dbe9a06247
SECURITY IMPROVEMENTS:
- Liquidsoap telnet now binds to 127.0.0.1 (was 0.0.0.0)
- Only accessible from within the container itself
- Defense in depth: even if another container is compromised
- Liquidsoap now uses ICECAST_SOURCE_PASSWORD environment variable
- Reads from environment.get("ICECAST_SOURCE_PASSWORD")
- Falls back to default for development
- All three streams (MP3, AAC, Low-quality) use same variable
DOCUMENTATION:
- Added comment to icecast.xml explaining environment variable override
- Clarifies that docker-compose.yml environment variables take precedence
This completes the password externalization for all Docker services:
- Icecast: Uses env vars (already done)
- Liquidsoap: Now uses env vars ✅
- PostgreSQL: Uses env vars (already done)
Ref: TODO.org security improvements
|
||
|---|---|---|
| .. | ||
| Dockerfile.liquidsoap | ||
| asteroid-radio-docker.liq | ||
| docker-compose.asteroid.yml | ||
| docker-compose.yml | ||
| docker-compose.yml.remote-backup | ||
| docker-streaming.org | ||
| icecast.xml | ||
| init-db.sql | ||
| radiance-default.conf.lisp | ||
| setup-complete.org | ||
| start.sh | ||
| stop.sh | ||