Interface OPCUAServerEndpointOptions

Additional endpoint URL(s) to advertise.

Use when the server is behind Docker port-mapping, a reverse proxy, or a NAT gateway. Each URL is parsed to extract hostname and port. Each entry can be a plain URL string (inherits all security settings from the main endpoint) or an AdvertisedEndpointConfig object with per-URL overrides. The server still listens on port.

tells if the server default endpoints should allow anonymous connection.

When false, UserTokenType.Anonymous is removed from the advertised user token policies, even if it is listed in userTokenTypes.

when true, the endpoint with SecurityPolicy.None also advertises a UserName token policy without any user token security policy (policyId username_unsecure): the password is then sent in clear text over an unsecured channel.

This is strongly discouraged by OPC 10000-4 and is only meant for legacy clients on trusted, isolated networks. It has no effect when UserTokenType.UserName is not in userTokenTypes or when MessageSecurityMode.None is not in securityModes.

alternate hostname or IP to use

true, if discovery service on secure channel shall be disabled

Host IP address or hostname where the TCP server listens for connections. If omitted, defaults to listening on all network interfaces:

• Unspecified IPv6 address (::) if IPv6 is available,
• Unspecified IPv4 address (0.0.0.0) otherwise. Use this to bind the server to a specific interface or IP.

In an endpoints[] entry, it applies to that listener only; when the entry has no host, the top-level host is used (then all interfaces). Binding each listener to its own interface is how two networks get different security settings (see advertisedEndpoints for the limits of per-URL settings on a shared listener).

note: hostname is what endpoint URLs advertise; host is where the socket is bound. They are independent.

the primary hostname of the endpoint.

the TCP port to listen to.

share the port with other listeners in this process or others (SO_REUSEPORT, Linux): the kernel spreads the incoming connections across them. Used by front threads, which all listen on the same port.

In an endpoints[] entry, it applies to that listener only; the top-level value is the fallback.

the possible security mode that the server will expose

the possible security policies that the server will expose

the user identity token types that the endpoints advertise in their userIdentityTokens (UserTokenPolicy) list.

The server only accepts, at ActivateSession, a user identity token whose type and policyId match one of the advertised UserTokenPolicies of the endpoint the session was created on: any other token is rejected with BadIdentityTokenInvalid. Restricting this list therefore restricts the way users can authenticate, not only what is shown to clients.

• UserTokenType.Anonymous is removed when allowAnonymous is false (allowAnonymous: false always wins).
• UserTokenType.IssuedToken is not supported yet and is ignored.
• the resulting list must not be empty, otherwise no client could ever activate a session: the server constructor throws.

Per-URL lists in advertisedEndpoints can only restrict this list. They all share this listener's socket, so a client presenting an unknown URL (or the URL of another listener) is limited to the most restrictive list of the listener it is connected to; to enforce a different list for some clients, give them their own listener in endpoints.