diff --git a/config/default.ts b/config/default.ts
index 68420fe..7d37f72 100644
--- a/config/default.ts
+++ b/config/default.ts
@@ -7,6 +7,7 @@ module.exports = {
     db_log_level: "ERROR",
     base_url: "http://localhost:4899",
     public_websocket_url: "ws://localhost:4899",
+    listen_addr: '127.0.0.1',
     port: 4899,
     gitlab_webhook_token: 'default',
     mysql: {
diff --git a/src/components/ExpressAppComponent.ts b/src/components/ExpressAppComponent.ts
index a54b8e0..9544f4c 100644
--- a/src/components/ExpressAppComponent.ts
+++ b/src/components/ExpressAppComponent.ts
@@ -5,18 +5,20 @@ import {Server} from "http";
 import compression from "compression";
 
 export default class ExpressAppComponent extends ApplicationComponent<void> {
+    private readonly addr: string;
     private readonly port: number;
     private server?: Server;
     private expressApp?: Express;
 
-    constructor(port: number) {
+    public constructor(addr: string, port: number) {
         super();
+        this.addr = addr;
         this.port = port;
     }
 
     public async start(app: Express): Promise<void> {
-        this.server = app.listen(this.port, 'localhost', () => {
-            Logger.info(`Web server running on localhost:${this.port}.`);
+        this.server = app.listen(this.port, this.addr, () => {
+            Logger.info(`Web server running on ${this.addr}:${this.port}.`);
         });
 
         // Proxy
diff --git a/test/CsrfProtectionComponent.test.ts b/test/CsrfProtectionComponent.test.ts
index d6ab12d..992e36d 100644
--- a/test/CsrfProtectionComponent.test.ts
+++ b/test/CsrfProtectionComponent.test.ts
@@ -4,7 +4,7 @@ import CsrfProtectionComponent from "../src/components/CsrfProtectionComponent";
 import supertest from "supertest";
 
 let app: TestApp;
-useApp(port => {
+useApp((addr, port) => {
     return app = new class extends TestApp {
         protected async init(): Promise<void> {
             this.use(new class extends Controller {
@@ -29,7 +29,7 @@ useApp(port => {
             super.registerComponents();
             this.use(new CsrfProtectionComponent());
         }
-    }(port);
+    }(addr, port);
 });
 
 describe('Test CSRF protection', () => {
diff --git a/test/_app.ts b/test/_app.ts
index 5b23778..0a5dcfb 100644
--- a/test/_app.ts
+++ b/test/_app.ts
@@ -18,12 +18,12 @@ import RedirectBackComponent from "../src/components/RedirectBackComponent";
 import ServeStaticDirectoryComponent from "../src/components/ServeStaticDirectoryComponent";
 import {Express} from "express";
 
-export default function useApp(appSupplier?: (port: number) => TestApp) {
+export default function useApp(appSupplier?: (addr: string, port: number) => TestApp) {
     let app: Application;
 
     beforeAll(async (done) => {
         await setupMailServer();
-        app = appSupplier ? appSupplier(8966) : new TestApp(8966);
+        app = appSupplier ? appSupplier('127.0.0.1', 8966) : new TestApp('127.0.0.1', 8966);
 
         await app.start();
         done();
@@ -37,11 +37,13 @@ export default function useApp(appSupplier?: (port: number) => TestApp) {
 }
 
 export class TestApp extends Application {
+    private readonly addr: string;
     private readonly port: number;
     private expressAppComponent?: ExpressAppComponent;
 
-    constructor(port: number) {
+    constructor(addr: string, port: number) {
         super(require('../package.json').version, true);
+        this.addr = addr;
         this.port = port;
     }
 
@@ -56,7 +58,7 @@ export class TestApp extends Application {
     }
 
     protected registerComponents() {
-        this.expressAppComponent = new ExpressAppComponent(this.port);
+        this.expressAppComponent = new ExpressAppComponent(this.addr, this.port);
         const redisComponent = new RedisComponent();
         const mysqlComponent = new MysqlComponent();