accept hostnames, wildcards, and padded values in networking.listen

The stricter parser broke localhost:5000, *:5000, and values with surrounding whitespace that the old int() parsing accepted. parse_listen_address now strips the value and accepts RFC 1123 hostnames and *, still rebuilding the rendered value from the parsed parts. The ListenConfig validator runs in before mode, because pydantic coerced true to port 1 while get_nginx_settings.py rejected it and fell back to 5000, so the auth internal port and nginx disagreed.

frigate/config/network.py

@@ -27,7 +27,9 @@ class ListenConfig(FrigateBaseModel):
         description="External listening port for Frigate (default 8971).",
     )
 
-    @field_validator("internal", "external")
+    # Runs before pydantic coerces a bool to an int port, which
+    # get_nginx_settings.py rejects when it reads the raw YAML
+    @field_validator("internal", "external", mode="before")
     @classmethod
     def validate_listen(cls, value: int | str) -> int | str:
         return parse_listen_address(value)[0]

frigate/test/test_network_config.py

@@ -45,6 +45,12 @@ class TestListenConfig(unittest.TestCase):
             "[::1]:5000": "[::1]:5000",
             "[::]:5000": "[::]:5000",
             "[2001:DB8:0:0::1]:5000": "[2001:db8::1]:5000",
+            " 5000 ": 5000,
+            "5000\n": 5000,
+            " 127.0.0.1:5000 ": "127.0.0.1:5000",
+            "localhost:5000": "localhost:5000",
+            "frigate-host.lan:5000": "frigate-host.lan:5000",
+            "*:5000": "*:5000",
         }
 
         for value, expected in cases.items():
@@ -59,17 +65,26 @@ class TestListenConfig(unittest.TestCase):
             "5000; location /x/ { alias /; autoindex on; } #:5000",
             "127.0.0.1:5000; include /etc/passwd",
             "5000 ssl",
-            " 5000",
             "5000;",
-            "5000\n",
-            "localhost:5000",
             "::1:5000",
             "[127.0.0.1]:5000",
             "[fe80::1%eth0]:5000",
+            "local host:5000",
+            "localhost;:5000",
+            "local{host}:5000",
+            "host#:5000",
+            "'localhost':5000",
+            '"localhost":5000',
+            "-host:5000",
+            "host-:5000",
+            "host..lan:5000",
+            "**:5000",
+            "*.lan:5000",
+            "unix:/tmp/sock:5000",
+            "5000 5001",
             ":5000",
             "127.0.0.1:",
             "127.0.0.1:+5000",
-            "127.0.0.01:5000",
             0,
             65536,
             -1,
@@ -80,6 +95,14 @@ class TestListenConfig(unittest.TestCase):
                 with self.assertRaises(ValidationError):
                     ListenConfig(internal=value)
 
+    def test_bool_listen_value_rejected(self):
+        # get_nginx_settings.py sees the raw bool and falls back to the default,
+        # so accepting it as port 1 would split nginx and the auth port check
+        for value in (True, False):
+            with self.subTest(value=value):
+                with self.assertRaises(ValidationError):
+                    ListenConfig(internal=value)
+
 
 if __name__ == "__main__":
     unittest.main(verbosity=2)

frigate/util/config.py

@@ -128,11 +128,18 @@ def redact_credential(obj: dict[str, Any], key: str) -> None:
         obj.pop(key, None)
 
 
+LISTEN_HOSTNAME = re.compile(
+    r"[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?"
+    r"(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*"
+)
+
+
 def parse_listen_address(value: int | str) -> tuple[int | str, int]:
     """Validate a networking.listen value and rebuild it from its parsed parts.
 
-    Accepts a port, "IPv4:port", or "[IPv6]:port". nginx receives the rebuilt
-    value verbatim, so anything else raises ValueError.
+    Accepts a port, "host:port", "*:port", or "[IPv6]:port", where host is an
+    IPv4 address or an RFC 1123 hostname. nginx receives the rebuilt value
+    verbatim, so anything else raises ValueError.
 
     Returns:
         The normalized value (an int for a bare port) and the port
@@ -140,7 +147,7 @@ def parse_listen_address(value: int | str) -> tuple[int | str, int]:
     if isinstance(value, bool) or not isinstance(value, int | str):
         raise ValueError(f"invalid listen value: {value!r}")
 
-    host, sep, port_text = str(value).rpartition(":")
+    host, sep, port_text = str(value).strip().rpartition(":")
 
     if not re.fullmatch(r"[0-9]{1,5}", port_text) or not (1 <= int(port_text) <= 65535):
         raise ValueError(f"invalid listen port: {value!r}")
@@ -158,7 +165,10 @@ def parse_listen_address(value: int | str) -> tuple[int | str, int]:
 
         return f"[{address}]:{port}", port
 
-    return f"{ipaddress.IPv4Address(host)}:{port}", port
+    if host != "*" and not LISTEN_HOSTNAME.fullmatch(host):
+        raise ValueError(f"invalid listen address: {value!r}")
+
+    return f"{host}:{port}", port
 
 
 def find_config_file() -> str: