Allow binding the web server port to a specific address

[lbeltrame]

The best example is when using a reverse proxy, which means the server admin could allow connections to the actual server port (8080) only from localhost (while everyone else connects through the proxy itself), but includes people with multiple network interfaces who may want to have the web port listening to only one of the addresses they have.

[aaronpk]

Here's the docs on how to do that!

https://owncast.online/docs/configuration/#custom-ports

Owncast

Configuration

Configuration is done through the Owncast administration page. Learn what you have control over and what customizations can be made.

[lbeltrame]

Hm, I think I worded my request poorly. More than the actual port, what I mean is the binding, that is that the listening port is only bound on localhost and so outside connections are not possible.

IOW, I want to set the binding to localhost:8080, for example, because in that case only nginx will be able to connect to 8080. Right now, if I set, for example, port to 12345 and I use a reverse proxy, clients can:

• Connect directly to OWNCAST_HOST:12345
• Connect through the reverse proxy

The former scenario is what I want to avoid. With Docker it's fairly easy because you can set -p 127.0.0.1:8080:8080 for example, and the port is bound only to 127.0.0.1, but in case of using owncast natively (like I'm doing), it is not possible as far as I can see.

Like this, if one wants, there is one less service listening on all interfaces, and eliminates the need of using a firewall rule to block access to the port, to force all client traffic (web service) through the reverse proxy.

This of course doesn't concern the actual streaming port, just the web interface's.

[gabek]

Yeah I see what you're getting at, it's a good idea. It would be a good command line flag to add. I'll slip this in with a future update, thanks for the suggestion!

[leuc]

it's implemented with a default to 0.0.0.0 for ease of use.

127.0.0.1 is recommended for setups behind a SSL Proxy, simply to have less attack surface exposed to the public.