add WEBAPI_LISTENERS configuration

cmd/server/factory.go

@@ -593,7 +593,7 @@ func WebAPI(deps Container) *webapi.Server {
 		FeedbagService:     deps.feedbagSvc,
 	}
 	// Pass SQLiteUserStore as the API key validator (it implements middleware.APIKeyValidator)
-	return webapi.NewServer([]string{"0.0.0.0:80"}, logger, handler, deps.sqLiteUserStore, deps.webAPISessionManager)
+	return webapi.NewServer(deps.cfg.WebAPIListeners, logger, handler, deps.sqLiteUserStore, deps.webAPISessionManager)
 }
 
 // ICQLegacy creates a legacy ICQ server for v2-v5 protocols.

config/config.go

@@ -48,6 +48,7 @@ type Config struct {
 	KerberosListeners       []string `envconfig:"KERBEROS_LISTENERS" required:"false" basic:"" ssl:"LOCAL://0.0.0.0:1088" description:"Network listeners for Kerberos authentication. See OSCAR_LISTENERS doc for more details.\n\nExamples:\n\t// Listen on all interfaces\n\tLAN://0.0.0.0:1088\n\t// Separate Internet and LAN config\n\tWAN://142.250.176.206:1088,LAN://192.168.1.10:1087"`
 	TOCListeners            []string `envconfig:"TOC_LISTENERS" required:"true" basic:"0.0.0.0:9898" ssl:"0.0.0.0:9898" description:"Network listeners for TOC protocol service.\n\nFormat: Comma-separated list of hostname:port pairs.\n\nExamples:\n\t// All interfaces\n\t0.0.0.0:9898\n\t// Multiple listeners\n\t0.0.0.0:9898,192.168.1.10:9899"`
 	APIListener             string   `envconfig:"API_LISTENER" required:"true" basic:"127.0.0.1:8080" ssl:"127.0.0.1:8080" description:"Network listener for management API binds to. Only 1 listener can be specified. (Default 127.0.0.1 restricts to same machine only)."`
+	WebAPIListeners         []string `envconfig:"WEBAPI_LISTENERS" required:"false" basic:"0.0.0.0:8081" ssl:"0.0.0.0:8081" description:"Network listeners for WebAPI. See OSCAR_LISTENERS doc for more details.\n\nExamples:\n\t// Listen on all interfaces\n\tLAN://0.0.0.0:8081\n\t// Separate Internet and LAN config\n\tWAN://142.250.176.206:8081,LAN://192.168.1.10:8082"`
 
 	DBPath                 string `envconfig:"DB_PATH" required:"true" basic:"oscar.sqlite" ssl:"oscar.sqlite" description:"The path to the SQLite database file. The file and DB schema are auto-created if they doesn't exist."`
 	DisableAuth            bool   `envconfig:"DISABLE_AUTH" required:"true" basic:"true" ssl:"true" description:"Disable password check and auto-create new users at login time. Useful for quickly creating new accounts during development without having to register new users via the management API."`
@@ -270,5 +271,26 @@ func (c *Config) Validate() error {
 		return fmt.Errorf("invalid API listener %q: missing port. Valid format: HOST:PORT (e.g., 127.0.0.1:8080)", c.APIListener)
 	}
 
+	// Validate WebAPIListeners (format: hostname:port pairs, no scheme)
+	for _, listener := range c.WebAPIListeners {
+		listener = strings.TrimSpace(listener)
+		if listener == "" {
+			continue
+		}
+
+		host, port, err := net.SplitHostPort(listener)
+		if err != nil {
+			return fmt.Errorf("invalid web API listener %q: %v. Valid format: HOST:PORT (e.g., 0.0.0.0:8081)", listener, err)
+		}
+
+		if host == "" {
+			return fmt.Errorf("invalid web API listener %q: missing host. Valid format: HOST:PORT (e.g., 0.0.0.0:8081)", listener)
+		}
+
+		if port == "" {
+			return fmt.Errorf("invalid web API listener %q: missing port. Valid format: HOST:PORT (e.g., 0.0.0.0:8081)", listener)
+		}
+	}
+
 	return nil
 }

config/config_test.go

@@ -442,24 +442,27 @@ func TestConfigValidate(t *testing.T) {
 		{
 			name: "valid config with all fields",
 			config: Config{
-				TOCListeners: []string{"0.0.0.0:9898", "192.168.1.10:9899"},
-				APIListener:  "127.0.0.1:8080",
+				TOCListeners:    []string{"0.0.0.0:9898", "192.168.1.10:9899"},
+				APIListener:     "127.0.0.1:8080",
+				WebAPIListeners: []string{"0.0.0.0:8081"},
 			},
 			wantErr: false,
 		},
 		{
 			name: "valid config with single TOC listener",
 			config: Config{
-				TOCListeners: []string{"0.0.0.0:9898"},
-				APIListener:  "127.0.0.1:8080",
+				TOCListeners:    []string{"0.0.0.0:9898"},
+				APIListener:     "127.0.0.1:8080",
+				WebAPIListeners: []string{"0.0.0.0:8081"},
 			},
 			wantErr: false,
 		},
 		{
 			name: "valid config with empty TOC listeners",
 			config: Config{
-				TOCListeners: []string{},
-				APIListener:  "127.0.0.1:8080",
+				TOCListeners:    []string{},
+				APIListener:     "127.0.0.1:8080",
+				WebAPIListeners: []string{"0.0.0.0:8081"},
 			},
 			wantErr: false,
 		},
@@ -547,20 +550,80 @@ func TestConfigValidate(t *testing.T) {
 		{
 			name: "whitespace-only TOC listeners",
 			config: Config{
-				TOCListeners: []string{"   ", "  ", "  "},
-				APIListener:  "127.0.0.1:8080",
+				TOCListeners:    []string{"   ", "  ", "  "},
+				APIListener:     "127.0.0.1:8080",
+				WebAPIListeners: []string{"0.0.0.0:8081"},
 			},
 			wantErr: false,
 		},
 		{
 			name: "whitespace-only API listener",
 			config: Config{
-				TOCListeners: []string{"0.0.0.0:9898"},
-				APIListener:  "   ",
+				TOCListeners:    []string{"0.0.0.0:9898"},
+				APIListener:     "   ",
+				WebAPIListeners: []string{"0.0.0.0:8081"},
 			},
 			wantErr:     true,
 			errContains: "APIListener is required and cannot be empty",
 		},
+		{
+			name: "valid multiple web API listeners",
+			config: Config{
+				TOCListeners:    []string{"0.0.0.0:9898"},
+				APIListener:     "127.0.0.1:8080",
+				WebAPIListeners: []string{"0.0.0.0:8081", "192.168.1.10:8082"},
+			},
+			wantErr: false,
+		},
+		{
+			name: "whitespace-only web API listeners",
+			config: Config{
+				TOCListeners:    []string{"0.0.0.0:9898"},
+				APIListener:     "127.0.0.1:8080",
+				WebAPIListeners: []string{"   ", "  "},
+			},
+			wantErr: false,
+		},
+		{
+			name: "invalid web API listener - missing port",
+			config: Config{
+				TOCListeners:    []string{"0.0.0.0:9898"},
+				APIListener:     "127.0.0.1:8080",
+				WebAPIListeners: []string{"0.0.0.0"},
+			},
+			wantErr:     true,
+			errContains: "invalid web API listener \"0.0.0.0\": address 0.0.0.0: missing port in address",
+		},
+		{
+			name: "invalid web API listener - missing host",
+			config: Config{
+				TOCListeners:    []string{"0.0.0.0:9898"},
+				APIListener:     "127.0.0.1:8080",
+				WebAPIListeners: []string{":8081"},
+			},
+			wantErr:     true,
+			errContains: "invalid web API listener \":8081\": missing host",
+		},
+		{
+			name: "invalid web API listener - malformed",
+			config: Config{
+				TOCListeners:    []string{"0.0.0.0:9898"},
+				APIListener:     "127.0.0.1:8080",
+				WebAPIListeners: []string{"invalid-format"},
+			},
+			wantErr:     true,
+			errContains: "invalid web API listener \"invalid-format\": address invalid-format: missing port in address",
+		},
+		{
+			name: "invalid web API listener in comma-separated list",
+			config: Config{
+				TOCListeners:    []string{"0.0.0.0:9898"},
+				APIListener:     "127.0.0.1:8080",
+				WebAPIListeners: []string{"0.0.0.0:8081", "invalid-format", "192.168.1.10:8082"},
+			},
+			wantErr:     true,
+			errContains: "invalid web API listener \"invalid-format\": address invalid-format: missing port in address",
+		},
 	}
 
 	for _, tt := range tests {

config/settings.env

@@ -48,6 +48,15 @@ export TOC_LISTENERS=0.0.0.0:9898
 # specified. (Default 127.0.0.1 restricts to same machine only).
 export API_LISTENER=127.0.0.1:8080
 
+# Network listeners for WebAPI. See OSCAR_LISTENERS doc for more details.
+# 
+# Examples:
+# 	// Listen on all interfaces
+# 	LAN://0.0.0.0:8081
+# 	// Separate Internet and LAN config
+# 	WAN://142.250.176.206:8081,LAN://192.168.1.10:8082
+export WEBAPI_LISTENERS=0.0.0.0:8081
+
 # The path to the SQLite database file. The file and DB schema are auto-created
 # if they doesn't exist.
 export DB_PATH=oscar.sqlite

config/ssl/settings.env

@@ -62,6 +62,15 @@ export TOC_LISTENERS=0.0.0.0:9898
 # specified. (Default 127.0.0.1 restricts to same machine only).
 export API_LISTENER=127.0.0.1:8080
 
+# Network listeners for WebAPI. See OSCAR_LISTENERS doc for more details.
+# 
+# Examples:
+# 	// Listen on all interfaces
+# 	LAN://0.0.0.0:8081
+# 	// Separate Internet and LAN config
+# 	WAN://142.250.176.206:8081,LAN://192.168.1.10:8082
+export WEBAPI_LISTENERS=0.0.0.0:8081
+
 # The path to the SQLite database file. The file and DB schema are auto-created
 # if they doesn't exist.
 export DB_PATH=oscar.sqlite