fix(config): preserve bind host when CLI overrides port

.cursor/bug-scan-progress.md

@@ -1,16 +1,25 @@
 # Bug scan progress
 
-Last scanned: logger (2026-07-02)
+Last scanned: config (2026-08-05)
 
 ## Modules
 
 - [x] config — .env loader, env overrides
-- [x] db — SQLite persistence, stream/publisher/player CRUD
-- [x] http — REST API, auth, stats endpoints
-- [x] server — App lifecycle, HTTP+RTMP wiring, deleted_streams eviction
-- [x] rtmp_bridge — RTMP protocol ↔ DB integration seam
-- [x] keygen — Stream key generation
-- [x] logger — Logging
+- [ ] db — SQLite persistence, stream/publisher/player CRUD
+- [ ] http — REST API, auth, stats endpoints
+- [ ] server — App lifecycle, HTTP+RTMP wiring, deleted_streams eviction
+- [ ] rtmp_bridge — RTMP protocol ↔ DB integration seam
+- [ ] keygen — Stream key generation
+- [ ] logger — Logging
+
+## Findings (2026-08-05 config pass)
+
+- **Critical (fixed):** CLI `-p`/`-w` port overrides rewrote bind addresses as
+  `0.0.0.0:{port}`, discarding a configured localhost-only host
+  (`RTMP_BIND=127.0.0.1:1935` or `HTTP_BIND=127.0.0.1:8080`). An operator
+  changing only the port via `-p`/`-w` would unintentionally expose RTMP/HTTP on
+  all interfaces. Fixed with `set_bind_port()` that preserves the configured host
+  (including bracketed IPv6) while replacing the port.
 
 ## Findings (2026-07-02 logger pass)
 

src/config.rs

@@ -154,6 +154,30 @@ impl ServerConfig {
 ///
 /// The only case with an explicit port is `"[v6addr]:port"` or exactly one
 /// unbracketed `:` (`"host:port"`).
+/// Host portion of a "host:port" bind string, with IPv6 bracketing when needed.
+/// Mirrors the host parsing rules used by `port_of` and `server::bind_with_default_port`.
+fn bind_host_of(bind: &str) -> String {
+    let bind = bind.trim();
+    if let Some(bracket_end) = bind.rfind(']') {
+        return bind[..=bracket_end].to_string();
+    }
+    let colon_count = bind.chars().filter(|&c| c == ':').count();
+    match colon_count {
+        0 => bind.to_string(),
+        1 => match bind.rsplit_once(':') {
+            Some((host, port)) if port.parse::<u16>().is_ok() => host.to_string(),
+            Some((host, _)) => host.to_string(),
+            None => bind.to_string(),
+        },
+        _ => format!("[{bind}]"),
+    }
+}
+
+/// Replace the port in a bind string while preserving the configured host.
+pub fn set_bind_port(bind: &str, new_port: u16) -> String {
+    format!("{}:{new_port}", bind_host_of(bind))
+}
+
 fn port_of(bind: &str, default: u16) -> u16 {
     if let Some(bracket_end) = bind.rfind(']') {
         return bind[bracket_end + 1..]
@@ -783,6 +807,20 @@ mod tests {
         assert_eq!(config.http_max_body_bytes, 2048);
     }
 
+    #[test]
+    fn set_bind_port_preserves_localhost_host() {
+        assert_eq!(set_bind_port("127.0.0.1:1935", 1936), "127.0.0.1:1936");
+        assert_eq!(set_bind_port("127.0.0.1:8080", 8081), "127.0.0.1:8081");
+    }
+
+    #[test]
+    fn set_bind_port_preserves_wildcard_and_ipv6_hosts() {
+        assert_eq!(set_bind_port("0.0.0.0:1935", 1936), "0.0.0.0:1936");
+        assert_eq!(set_bind_port("[::1]:1935", 1936), "[::1]:1936");
+        assert_eq!(set_bind_port("::1", 1936), "[::1]:1936");
+        assert_eq!(set_bind_port("127.0.0.1", 1935), "127.0.0.1:1935");
+    }
+
     #[test]
     fn parse_max_body_bytes_clamps_and_invalid_falls_back() {
         assert_eq!(parse_max_body_bytes("500"), 1024);

src/main.rs

@@ -1,4 +1,4 @@
-use librtmp2_server::config::{ServerConfig, config_apply_env, config_load};
+use librtmp2_server::config::{ServerConfig, config_apply_env, config_load, set_bind_port};
 use librtmp2_server::logger;
 use librtmp2_server::server::ServerApp;
 
@@ -44,10 +44,10 @@ fn run() -> Result<(), String> {
     config_apply_env(&mut config);
 
     if let Some(port) = cli.rtmp_port {
-        config.rtmp_bind = format!("0.0.0.0:{port}");
+        config.rtmp_bind = set_bind_port(&config.rtmp_bind, port);
     }
     if let Some(port) = cli.http_port {
-        config.http_bind = format!("0.0.0.0:{port}");
+        config.http_bind = set_bind_port(&config.http_bind, port);
     }
 
     if cli.verbose {