Default bind exposes Nomad HTTP API and UI to all interfaces

Nomad server and client HTTP listeners default to binding on all local addresses when no bind address is set. That default can make the management API and the optional UI reachable from unintended networks.

The UI and API share a single listener by default, so enabling the UI for operator access also exposes the API port on the same addresses. ACL enforcement protects API operations but health and UI landing pages remain reachable without a token, allowing service presence and version discovery.

Advertise address is operator-configured and version-sensitive. When advertise is left unset or set to a private address while bind is public, cluster gossip and client registration can behave inconsistently, complicating exposure diagnosis. Behavior varies by Nomad major version and by server versus client defaults.

What is the relationship between UI enablement and API listener reachability on the shared port? Is unauthenticated access to health and UI landing pages possible with ACLs enabled? Does a mismatch between bind and advertise affect which address is presented to the cluster versus external clients?