You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Future releases will add: group-based inclusion rules, channel numbering, filtering, HDHomeRun emulation, and more.
113
+
Future releases will add: group-based inclusion rules, channel numbering, filtering, and more.
113
114
114
115
See: `docs/SERVICE.md`
115
116
116
117
---
117
118
119
+
## UI Authentication
120
+
121
+
The web UI supports a simple local authentication model:
122
+
123
+
- One access level only: authenticated or not authenticated
124
+
- No roles or user tiers
125
+
- Endpoint authentication is configured separately in the UI
126
+
127
+
### Setup
128
+
129
+
Authentication is controlled entirely by environment variables — no UI toggle required.
130
+
131
+
| Variable | Default | Description |
132
+
|---|---|---|
133
+
|`M3UNDLE_AUTH_ENABLED`|`false`| Set to `true` to require login for the UI and management APIs |
134
+
|`M3UNDLE_ADMIN_USER`|`admin`| Admin username/email (used on first startup only) |
135
+
|`M3UNDLE_ADMIN_PASSWORD`|*(none)*|**Required** when `M3UNDLE_AUTH_ENABLED=true` and no account exists yet |
136
+
137
+
On first startup with `M3UNDLE_AUTH_ENABLED=true`, the admin account is created automatically from these variables. On subsequent startups the account already exists — changing the env vars does not affect the stored password (use **Settings → Change Password** instead).
138
+
139
+
### Behavior
140
+
141
+
- If `M3UNDLE_AUTH_ENABLED=false` (default), the UI and management APIs are open on your network.
142
+
- If `M3UNDLE_AUTH_ENABLED=true`, the UI and `/api/v1/*` management APIs require login.
143
+
- Compatibility endpoints can be secured independently from UI auth using **Settings → Endpoint Security**.
144
+
- Endpoint credentials are stored hashed in the database and validated with stateless username/password auth.
145
+
-`/status` and `/health` remain unauthenticated.
146
+
147
+
---
148
+
118
149
## Docker
119
150
120
151
```bash
@@ -141,6 +172,20 @@ M3Undle publishes endpoints compatible with common clients:
141
172
-`/m3u/m3undle.m3u`
142
173
-`/xmltv/m3undle.xml`
143
174
-`/stream/<streamKey>`
175
+
-`/hdhr/discover.json`
176
+
-`/hdhr/lineup.json`
177
+
-`/hdhr/lineup.xml`
178
+
-`/hdhr/lineup.m3u`
179
+
-`/hdhr/lineup_status.json`
180
+
-`/hdhr/device.xml`
181
+
-`/hdhr/tune/<streamKey>`
182
+
183
+
Legacy HDHomeRun root aliases (`/discover.json`, `/lineup.json`, etc.) are still available for compatibility.
184
+
185
+
Automatic discovery support:
186
+
- SSDP/UPnP (`UDP 1900`)
187
+
- SiliconDust discovery (`UDP 65001`)
188
+
- Discovery is disabled by default; manual add works without discovery
| `M3UNDLE_ENCRYPTION_KEY` | *(none)* | **Required for Xtream Codes providers.** Base64-encoded 32-byte AES key used to encrypt passwords at rest. Generate with `openssl rand -base64 32`. Keep this secret — treat it like a master password. |
137
137
138
+
### Optional — Authentication
139
+
140
+
| Variable | Default | Description |
141
+
|---|---|---|
142
+
| `M3UNDLE_AUTH_ENABLED` | `false` | Set to `true` to require login for the UI and management APIs. |
143
+
| `M3UNDLE_ADMIN_USER` | `admin` | Admin username/email. Used only on first startup when no account exists. |
144
+
| `M3UNDLE_ADMIN_PASSWORD` | *(none)* | **Required** when `M3UNDLE_AUTH_ENABLED=true` and no admin account exists yet. Used only for the initial seed — changing this later has no effect (use Settings → Change Password instead). |
145
+
146
+
Endpoint security (M3U/XMLTV/stream/HDHR username/password auth) is managed in **Settings → Endpoint Security** and stored in the database.
- Returns live channels from the active snapshot with stable `GuideNumber`, `GuideName`, and M3Undle-owned tune URLs.
105
+
- GET `/hdhr/lineup.xml`
106
+
- XML lineup equivalent of `/lineup.json`.
107
+
- GET `/hdhr/lineup.m3u`
108
+
- M3U lineup equivalent of `/lineup.json`.
109
+
- GET `/hdhr/lineup_status.json`
110
+
- Returns lineup readiness and channel count.
111
+
- GET/POST `/hdhr/lineup.post`
112
+
- No-op compatibility endpoint expected by some HDHomeRun clients.
113
+
- GET `/hdhr/device.xml`
114
+
- UPnP device description used by SSDP/manual client probes.
115
+
116
+
### Discovery (optional)
117
+
- SSDP / UPnP listener on UDP `1900`
118
+
- SiliconDust discovery listener on UDP `65001`
119
+
- Discovery uses the same device identity and base URL as manual HTTP endpoints.
120
+
- Discovery is disabled by default; manual add via `/discover.json` remains available.
121
+
85
122
## Authentication
86
-
Auth infrastructure (ASP.NET Core Identity) is present in the codebase. Whether to enable it is configured at first-run setup. Compatibility endpoints (`/m3u/`, `/xmltv/`, `/stream/`) are designed to be accessible without auth to support LAN clients. The web UI can optionally require login.
123
+
UI authentication and client endpoint authentication are independent:
124
+
125
+
- UI auth (`M3UNDLE_AUTH_ENABLED`) controls access to the web UI and management APIs.
126
+
- Endpoint auth is configured in the web UI (**Settings → Endpoint Security**) and stored in the database.
127
+
- When endpoint auth is enabled, M3U/XMLTV/stream/HDHR endpoints require stateless username/password access (no redirects, no session-cookie requirements).
128
+
- When endpoint auth is disabled, endpoint behavior remains open as before.
0 commit comments