Allow specifying bind-interface via ENV variable

[mnkhouri]

Request (TL;DR)

Allow setting bind-interface in the config file via an environment variable, e.g. something like this:

  # Set up fr24feed
  {
    echo receiver="beast-tcp"
    echo fr24key="${FR24KEY}"
    echo host="${BEASTHOST}:${BEASTPORT}"
    echo bs="no"
    echo raw="no"
    echo logmode="1"
    echo logpath="/var/log"
    echo mlat="${MLAT}"
    echo mlat-without-gps="${MLAT}"
+   if [ -z "${BIND_INTERFACE}" ]; then
+     echo bind-interface="${BIND_INTERFACE}"
+   fi
  } > /etc/fr24feed.ini

Why?

By default, the fr24feed program only allows access to its web interface from IP addresses in a private range. If you try to access the web interface from an IP address outside one of these ranges, the following message is displayed:

For security reasons the web interface is only availble from private class networks or after you have manually specified the bind-interface setting in /etc/fr24feed.ini
Please set it to bind-interface="0.0.0.0" to accept traffic from all interfaces or to the IP address of your preferred network interface!
For further assistance please contact [email protected]

So why doesn't this affect all users of this container? By default, docker runs with a "userland proxy". This means any incoming connections to a container appear to come from the proxy's address, typically 172.16.0.x (which is in the private range). So when running this container, most users' connections to the web-ui appears to come from an IP in the private range.

However, I run docker without the userland proxy, so that my containers can see the real client IPs. I also access my container via the Tailscale VPN, which uses IP addresses outside the private range ref. So for my particular use case, I need to set the bind-interface variable in the config.

Thanks!

[mikenye]

Thanks for such a detailed issue. I'm happy to implement this. Would you like to submit a PR (so you're listed as a contributor), or would you like me to implement it?

[mnkhouri]

I've got a lot on my plate at the moment and would prefer to defer to you for implementation, but I appreciate the offer.

Thanks for the quick reply and willingness to do it!

[optiz0r]

This is also needed for podman, which does not use the proxy either. The proposed fix is not quite right, it should be -n instead of -z to check if the env var has a value, rather than that it does not. I've done a quick test myself by bind-mounting a modified cont-init.d/01-fr24feed startup script, and it appears to work as expected. I'll raise it as a PR.