Server Settings, Domains & Streaming Ports

Overview

xOTT can serve the dashboard and public streams on one listener, or isolate playback on a second listener. Separation limits the streaming endpoint to read-only playback paths and keeps panel APIs, login pages, and administrative operations off the public HLS port.

The isolated listener accepts only read-only requests under these output routes:

Generated HLS, service M3U, global M3U, viewer, and XUI source URLs use the configured streaming base. Panel and worker-controller links continue to use the admin base.

Choose a Topology

General Fields

Server Name

A descriptive label shown in xOTT. It does not change DNS, the Linux hostname, or network routing.

Admin Port

Displays the active native admin listener port, normally 5847. It is read-only in the modal because changing the runtime listener requires deployment-level service configuration, not only a saved UI value.

Primary Network Interface

Select the interface used for server bandwidth and network monitoring. It does not bind listeners.

Maximum Download and Upload Bandwidth

Capacity values in MB/s used for monitoring and utilization calculations. They describe expected server capacity; they are not operating-system traffic-shaping rules.

Admin Binding & IP Restrictions

Admin Bind Address

• 0.0.0.0 listens on all IPv4 interfaces. Use it only when direct access is required or while managed deployment is being established.
• 127.0.0.1 limits the native panel listener to the local machine. Use this behind managed Nginx.
• An explicit server IP binds only that interface.

xOTT refuses a localhost admin binding unless the managed Nginx site exists, preventing accidental panel lockout.

Restrict Panel Access by IP/CIDR

Enables an administrator allowlist supporting IPv4, IPv6, and CIDR ranges. The current administrator address must be included before the restriction can be enabled.

Domain Name & Public Base URL

Domain Name

The panel hostname, such as panel.example.com. It is used when deriving panel links, viewer outputs, XUI data, and worker controller configuration.

Public Base URL

The externally reachable panel origin, such as https://panel.example.com. Leave it blank to derive it from Domain Name. Enter a custom value only when an existing load balancer or reverse proxy exposes the panel on another origin.

Use HTTPS for Generated Links

Selects HTTPS when xOTT derives URLs. This switch alone does not create DNS records or install a certificate. Use Apply Secure Deployment, or configure the external proxy and certificate yourself, before advertising HTTPS.

Direct HTTP Streaming

Use this mode when clients will connect directly to the native streaming port.

1. Enable Separate Streaming Listener.
2. Leave Managed HTTPS streaming domain disabled.
3. Set Streaming Port, normally 5848.
4. Use 0.0.0.0 as Streaming Bind Address.
5. Leave Streaming Public Base URL blank.
6. Open the streaming port in the host and provider firewalls.
7. Run Apply Secure Deployment to reconcile settings and test the listener.

xOTT then derives an output such as:

Managed HTTPS Streaming Domain

This is the preferred public streaming configuration.

1. Create a dedicated hostname, for example stream.example.com.
2. Point its A record to the xOTT server and initially use DNS-only mode.
3. Enable Separate Streaming Listener.
4. Enable Managed HTTPS streaming domain.
5. Enter the dedicated Streaming Domain. It must differ from the panel domain.
6. Keep the streaming port at 5848 unless another local service already uses it.
7. Enter a valid certificate email and run Apply Secure Deployment.

The deployment configures:

• Nginx on ports 80 and 443 for the streaming hostname.
• A Let's Encrypt certificate for the configured domains.
• A localhost-only native stream backend.
• Read-only Nginx routing for xOTT playback paths; all other paths return 404.
• A public base such as https://stream.example.com, without exposing port 5848.

Streaming Public Base URL

This is an advanced override for infrastructure managed outside xOTT. It changes the origin advertised in generated HLS, M3U, viewer, and XUI links. It does not configure DNS, Nginx, Cloudflare, TLS, firewall rules, or port forwarding.

For example, entering https://media.example.com is valid only when that endpoint already forwards the allowed playback paths to the native streaming listener. xOTT warns when the advertised port differs from the native port.

Cloudflare Configuration

Direct HTTP mode

Use DNS-only mode. Cloudflare's standard proxy does not support arbitrary ports such as 5848. The output URL must contain :5848 and the port must be publicly open.

Managed HTTPS mode

1. Set panel and streaming records to DNS-only while certificates are issued.
2. Run Apply Secure Deployment and confirm the status is completed.
3. Verify the HTTPS output directly.
4. Enable Cloudflare proxying if desired.
5. Use SSL/TLS mode Full (strict), not Flexible.

See Cloudflare's official documentation for supported proxy ports and Full (strict) TLS.

UFW & Apply Secure Deployment

Manage UFW Rules

When enabled, xOTT requires UFW to be installed and active. The deployment:

• Allows ports 80 and 443.
• Closes direct access to the native admin port.
• Opens the native streaming port in direct HTTP mode.
• Closes the native streaming port when managed Nginx keeps it on localhost.

What Apply Secure Deployment does

1. Validates domains, listener ports, bindings, and administrator CIDRs.
2. Checks that DNS resolves to the server before making listener or firewall changes.
3. Installs or updates Nginx and Certbot configuration.
4. Requests certificates and reconciles UFW when selected.
5. Writes deterministic panel and streaming settings.
6. Restarts xOTT.
7. Runs a native streaming-listener postflight and, for managed domains, an Nginx streaming-route postflight.

A completed direct-mode status means the native listener passed its postflight. A completed managed-domain status means both the listener and reverse-proxy route passed. A failed status should be investigated using the setup log displayed in the modal.

Worker Nodes & Load Balancing

Separate public streaming does not require a separate public domain for each worker. Workers process assigned streams, while viewers continue to use the main controller's stable streaming URL. The controller retrieves worker playlists and segments through authenticated internal node endpoints.

• Domain Name and Public Base URL identify the controller to worker nodes.
• Streaming Public Base URL identifies the viewer-facing output origin.
• Worker Internal URL should use the private or directly reachable worker address.
• Do not point viewer M3U or XUI sources directly at worker APIs.

See the Load Balancing & Worker Nodes guide for deployment details.

Troubleshooting

Generated URL has no streaming port

In direct HTTP mode the URL must contain the configured port. Leave Streaming Public Base URL blank and run Apply Secure Deployment. A portless URL requires a working reverse proxy.

Cloudflare URL loads the panel or returns 404

The hostname is reaching the admin Nginx site instead of a streaming vhost. Configure Managed HTTPS with a different Streaming Domain, or use direct HTTP with DNS-only mode and :5848.

Connection times out on port 5848

• Confirm Separate Streaming Listener is enabled and xOTT was restarted.
• Confirm Streaming Bind Address is 0.0.0.0 for direct mode.
• Open the port in UFW and the hosting provider firewall.
• Disable Cloudflare proxying for direct mode.

Managed deployment fails DNS preflight

Set the relevant A records to the xOTT server's public IPv4 address and temporarily disable Cloudflare proxying.

HTTPS gives certificate or redirect errors

Confirm certificate issuance completed, port 443 reaches Nginx, and Cloudflare uses Full (strict), not Flexible.

Panel IP restriction blocks an administrator

Add the current public address or its correct CIDR before enabling the restriction. Include IPv6 when the administrator connects over IPv6.

Production Security Checklist

• Use a dedicated panel hostname and a different streaming hostname.
• Bind native admin and managed streaming backends to 127.0.0.1.
• Use HTTPS with valid certificates and Full (strict) when Cloudflare is enabled.
• Restrict panel access by trusted IP/CIDR where operations permit it.
• Keep raw admin and managed streaming backend ports closed publicly.
• Keep scoped output tokens enabled and regenerate a compromised output URL.
• Restrict worker APIs to the controller whenever network policy allows.
• Review the deployment log and test an actual HLS output after configuration changes.