SECURITY IMPROVEMENTS:
- Liquidsoap telnet now binds to 127.0.0.1 (was 0.0.0.0)
- Only accessible from within the container itself
- Defense in depth: even if another container is compromised
- Liquidsoap now uses ICECAST_SOURCE_PASSWORD environment variable
- Reads from environment.get("ICECAST_SOURCE_PASSWORD")
- Falls back to default for development
- All three streams (MP3, AAC, Low-quality) use same variable
DOCUMENTATION:
- Added comment to icecast.xml explaining environment variable override
- Clarifies that docker-compose.yml environment variables take precedence
This completes the password externalization for all Docker services:
- Icecast: Uses env vars (already done)
- Liquidsoap: Now uses env vars ✅
- PostgreSQL: Uses env vars (already done)
Ref: TODO.org security improvements
- Add <changeowner> section to fix 'run as root' error
- Remove complex mount configurations, let Docker handle automatically
- Fix log directory path from /var/log/icecast2/ to /var/log/icecast/
- Update docker-compose.yml to use main icecast.xml instead of minimal version
- Remove temporary minimal-icecast.xml workaround file
All three streams now working with clean main configuration:
- asteroid.aac (96kbps AAC - recommended)
- asteroid.mp3 (128kbps MP3 - compatible)
- asteroid-low.mp3 (64kbps MP3 - low bandwidth)
AAC streaming feature is now production-ready with proper Docker integration.
- Increase sources limit from 2 to 5 in icecast.xml
- Add explicit mount configurations for asteroid.aac and asteroid-low.mp3
- Configure proper stream metadata and settings for each mount point
This should resolve the 403 Forbidden errors for AAC and low quality streams.
- Add complete Docker Compose setup with official Liquidsoap image (savonet/liquidsoap:v2.2.5)
- Add Icecast2 streaming server configuration
- Create dual quality streams (128kbps and 64kbps MP3)
- Add comprehensive documentation in Org format
- Add simple start/stop scripts for easy management
- Update .gitignore to exclude music files and Docker artifacts
- Remove old shell scripts (moved to ~/asteroid-scripts/)
- System-agnostic solution works on any Docker-capable system
This provides a complete streaming solution that works consistently across
all platforms, including Arch Linux where Liquidsoap packages may not be available.
glenneth