fix(config): preserve bind host when CLI overrides port

[cursor]

Bug scan: config module (2026-08-05)

Bug

CLI -p/-w port overrides rewrote RTMP_BIND and HTTP_BIND as 0.0.0.0:{port}, discarding a configured localhost-only host.

Scenario: Operator sets RTMP_BIND=127.0.0.1:1935 (or HTTP_BIND=127.0.0.1:8080) and runs ./librtmp2-server -p 1936 to change only the port. The server would bind to 0.0.0.0:1936, unintentionally exposing RTMP/HTTP on all interfaces.

Fix

Add set_bind_port() in config.rs to replace the port while preserving the configured host (including bracketed IPv6). Use it from main.rs for -p/-w overrides.

Validation

• 18 config:: unit tests pass (including new set_bind_port tests)

Scan notes

Also re-verified: API token isolation from .env file, parse_env_line/apply_kv, config_apply_env, TLS/trusted-proxy parsing, memory/idle clamps, port_of vs librtmp2 bind parsing.

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Note

Medium Risk
Changes listener bind behavior for operators using -p/-w with non-wildcard hosts; fixes accidental exposure but alters semantics from the buggy 0.0.0.0 override.

Overview
Fixes a bind-address regression where CLI -p/-w port overrides always rewrote RTMP_BIND and HTTP_BIND as 0.0.0.0:{port}, dropping a configured localhost-only host (e.g. 127.0.0.1:1935) and unintentionally listening on all interfaces.

Adds set_bind_port() (with bind_host_of() parsing aligned to existing bind-string rules) so only the port changes while the configured host is kept, including bracketed IPv6. main.rs now uses that helper instead of hard-coded 0.0.0.0 formatting.

Includes unit tests for localhost, wildcard, and IPv6 bind strings, plus a config bug-scan note in .cursor/bug-scan-progress.md. Cargo.lock has minor transitive dependency version bumps.

^{Reviewed by Cursor Bugbot for commit d7e01db. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_71dba50f-ed12-4c4a-9c4b-24e16d93333b)

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[AlexanderWagnerDev]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: d7e01db65e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".