[**English**](Configuration.md) | [**日本語**](Configuration.ja.md) # Configuration - 🗒️[server.yml](#serveryml) - Server Settings - 🗒️[tuners.yml](#tunersyml) - Tuner Settings - 🗒️[channels.yml](#channelsyml) - Channel Settings ## ⚠️Security Considerations (FYI) - Mirakurun is designed to be a LAN-only server. - By default, access is restricted to private IP addresses. - Access from arbitrary hostnames or domains is prohibited → **DNS Rebinding / CSRF protection** - `hostname`: Set the hostname to access the Web UI. - `allowOrigins`: Explicitly set allowed hostnames/domains if required. - Multiple techniques are used to mitigate attack risks. - Do not allow API access from all domains or deploy without a reverse proxy, as it may be vulnerable to: - Attacks reusing authenticated BASIC credentials or session data. - Although modern browsers offer protection, do not rely on them entirely. - HTTPS reverse proxies might bypass certain browser and Mirakurun safeguards, increasing risk → [Secure Contexts](https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts) - Instead, use VPN, SSH tunnels, or tunnel services. - Note: Some tunnel services require configuring `allowIPv4CidrRanges` to prevent third-party access. > **DNS Rebinding Attack**: An attacker controls a domain and initially serves a legitimate site. After the DNS TTL expires, they switch it to point to their malicious server. This bypasses the browser’s same-origin policy and enables unauthorized access to a LAN server via the browser. > **XSS/CSRF Attack**: An attacker embeds malicious code into a website to gain unauthorized access to a LAN server via the browser. - Examples of attacks: - Execute arbitrary code via tuner commands - Inject malicious code into the server and turn it into a botnet - The above are only a few examples; many others, exploiting browser or middleware vulnerabilities, are devised daily. - With more web-based applications emerging, they can be as vulnerable to similar attacks as browsers. Exercise caution. ## 🗒️server.yml 📛 Partially supported in Web UI ### File Paths - Environment Variable: `SERVER_CONFIG_PATH` - Docker Host (Default): `/opt/mirakurun/config/server.yml` - Linux (Legacy): `/usr/local/etc/mirakurun/server.yml` ### Server Settings List | Property (🗒️server.yml) | Environment Variable (🐋Docker) | Type | Default | Description | |------------|------------------|-------|-----------|------| | `logLevel` | `LOG_LEVEL` | Integer | `2` | Log Level (`-1`: FATAL to `3`: DEBUG) | | `maxLogHistory` | `MAX_LOG_HISTORY` | Integer | `1000` | Maximum number of log lines to retain | | `path` | - | String, null | 🗒️`/var/run/mirakurun.sock` | Unix Socket Path **※Fixed to default in Docker** | | `port` | - | Integer, null | `40772` | Server Port **※Fixed at `40772` on the container side in Docker** | | `hostname` | `HOSTNAME` | String | `localhost` | Hostname | | `disableIPv6` | - | Boolean | `false` | Disable IPv6 **※Always disabled in Docker** | | `jobMaxRunning` | `JOB_MAX_RUNNING` | Integer | logical cores / 2, min 1, max 100 | Maximum number of jobs that can run simultaneously | | `jobMaxStandby` | `JOB_MAX_STANDBY` | Integer | logical cores - 1, min 1, max 100 | Maximum number of jobs that can be prepared simultaneously | | `maxBufferBytesBeforeReady` | `MAX_BUFFER_BYTES_BEFORE_READY` | Integer | `8388608` | Maximum buffer size before ready (bytes)
**※Increase if the beginning of the program is missing** | | `eventEndTimeout` | `EVENT_END_TIMEOUT` | Integer | `1000` | Event end timeout (milliseconds)
**※Increase if program end is incorrectly detected** | | `programGCJobSchedule` | `PROGRAM_GC_JOB_SCHEDULE` | String | `45 * * * *` | Program list GC schedule (cron-like format) | | `epgGatheringJobSchedule` | `EPG_GATHERING_JOB_SCHEDULE` | String | `20,50 * * * *` | EPG gathering schedule (cron-like format) | | `epgRetrievalTime` | `EPG_RETRIEVAL_TIME` | Integer | `600000` | EPG retrieval time (milliseconds) | | `logoDataInterval` | `LOGO_DATA_INTERVAL` | Integer | `604800000` | Logo data update interval (milliseconds) | | `disableEITParsing` | `DISABLE_EIT_PARSING` | Boolean | `false` | ⚠️Disable EIT parsing | | `disableWebUI` | `DISABLE_WEB_UI` | Boolean | `false` | ⚠️Disable Web UI | | `allowIPv4CidrRanges` | `ALLOW_IPV4_CIDR_RANGES` | String[] | `["10.0.0.0/8", "127.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]` | ⚠️Allowed IPv4 CIDR blocks | | `allowIPv6CidrRanges` | `ALLOW_IPV6_CIDR_RANGES` | String[] | `["fc00::/7"]` | ⚠️Allowed IPv6 CIDR blocks | | `allowOrigins` | `ALLOW_ORIGINS` | String[] | `["https://mirakurun-secure-contexts-api.pages.dev"]` | ⚠️🧪Allowed origins (experimental) | | `allowPNA` | `ALLOW_PNA` | Boolean | `true` | 🧪[PNA](https://github.com/WICG/private-network-access)/[LNA](https://github.com/explainers-by-googlers/local-network-access) permission settings (experimental) | | `tsplayEndpoint` | `TSPLAY_ENDPOINT` | String | `https://mirakurun-secure-contexts-api.pages.dev/tsplay/` | 🧪TSPlay endpoint (experimental) | ## 🗒️tuners.yml 💯 Fully supported in Web UI ### File Path - Environment Variable: `TUNERS_CONFIG_PATH` - Docker Host (Default): `/opt/mirakurun/config/tuners.yml` - Linux (Legacy): `/usr/local/etc/mirakurun/tuners.yml` ### Structure ```yaml # Array - name: TunerIdentificationName # String types: # (GR|BS|CS|SKY)[] - GR - BS - CS - SKY # For chardev/dvb # "