 # Create instance with vGPU
-curl -X POST localhost:8080/instances \
+curl -X POST localhost:4973/instances \
   -H "Content-Type: application/json" \
   -d '{
     "name": "ml-training",
@@ -56,21 +56,21 @@ nvidia-smi
 
 ```bash
 # Discover available devices
-curl localhost:8080/devices/available
+curl localhost:4973/devices/available
 
 # Register the GPU
-curl -X POST localhost:8080/devices \
+curl -X POST localhost:4973/devices \
   -d '{"name": "l4-gpu", "pci_address": "0000:a2:00.0"}'
 
 # Create instance with GPU
-curl -X POST localhost:8080/instances \
+curl -X POST localhost:4973/instances \
   -d '{"name": "ml-training", "image": "nvidia/cuda:12.0-base", "devices": ["l4-gpu"]}'
 
 # Inside VM: verify GPU
 nvidia-smi
 
 # Delete instance (auto-unbinds from VFIO)
-curl -X DELETE localhost:8080/instances/{id}
+curl -X DELETE localhost:4973/instances/{id}
 ```
 
 ## Device Lifecycle
@@ -194,7 +194,7 @@ sudo systemctl start nvidia-persistenced
 
 Check available slots:
 ```bash
-curl localhost:8080/resources | jq '.gpu.profiles'
+curl localhost:4973/resources | jq '.gpu.profiles'
 ```
 
 ### Running the E2E Test
diff --git a/lib/providers/providers.go b/lib/providers/providers.go
index 090d2ccfd..5453ea9b8 100644
--- a/lib/providers/providers.go
+++ b/lib/providers/providers.go
@@ -336,7 +336,7 @@ func ProvideIngressManager(p *paths.Paths, cfg *config.Config, instanceManager i
 	}
 
 	// Parse API port from config
-	apiPort := 8080 // default
+	apiPort := 4973 // default
 	if cfg.Port != "" {
 		if p, err := strconv.Atoi(cfg.Port); err == nil {
 			apiPort = p
@@ -396,7 +396,7 @@ func ProvideBuildManager(p *paths.Paths, cfg *config.Config, instanceManager ins
 	// Inside a VM, "localhost" refers to the VM itself, not the host.
 	registryURL := cfg.Registry.URL
 	if registryURL == "" {
-		registryURL = "localhost:8080"
+		registryURL = "localhost:4973"
 	}
 	if strings.HasPrefix(registryURL, "localhost:") || strings.HasPrefix(registryURL, "127.0.0.1:") {
 		gateway := cfg.Network.SubnetGateway
diff --git a/openapi.yaml b/openapi.yaml
index 14b0eed93..7c4ce41b0 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -4,7 +4,7 @@ info:
   description: Generic API for managing VM lifecycle using Cloud Hypervisor with OCI-based workloads
   version: 0.2.0
 servers:
-  - url: http://localhost:8080
+  - url: http://localhost:4973
     description: Local development server
 components:
   securitySchemes:
diff --git a/scripts/e2e-install-test.sh b/scripts/e2e-install-test.sh
index b289ad246..1e3b28d8d 100755
--- a/scripts/e2e-install-test.sh
+++ b/scripts/e2e-install-test.sh
@@ -46,7 +46,7 @@ BRANCH="$BRANCH" CLI_BRANCH="${CLI_BRANCH:-}" bash scripts/install.sh
 # =============================================================================
 info "Phase 3: Waiting for service to be healthy..."
 
-PORT=8080
+PORT=4973
 TIMEOUT=60
 ELAPSED=0
 
diff --git a/scripts/install.sh b/scripts/install.sh
index c6d8013b0..541367e2e 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -765,7 +765,7 @@ if [ "$CLI_INSTALLED" = true ]; then
         mkdir -p "$CLI_CONFIG_DIR"
 
         # Determine the port from config
-        CLI_PORT="8080"
+        CLI_PORT="4973"
         if [ -f "$CONFIG_FILE" ]; then
             PARSED_PORT=$(grep -E '^[[:space:]]*port[[:space:]]*:' "$CONFIG_FILE" 2>/dev/null | head -1 | sed 's/^[[:space:]]*port[[:space:]]*:[[:space:]]*//' | tr -d "\"'" | sed 's/[[:space:]]*$//' || true)
             if [ -n "$PARSED_PORT" ]; then
diff --git a/scripts/utm/README.md b/scripts/utm/README.md
index e845c44a5..113cf7c39 100644
--- a/scripts/utm/README.md
+++ b/scripts/utm/README.md
@@ -146,7 +146,7 @@ make gen-jwt
 
 # on the host machine
 export HYPEMAN_API_KEY="<token-from-vm>"
-export HYPEMAN_BASE_URL="http://hypemman.local:8080"
+export HYPEMAN_BASE_URL="http://hypemman.local:4973"
 
 # then try out some commands
 hypeman pull debian:13-slim
diff --git a/stainless.yaml b/stainless.yaml
index ff84a9535..269b91dbf 100644
--- a/stainless.yaml
+++ b/stainless.yaml
@@ -35,7 +35,7 @@ targets:
 # `environments` are a map of the name of the environment (e.g. "sandbox",
 # "production") to the corresponding url to use.
 environments:
-  production: http://localhost:8080
+  production: http://localhost:4973
 
 # `resources` define the structure and organization for your API, such as how
 # methods and models are grouped together and accessed. See the [configuration

From 19b930abdee5cb9b97f6377adb62ea515ec2ae5a Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Wed, 5 Aug 2026 14:22:03 +0000
Subject: [PATCH 2/5] Keep CloudFormation on port 8080

---
 deploy/README.md                           | 4 ++--
 deploy/aws/cloudformation/template.yaml    | 2 +-
 deploy/aws/cloudformation/template_test.go | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/deploy/README.md b/deploy/README.md
index 92807fe69..a7e2bc32b 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -42,7 +42,7 @@ curl -fsSL https://get.hypeman.sh/cli | bash
 
 mkdir -p ~/.config/hypeman
 cat > ~/.config/hypeman/cli.yaml <<EOF
-base_url: http://<public-ip>:4973
+base_url: http://<public-ip>:8080
 api_key: "<jwt-from-hypeman-create-token>"
 EOF
 
@@ -92,7 +92,7 @@ https://kernel-hypeman-cloudformation-prod.s3.us-east-1.amazonaws.com/v1/hypeman
 | --- | --- |
 | Region | `us-east-1` |
 | Instance type | `c8i.2xlarge` |
-| Hypeman API port | `4973` |
+| Hypeman API port | `8080` |
 | Admin access | AWS Systems Manager Session Manager |
 | SSH | Disabled unless explicitly enabled |
 | Root volume | 30 GiB encrypted EBS |
diff --git a/deploy/aws/cloudformation/template.yaml b/deploy/aws/cloudformation/template.yaml
index d1d3c3814..076d971b6 100644
--- a/deploy/aws/cloudformation/template.yaml
+++ b/deploy/aws/cloudformation/template.yaml
@@ -94,7 +94,7 @@ Parameters:
     AllowedPattern: "^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$"
   ApiPort:
     Type: Number
-    Default: 4973
+    Default: 8080
     MinValue: 1
     MaxValue: 65535
     Description: Hypeman API port exposed to AllowedApiCidr.
diff --git a/deploy/aws/cloudformation/template_test.go b/deploy/aws/cloudformation/template_test.go
index d606bd56e..69cafd7fa 100644
--- a/deploy/aws/cloudformation/template_test.go
+++ b/deploy/aws/cloudformation/template_test.go
@@ -15,7 +15,7 @@ func TestQuickstartParameters(t *testing.T) {
 	parameters := requireMapping(t, requireField(t, root, "Parameters"))
 	assertDefault(t, parameters, "InstanceType", "c8i.2xlarge")
 	assertDefault(t, parameters, "AllowedApiCidr", "127.0.0.1/32")
-	assertDefault(t, parameters, "ApiPort", "4973")
+	assertDefault(t, parameters, "ApiPort", "8080")
 	assertDefault(t, parameters, "EnableHttpIngress", "false")
 	assertDefault(t, parameters, "EnableHttpsIngress", "false")
 	assertDefault(t, parameters, "AllowedIngressCidr", "127.0.0.1/32")

From 9072aa5ffd5e76304fc8a35874bbc8d96f872e4d Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Wed, 5 Aug 2026 15:05:37 +0000
Subject: [PATCH 3/5] Bump OpenAPI version to 0.3.0

---
 openapi.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/openapi.yaml b/openapi.yaml
index 5ce68fbf0..cd796174f 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -2,7 +2,7 @@ openapi: 3.1.0
 info:
   title: Hypeman API
   description: Generic API for managing VM lifecycle using Cloud Hypervisor with OCI-based workloads
-  version: 0.2.0
+  version: 0.3.0
 servers:
   - url: http://localhost:4973
     description: Local development server

From 325d7de430961f6a9ed7d66be4662d665764ca28 Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Wed, 5 Aug 2026 15:41:00 +0000
Subject: [PATCH 4/5] Keep installer CLI port aligned with config

---
 scripts/install.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scripts/install.sh b/scripts/install.sh
index 541367e2e..783728cb4 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -768,6 +768,9 @@ if [ "$CLI_INSTALLED" = true ]; then
         CLI_PORT="4973"
         if [ -f "$CONFIG_FILE" ]; then
             PARSED_PORT=$(grep -E '^[[:space:]]*port[[:space:]]*:' "$CONFIG_FILE" 2>/dev/null | head -1 | sed 's/^[[:space:]]*port[[:space:]]*:[[:space:]]*//' | tr -d "\"'" | sed 's/[[:space:]]*$//' || true)
+            if [ -z "$PARSED_PORT" ]; then
+                PARSED_PORT=$(grep -E '^[[:space:]]*#[[:space:]]*port[[:space:]]*:' "$CONFIG_FILE" 2>/dev/null | head -1 | sed 's/^[[:space:]]*#[[:space:]]*port[[:space:]]*:[[:space:]]*//' | tr -d "\"'" | sed 's/[[:space:]]*$//' || true)
+            fi
             if [ -n "$PARSED_PORT" ]; then
                 CLI_PORT="$PARSED_PORT"
             fi

From c3906290ed89e356b60687b2a53635d8d5f566d2 Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Wed, 5 Aug 2026 16:14:07 +0000
Subject: [PATCH 5/5] Derive installer CLI port from release config

---
 scripts/install.sh | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/scripts/install.sh b/scripts/install.sh
index 783728cb4..3350a25d9 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -766,15 +766,25 @@ if [ "$CLI_INSTALLED" = true ]; then
 
         # Determine the port from config
         CLI_PORT="4973"
-        if [ -f "$CONFIG_FILE" ]; then
-            PARSED_PORT=$(grep -E '^[[:space:]]*port[[:space:]]*:' "$CONFIG_FILE" 2>/dev/null | head -1 | sed 's/^[[:space:]]*port[[:space:]]*:[[:space:]]*//' | tr -d "\"'" | sed 's/[[:space:]]*$//' || true)
+        DEFAULT_CONFIG_FILE="${TMP_DIR}/config.example.yaml"
+        if [ "$OS" = "darwin" ]; then
+            DEFAULT_CONFIG_FILE="${TMP_DIR}/config.example.darwin.yaml"
+        fi
+        if [ -f "$DEFAULT_CONFIG_FILE" ]; then
+            PARSED_PORT=$(grep -E '^[[:space:]]*port[[:space:]]*:' "$DEFAULT_CONFIG_FILE" 2>/dev/null | head -1 | sed 's/^[[:space:]]*port[[:space:]]*:[[:space:]]*//' | tr -d "\"'" | sed 's/[[:space:]]*$//' || true)
             if [ -z "$PARSED_PORT" ]; then
-                PARSED_PORT=$(grep -E '^[[:space:]]*#[[:space:]]*port[[:space:]]*:' "$CONFIG_FILE" 2>/dev/null | head -1 | sed 's/^[[:space:]]*#[[:space:]]*port[[:space:]]*:[[:space:]]*//' | tr -d "\"'" | sed 's/[[:space:]]*$//' || true)
+                PARSED_PORT=$(grep -E '^[[:space:]]*#[[:space:]]*port[[:space:]]*:' "$DEFAULT_CONFIG_FILE" 2>/dev/null | head -1 | sed 's/^[[:space:]]*#[[:space:]]*port[[:space:]]*:[[:space:]]*//' | tr -d "\"'" | sed 's/[[:space:]]*$//' || true)
             fi
             if [ -n "$PARSED_PORT" ]; then
                 CLI_PORT="$PARSED_PORT"
             fi
         fi
+        if [ -f "$CONFIG_FILE" ]; then
+            PARSED_PORT=$(grep -E '^[[:space:]]*port[[:space:]]*:' "$CONFIG_FILE" 2>/dev/null | head -1 | sed 's/^[[:space:]]*port[[:space:]]*:[[:space:]]*//' | tr -d "\"'" | sed 's/[[:space:]]*$//' || true)
+            if [ -n "$PARSED_PORT" ]; then
+                CLI_PORT="$PARSED_PORT"
+            fi
+        fi
 
         # Generate a long-lived CLI token
         # Pass JWT_SECRET explicitly since the config file may not be readable by the current user