Public access · BGPVR Operator guide

Both names point at the same IP. The main name goes through Cloudflare; the media name goes straight to your proxy, which accepts the main name only from Cloudflare and passes video on the media name. The suite itself also answers only video there.

Set the main address

Settings → Public access → Main address → type the address viewers use (for example https://tv.example.com) → Save (or Enter). Empty means the address this console is open on. It is the address the check reaches, the name in the reverse proxy settings, and what Settings → Integrations & API → Connection addresses shows. The links the server hands out still follow the address each device used, so a home-network shortcut keeps working. It cannot be the media address’s name.

Serve video from a media address

Create a DNS record for a second name (for example media.example.com) that points straight at your server: DNS only, never through a CDN proxy. Give it a certificate and point your proxy at the suite (Reverse proxy settings on the same page has nginx, Caddy, Traefik and Synology · QNAP versions). Then Settings → Public access → save the Main address (the media address can never take its name, nor the MAG stream address’s) → Media address → type it → Turn on media address. The server checks it first (about two minutes): the name resolves, the certificate is valid and how long it has left, it reaches this server, the proxy passes the name on, Cloudflare is not in front, video goes straight through and a stream stays open for 110 seconds. It turns on only if every step passes. From then on the M3U playlists, MAG boxes and (with BGPVR Player builds that read media_base) the app take their video from it; sign-in, the API, the guide and this console stay on the main address.

Set the MAG / set-top box address

Settings → Public access → MAG / set-top box address → type where MAG and other set-top boxes get their portal and streams (for example http://mag.example.com:8095) → Save (or Enter). Plain http is normal there: old boxes cannot check newer certificates. Empty: the boxes use the media address, else the address they opened the portal on. It is the same setting as Modules → MAG Stream Base URL (either place saves it) and it can never be the media address’s name: everything but video answers 404 there, the portal included.

See where each kind of device connects

Settings → Public access → Device ports lists, for information: this server’s web port (the console, the apps, Xtream and M3U players, the MAG portal and its streams; old Tvheadend clients set to port 9981 keep working when your router forwards 9981 to it), the MAG portal’s address, and the HTSP port for Kodi’s Tvheadend client (on or off: Modules → HTSP / Kodi Adapter). Check now also checks the MAG address (it resolves, connects and the BGPVR portal answers at /stalker_portal/c/) and, when HTSP is on, that its port takes a connection on the MAG name (else the main one). These checks only read: they change nothing.

Check the addresses

Check now checks the main address and the media address in the field from the server, side by side, and changes nothing. Each step says what it found in plain words. A certificate that runs out within 14 days is a warning; a main address behind Cloudflare is a warning that suggests a media address.

Turn it on although the check failed

The server checks from its own network, which may not see the address as your viewers do (many routers cannot reach their own public address from inside). When the check fails only on such steps, the result offers Turn on anyway…: it asks you to confirm that you checked from outside (for example a phone on mobile data) and records who turned it on and which steps failed. It is never offered when the address is the console’s own name, when the proxy does not pass the name on, or when the console answers on the media address.

One public IP address (the usual home or small-office setup)

Point both names at the same IP: the main name through Cloudflare (orange cloud), the media name DNS only (grey cloud). The DNS-only name shows anyone that IP, so on your proxy accept the main name’s connections only from Cloudflare’s address ranges (keep the list current from https://www.cloudflare.com/ips/), serve only the video paths on the media name (the suite enforces it too) with per-address rate and connection limits, and give the media name its own certificate (a DNS challenge works when port 80 is closed). If old set-top boxes or players use another port (for example MAG boxes on 8095), keep it working: there, block only the console and sign-in paths.

The viewer help names this server, never ours (2.9.419)

Every address the subscriber help (/help) tells a viewer to type (the Server URL in Kodi, Xtream apps, the MAG portal, the app download) is the address your server's help is opened on, so your own domain. Kodi's Tvheadend HTSP client gets the host of your Media address (above) when you set one, because a web proxy such as Cloudflare lets only the web ports through, and the HTSP port from Modules. Without a Media address the help names this site's host.

Watch out

What the media address serves (2.9.352): only video (live TV, catch-up and timeshift, recordings, films and episodes, and the MAG portal’s streams). Everything else answers 404 there: the console, sign-in, the API, the guide and the playlists. It never takes an account password: links carry each account’s stream key instead (the one in its M3U and Xtream links, which Reset my links changes), and MAG links carry a signed key for that channel and that box that lasts 24 hours. A stream that is playing is never cut: the key is checked when a stream opens. A password or a console sign-in sent there is refused.
Xtream Codes players (TiviMate, Smarters and others) keep the main address for sign-in and video: the protocol has no separate video address, and those players build both from the one address you gave them. M3U playlists and MAG boxes move to the media address; the BGPVR app moves once a build that reads media_base is installed.
A MAG stream address set on Modules → Stalker (stalker_stream_base_url) keeps priority for MAG boxes: clear it to move MAG video to the media address. Old MAG firmware may not trust Let’s Encrypt certificates, so check one box after the change.
Use a new name for the media address: every request on it is limited to video, so never reuse the name your MAG portal or console is set up on. Turning it off brings every link back to the main address; players that saved a playlist keep asking for the media name until they reload it, so keep the name working for a while.
Your proxy must pass the host name on (proxy_set_header Host $host in nginx; not $http_host, which Debian’s proxy_params uses); otherwise the server cannot tell the media name from the main one, and the check fails on that step. The suite already tells nginx not to buffer video (X-Accel-Buffering: no).
A check holds the server’s own connection to each name for about two minutes; one check per name runs at a time. The proxy settings use 127.0.0.1:8095 for the suite: change it to where your proxy reaches it.
HTSP for Kodi (2.9.358) is a plain TCP port, not a web address: it cannot go through Cloudflare. Give Kodi a DNS-only name (the MAG address works) and forward the HTSP port on your router.