An event notification reports that something happened. An authentication decision controls whether a request is admitted. Keep these responsibilities separate, especially when migrating the older mount callbacks described by the web manual to Icecast 2.5.0’s shipped configuration.
Read the binding at the correct scope
The 2.5.0 example includes source-connect and source-disconnect bindings inside a mount. This excerpt belongs in the appropriate <mount> block and invokes your own restricted executable:
<event-bindings>
<event type="exec" trigger="source-connect">
<option name="executable" value="/ABSOLUTE/PRIVATE/PATH/stream-start"/>
</event>
<event type="exec" trigger="source-disconnect">
<option name="executable" value="/ABSOLUTE/PRIVATE/PATH/stream-stop"/>
</event>
</event-bindings>The paths are explicit replacement values; those programs are not supplied here. The release example also shows URL events using type="url", a url option and an action such as mount_add. Do not infer a callback’s payload or execution guarantees from the event’s friendly name alone. Check the actual event implementation for the data your integration consumes.
Constrain the side effect
Run hook programs with the minimum privileges the service needs. Keep executable files outside served directories and prevent the service account or untrusted users from rewriting a more privileged program. Treat incoming mount names and metadata as data; never concatenate them into a shell command.
A remote event target can fail, respond slowly or be temporarily unreachable. Design your receiver so repeated notifications do not cause duplicate irreversible actions. Keep diagnostics free of secrets and personal information that the integration does not need.
Test one lifecycle at a time
Use a private test mount and a harmless receiver that records only a marker. Connect, disconnect and reconnect the source; inspect both the Icecast log and the receiver. Repeat with a controlled receiver failure. Confirm that stream delivery and authentication still behave as intended. A syntactically valid event block proves neither that the executable exists nor that a remote callback arrived.