xOTTNetworking, domains and HTTPS
Separate public URLs from actual listeners, protect administration and keep playback routes reachable.
On this page
Addresses do different jobs
| Setting | Meaning |
|---|---|
| Admin Port / Bind Address | Where the native panel/API listens; commonly 5847. |
| Panel domain / Public Base URL | Advertised controller address. Does not itself issue a certificate. |
| Separate Streaming Listener | Optional playback listener, commonly 5848. |
| Streaming Public Base URL | Advertised playback origin; it must already route correctly or be managed by deployment. |
| Network Interface | Telemetry/capacity context; it does not automatically bind every stream to that NIC. |
Generated HTTPS links do not configure DNS, certificates, NAT or firewall rules by themselves. Read the deployment preview and preserve a recovery SSH session before changing access.
Direct HTTP setup
- For a temporary direct panel setup, use the intended server IP and exposed admin port only on trusted networks.
- If enabling a separate streaming listener, choose an unused port and appropriate public binding.
- Open only the selected ports in the host, provider firewall and any NAT rules.
- Keep advertised URLs consistent with externally reachable ports. A portless HTTP URL targets port 80, not a native listener on 5848.
- Test the exact output URL externally. Enabling HTTP native-player login is a separate explicit security setting.
Managed HTTPS deployment
- Create the intended panel and streaming DNS records and make them resolve to the correct server.
- Use a different streaming hostname when the managed deployment requires it. Provide the certificate email and valid listener settings.
- Review administrative IP/CIDR restrictions and retain your current administrator address.
- Use Apply Secure Deployment, follow the displayed job log and allow for an application restart.
- Verify panel login and actual public HLS playback afterwards. Do not interpret a saved form as a completed certificate/deployment job.
Managed deployment reconciles supported Nginx/certificate/listener settings. If you use an external reverse proxy, configure it deliberately; an advertised URL override is not a reverse-proxy installer.
Firewalls, proxies and CDN frontends
Allow the active SSH port before changing UFW. Include provider firewalls and NAT in the plan. A CDN proxy may not support the raw port you chose; DNS-only mode is the simplest diagnostic baseline. Use end-to-end valid TLS when proxying HTTPS, not a mode that creates redirect loops or leaves the origin unprotected.
Administrative IP restrictions are not subscriber entitlements and should not be used to block legitimate playback routes or worker callbacks. If a browser frontend is HTTPS, verify its worker media origins are also compatible; mixed HTTP media can be rejected.
Workers and public media
Worker control addresses, public media origins and the controller’s public URL are separate. A viewer entry link may remain on the controller while direct delivery redirects media to the assigned worker. See delivery modes. Do not give viewers private worker APIs as replacement M3U URLs.
After a network change
- Panel unreachable: check binding, IP allowlist, listener, proxy and firewall separately.
- URL has wrong port: compare native listener and advertised public origin.
- Certificate failure: check DNS, certificate issuance log, port reachability and reverse-proxy host routing.
- Player login works but media fails: inspect the actual redirect/origin and scheme.
- Do not change global server DNS to repair a service-specific SmartDNS assignment.