From 72e936d3f1944d30e1463d0df5535b608818984b Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Thu, 6 Aug 2026 18:52:02 +0100
Subject: [PATCH] fix: viewer port starts/stops dynamically on config save,
 auth bypass removed

---
 main.go   | 23 +++++++++++++++++++----
 server.go |  7 ++++---
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/main.go b/main.go
index d438a95..9a3e0ad 100644
--- a/main.go
+++ b/main.go
@@ -8,6 +8,7 @@ package main
 import (
 	"fmt"
 	"log"
+	"net/http"
 	"os"
 	"os/signal"
 	"syscall"
@@ -82,8 +83,19 @@ func main() {
 		if app.go2rtc != nil { app.go2rtc.Stop() }
 		if app.snapshots != nil { app.snapshots.StopAll() }
 		if app.recorder != nil { app.recorder.StopAll() }
-		// Restart with the updated config from the server's in-memory copy.
+		// Handle viewer server toggle.
 		liveCfg := app.server.appConfig
+		if liveCfg.Auth.Viewer.Enabled && app.viewerSrv == nil {
+			go func() {
+				v, err := app.server.StartViewerServer()
+				if err != nil { log.Printf("Viewer server: %v", err) }
+				app.viewerSrv = v
+			}()
+		} else if !liveCfg.Auth.Viewer.Enabled && app.viewerSrv != nil {
+			log.Println("Stopping viewer server...")
+			app.viewerSrv.Close()
+			app.viewerSrv = nil
+		}
 		if liveCfg.Go2RTC.Enabled {
 			app.go2rtc = NewGo2RTCManager(liveCfg.Go2RTC)
 			app.go2rtc.Start(liveCfg.Cameras)
@@ -104,9 +116,11 @@ func main() {
 	// Start viewer server only if enabled.
 	if cfg.Auth.Viewer.Enabled {
 		go func() {
-			if err := app.server.StartViewerServer(); err != nil {
+			v, err := app.server.StartViewerServer()
+			if err != nil {
 				log.Printf("Viewer server: %v", err)
 			}
+			app.viewerSrv = v
 		}()
 	} else {
 		log.Println("Viewer server: disabled in config")
@@ -156,6 +170,7 @@ type App struct {
 	snapshots  *SnapshotEngine
 	recorder   *RecorderManager
 	cleaner    *Cleaner
+	viewerSrv  *http.Server
 }
 
 // StartServer initializes and starts the HTTP server.
@@ -169,9 +184,9 @@ func (a *App) StartServer() error {
 }
 
 // StartViewerServer launches the viewer-only server.
-func (a *App) StartViewerServer() error {
+func (a *App) StartViewerServer() (*http.Server, error) {
 	if a.server == nil {
-		return fmt.Errorf("main server not initialized")
+		return nil, fmt.Errorf("main server not initialized")
 	}
 	return a.server.StartViewerServer()
 }
diff --git a/server.go b/server.go
index 1640c1c..87a69bc 100644
--- a/server.go
+++ b/server.go
@@ -60,16 +60,17 @@ func (s *Server) ListenAndServe() error {
 }
 
 // StartViewerServer launches the viewer-only server on the configured port.
-func (s *Server) StartViewerServer() error {
+func (s *Server) StartViewerServer() (*http.Server, error) {
 	viewerAddr := s.config.Server.BindHost + s.config.Server.ViewerPort
 	if viewerAddr == "" || viewerAddr == ":0" || viewerAddr == ":" {
-		return nil // viewer port not configured
+		return nil, nil
 	}
 
 	viewerMux := http.NewServeMux()
 	viewerMux.Handle("/", s.middleware(s.viewerOnly(s.mux)))
+	v := &http.Server{Addr: viewerAddr, Handler: viewerMux}
 	log.Printf("Viewer server listening on %s (live wall only, no auth)", viewerAddr)
-	return http.ListenAndServe(viewerAddr, viewerMux)
+	return v, v.ListenAndServe()
 }
 
 // Close shuts down the HTTP server.