Add web bind address by dpw13 · Pull Request #357 · opensensor/lightNVR

dpw13 · 2026-04-04T21:50:58Z

Useful for deployments with many network interfaces or behind a proxy, to avoid exposing the unencrypted HTTP port.

Copilot

Pull request overview

Adds a configurable web bind address so deployments can restrict which network interface the (unencrypted) HTTP server listens on, reducing accidental exposure on multi-homed hosts or behind proxies.

Changes:

Introduces web_bind_ip configuration across INI/env/defaults, API, and server startup (libuv bind).
Exposes the setting in the web UI (settings form + i18n) and includes it in config export/backup JSON.
Documents bind_ip in configuration docs and wires it into the Docker entrypoint default config.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
web/public/locales/en.json	Adds UI label for the new bind address setting.
web/js/utils/settings-utils.js	Adds default `web_bind_ip` value for frontend settings model.
web/js/components/preact/SettingsView.jsx	Adds bind address field to settings load/save + renders an input.
src/web/libuv_server.c	Binds the listener to the configured IPv4 address and improves logging.
src/web/api_handlers_system.c	Includes `web_bind_ip` in system backup JSON.
src/web/api_handlers_settings.c	Exposes `web_bind_ip` in GET settings and accepts it in POST updates.
src/web/api_handlers_common_utils.c	Includes `web_bind_ip` in generic config JSON output.
src/core/main.c	Passes bind address into HTTP server config and updates log messages.
src/core/config.c	Adds env mapping/default/INI/save/print/reload logging for `web_bind_ip`.
include/web/http_server.h	Extends `http_server_config_t` with `bind_ip`.
include/core/config.h	Adds `web_bind_ip` to the core config struct.
docs/CONFIGURATION.md	Documents the new `[web] bind_ip` setting.
docker-entrypoint.sh	Adds `bind_ip` to the generated default config in container entrypoint.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-06T22:44:39Z

src/core/config.c

+        } else if (strcmp(name, "bind_ip") == 0) {
+            strncpy(config->web_bind_ip, value, 31);
        } else if (strcmp(name, "root") == 0) {


strncpy(config->web_bind_ip, value, 31); does not guarantee NUL-termination when value is length >= 31. This can leave web_bind_ip unterminated and later %s logging / uv_ip4_addr reads past the buffer. Ensure the destination is always NUL-terminated (or use a bounded copy helper that always terminates).

src/web/api_handlers_settings.c

src/web/libuv_server.c

web/js/components/preact/SettingsView.jsx

Copilot · 2026-04-06T22:44:40Z

src/core/config.c

    // Web server settings
    {"WEB_PORT",           CONFIG_TYPE_INT,    CONFIG_OFFSET(web_port),           0,   NULL, 8080, false},
+    {"WEB_BIND_IP",        CONFIG_TYPE_STRING, CONFIG_OFFSET(web_bind_ip),        32,  "0.0.0.0", 0, false},
    {"WEB_AUTH_ENABLED",   CONFIG_TYPE_BOOL,   CONFIG_OFFSET(web_auth_enabled),   0,   NULL, 0, true},


Config loading already has unit tests (e.g., tests/unit/test_config.c covers web_port defaults/env overrides). This PR adds a new config field (WEB_BIND_IP, default 0.0.0.0) but no corresponding tests to prevent regressions in defaults, INI parsing, and env override behavior. Please add unit coverage for the new field similar to the existing web_port tests.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/core/config.c

Copilot · 2026-04-08T01:38:17Z

src/web/api_handlers_settings.c

+    // Web bind address
+    cJSON *web_bind_ip = cJSON_GetObjectItem(settings, "web_bind_ip");
+    if (web_bind_ip && cJSON_IsString(web_bind_ip)) {
+        const char *new_bind_ip = web_bind_ip->valuestring;
+        bool bind_ip_empty = (new_bind_ip == NULL);
+
+        if (!bind_ip_empty) {
+            while (isspace((unsigned char)*new_bind_ip)) {
+                new_bind_ip++;
+            }
+            bind_ip_empty = (*new_bind_ip == '\0');
+        }
+
+        if (bind_ip_empty) {
+            log_warn("Rejected empty web_bind_ip update");
+        } else if (strcmp(g_config.web_bind_ip, new_bind_ip) != 0) {
+            strncpy(g_config.web_bind_ip, new_bind_ip, sizeof(g_config.web_bind_ip) - 1);
+            g_config.web_bind_ip[sizeof(g_config.web_bind_ip) - 1] = '\0';
+            settings_changed = true;
+            restart_required = true;
+            log_info("Updated web_bind_ip: %s (restart required)", g_config.web_bind_ip);
+        }


web_bind_ip updates are only checked for non-empty, then persisted and logged. Since this value is later written into the INI via fprintf("bind_ip = %s\n", ...) and parsed by uv_ip4_addr, allowing whitespace/control characters or non-IPv4 strings can corrupt the saved config (newline injection) or make the web server fail to start on next restart. Consider trimming both leading/trailing whitespace and validating the value as an IPv4 address (or explicitly document/implement IPv6/hostnames) before accepting it.

Copilot · 2026-04-08T01:38:17Z

src/web/api_handlers_settings.c

    // Web port
    cJSON *web_port = cJSON_GetObjectItem(settings, "web_port");
    if (web_port && cJSON_IsNumber(web_port)) {
        g_config.web_port = web_port->valueint;
        settings_changed = true;
        log_info("Updated web_port: %d", g_config.web_port);
    }

+    // Web bind address
+    cJSON *web_bind_ip = cJSON_GetObjectItem(settings, "web_bind_ip");


web_port is updated and persisted, but restart_required is not set (unlike web_bind_ip and web_thread_pool_size). Since the running libuv server won’t rebind to a new port without a restart, the settings API response/UI will incorrectly imply the change is live. Set restart_required = true (and ideally return an appropriate restart_required_message) when web_port changes.

Copilot · 2026-04-08T01:38:17Z

src/core/main.c

    // Initialize HTTP server (libuv + llhttp)
-    log_info("Initializing web server on port %d (daemon_mode: %s)",
-             config.web_port, daemon_mode ? "true" : "false");
+    log_info("Initializing web server on %s:%d (daemon_mode: %s)",
+             config.web_bind_ip, config.web_port, daemon_mode ? "true" : "false");


Daemon-mode port verification still attempts to connect to INADDR_LOOPBACK regardless of the configured bind address. With web_bind_ip now configurable, binding to a specific non-loopback interface (e.g., 192.168.x.x) will cause this verification to fail and log misleading warnings. Update the verification logic to connect to the configured bind address (or treat 0.0.0.0 as a special case and verify via loopback).

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Add web bind address

a61f172

matteius requested a review from Copilot April 6, 2026 22:40

Copilot started reviewing on behalf of matteius April 6, 2026 22:41 View session

Copilot AI reviewed Apr 6, 2026

View reviewed changes

matteius and others added 3 commits April 7, 2026 21:32

Update web/js/components/preact/SettingsView.jsx

a23bbeb

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update src/web/libuv_server.c

9970e36

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update src/web/api_handlers_settings.c

7360585

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

matteius requested a review from Copilot April 8, 2026 01:33

Copilot started reviewing on behalf of matteius April 8, 2026 01:33 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

Update src/core/config.c

e5e711b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add web bind address#357

Add web bind address#357
dpw13 wants to merge 5 commits intoopensensor:mainfrom
dpw13:feat/bind_ip

dpw13 commented Apr 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 6, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

dpw13 commented Apr 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants