A mountpoint identifies one stream on one Icecast instance. Configuration and incoming media meet at its exact path. /live.ogg and /Live.ogg should not be treated as interchangeable names, and a configured path still needs a source or relay before it carries live media.
Decide what needs an override
Use a specific mount block when one stream needs its own source credentials, listener cap, public visibility or fallback policy. Leave unrelated values at their existing settings. Before editing, record the active source, format, current listener count and any fallback destination. Keep a copy of the working configuration.
This 2.5.0-compatible excerpt belongs directly inside <icecast> in the existing file:
<mount type="normal">
<mount-name>/live.ogg</mount-name>
<username>source</username>
<password>REPLACE_WITH_RANDOM_MOUNT_SECRET</password>
<max-listeners>40</max-listeners>
<public>false</public>
<fallback-mount>/backup.ogg</fallback-mount>
<fallback-override>true</fallback-override>
</mount>The marker is a value you must replace, not a usable default. After this change the encoder must use this mount-specific password. The backup is another active, compatible stream on the same server; declaring it here does not start it.
Understand defaults before relying on them
The documented type="default" mount supplies settings where no matching normal mount is defined. The documentation explicitly warns that default mounts do not simply merge all their values into an explicit normal mount. Put the complete intended policy into a normal mount rather than assuming an omitted authentication or visibility setting will inherit.
Regular Icecast 2.5.0 configuration is not KH configuration. Do not paste KH wildcard matching, host priority or bandwidth extensions into this file just because the XML looks similar. Conversely, do not assume a tutorial for Icecast 2.0.2 documents every current option.
Verify the effective result
Validate XML, then reload through your installation’s documented mechanism or perform a controlled restart. Some changes affect new connections or the next source start; a reload is not a guarantee that every existing session changes immediately. Watch the error log for obsolete or unrecognised settings.
Reconnect the source during a planned test and confirm the exact mount path in administration. Test the expected source secret and reject an incorrect one. Connect a listener and verify the stream’s actual format. For fallback testing, keep both streams active, remove only the test source, and confirm whether listeners move and return as intended.
Keep related controls separate
hidden removes a stream from certain generated listings; it is not access control. public governs directory publication and does not make a stream private. max-listeners limits this mount rather than every HTTP connection on the instance. Use listener authentication when listening actually requires authorisation, and inspect fallback behaviour before sharing a backup between several live mounts.