diff --git a/daemons/execd/remoted_tls.c b/daemons/execd/remoted_tls.c
index 8681419421..d9514db7b2 100644
--- a/daemons/execd/remoted_tls.c
+++ b/daemons/execd/remoted_tls.c
@@ -1,408 +1,417 @@
 /*
  * Copyright 2012-2019 the Pacemaker project contributors
  *
  * The version control history for this file may have further details.
  *
  * This source code is licensed under the GNU Lesser General Public License
  * version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
  */
 
 #include <crm_internal.h>
 
 #include <glib.h>
 #include <unistd.h>
 
 #include <crm/crm.h>
 #include <crm/msg_xml.h>
 #include <crm/crm.h>
 #include <crm/msg_xml.h>
 #include <crm/common/mainloop.h>
 #include <crm/common/remote_internal.h>
 
 #include <netdb.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <netinet/ip.h>
 #include <arpa/inet.h>
 
 #include "pacemaker-execd.h"
 
 #ifdef HAVE_GNUTLS_GNUTLS_H
 
 #  include <gnutls/gnutls.h>
 
 // Hidden in liblrmd
 extern int lrmd_tls_set_key(gnutls_datum_t *key);
 
 #  define LRMD_REMOTE_AUTH_TIMEOUT 10000
 gnutls_psk_server_credentials_t psk_cred_s;
 gnutls_dh_params_t dh_params;
 static int ssock = -1;
 extern int lrmd_call_id;
 
 static void
 debug_log(int level, const char *str)
 {
     fputs(str, stderr);
 }
 
 /*!
  * \internal
  * \brief Read (more) TLS handshake data from client
  */
 static int
 remoted__read_handshake_data(crm_client_t *client)
 {
     int rc = pcmk__read_handshake_data(client);
 
     if (rc == 0) {
         /* No more data is available at the moment. Just return for now;
          * we'll get invoked again once the client sends more.
          */
         return 0;
     } else if (rc < 0) {
         crm_err("TLS handshake with remote client failed: %s "
                 CRM_XS " rc=%d", gnutls_strerror(rc), rc);
         return -1;
     }
 
     if (client->remote->auth_timeout) {
         g_source_remove(client->remote->auth_timeout);
     }
     client->remote->auth_timeout = 0;
 
     client->remote->tls_handshake_complete = TRUE;
     crm_notice("Remote client connection accepted");
 
     // Alert other clients of the new connection
     notify_of_new_client(client);
     return 0;
 }
 
 static int
 lrmd_remote_client_msg(gpointer data)
 {
     int id = 0;
     int rc = 0;
     int disconnected = 0;
     xmlNode *request = NULL;
     crm_client_t *client = data;
 
     if (client->remote->tls_handshake_complete == FALSE) {
         return remoted__read_handshake_data(client);
     }
 
     rc = crm_remote_ready(client->remote, 0);
     if (rc == 0) {
         /* no msg to read */
         return 0;
     } else if (rc < 0) {
         crm_info("Remote client disconnected while polling it");
         return -1;
     }
 
     crm_remote_recv(client->remote, -1, &disconnected);
 
     request = crm_remote_parse_buffer(client->remote);
     while (request) {
         crm_element_value_int(request, F_LRMD_REMOTE_MSG_ID, &id);
         crm_trace("Processing remote client request %d", id);
         if (!client->name) {
             const char *value = crm_element_value(request, F_LRMD_CLIENTNAME);
 
             if (value) {
                 client->name = strdup(value);
             }
         }
 
         lrmd_call_id++;
         if (lrmd_call_id < 1) {
             lrmd_call_id = 1;
         }
 
         crm_xml_add(request, F_LRMD_CLIENTID, client->id);
         crm_xml_add(request, F_LRMD_CLIENTNAME, client->name);
         crm_xml_add_int(request, F_LRMD_CALLID, lrmd_call_id);
 
         process_lrmd_message(client, id, request);
         free_xml(request);
 
         /* process all the messages in the current buffer */
         request = crm_remote_parse_buffer(client->remote);
     }
 
     if (disconnected) {
         crm_info("Remote client disconnected while reading from it");
         return -1;
     }
 
     return 0;
 }
 
 static void
 lrmd_remote_client_destroy(gpointer user_data)
 {
     crm_client_t *client = user_data;
 
     if (client == NULL) {
         return;
     }
 
     crm_notice("Cleaning up after remote client %s disconnected "
                CRM_XS " id=%s",
                (client->name? client->name : ""), client->id);
 
     ipc_proxy_remove_provider(client);
 
     /* if this is the last remote connection, stop recurring
      * operations */
     if (crm_hash_table_size(client_connections) == 1) {
         client_disconnect_cleanup(NULL);
     }
 
     if (client->remote->tls_session) {
         void *sock_ptr;
         int csock;
 
         sock_ptr = gnutls_transport_get_ptr(*client->remote->tls_session);
         csock = GPOINTER_TO_INT(sock_ptr);
 
         gnutls_bye(*client->remote->tls_session, GNUTLS_SHUT_RDWR);
         gnutls_deinit(*client->remote->tls_session);
         gnutls_free(client->remote->tls_session);
         close(csock);
     }
 
     lrmd_client_destroy(client);
     return;
 }
 
 static gboolean
 lrmd_auth_timeout_cb(gpointer data)
 {
     crm_client_t *client = data;
 
     client->remote->auth_timeout = 0;
 
     if (client->remote->tls_handshake_complete == TRUE) {
         return FALSE;
     }
 
     mainloop_del_fd(client->remote->source);
     client->remote->source = NULL;
     crm_err("Remote client authentication timed out");
 
     return FALSE;
 }
 
 static int
 lrmd_remote_listen(gpointer data)
 {
     int csock = 0;
     gnutls_session_t *session = NULL;
     crm_client_t *new_client = NULL;
 
     static struct mainloop_fd_callbacks lrmd_remote_fd_cb = {
         .dispatch = lrmd_remote_client_msg,
         .destroy = lrmd_remote_client_destroy,
     };
 
     csock = crm_remote_accept(ssock);
     if (csock < 0) {
         return TRUE;
     }
 
     session = pcmk__new_tls_session(csock, GNUTLS_SERVER, GNUTLS_CRD_PSK,
                                     psk_cred_s);
     if (session == NULL) {
         close(csock);
         return TRUE;
     }
 
     new_client = crm_client_alloc(NULL);
     new_client->remote = calloc(1, sizeof(crm_remote_t));
     new_client->kind = CRM_CLIENT_TLS;
     new_client->remote->tls_session = session;
 
     // Require the client to authenticate within this time
     new_client->remote->auth_timeout = g_timeout_add(LRMD_REMOTE_AUTH_TIMEOUT,
                                                      lrmd_auth_timeout_cb,
                                                      new_client);
     crm_info("Remote client pending authentication "
              CRM_XS " %p id: %s", new_client, new_client->id);
 
     new_client->remote->source =
         mainloop_add_fd("pacemaker-remote-client", G_PRIORITY_DEFAULT, csock,
                         new_client, &lrmd_remote_fd_cb);
     return TRUE;
 }
 
 static void
 lrmd_remote_connection_destroy(gpointer user_data)
 {
     crm_notice("TLS server session ended");
     return;
 }
 
 static int
 lrmd_tls_server_key_cb(gnutls_session_t session, const char *username, gnutls_datum_t * key)
 {
     return lrmd_tls_set_key(key);
 }
 
 static int
 bind_and_listen(struct addrinfo *addr)
 {
     int optval;
     int fd;
     int rc;
     char buffer[INET6_ADDRSTRLEN] = { 0, };
 
     crm_sockaddr2str(addr->ai_addr, buffer);
     crm_trace("Attempting to bind to address %s", buffer);
 
     fd = socket(addr->ai_family, addr->ai_socktype, addr->ai_protocol);
     if (fd < 0) {
         crm_perror(LOG_ERR, "Listener socket creation failed");
         return -1;
     }
 
     /* reuse address */
     optval = 1;
     rc = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(optval));
     if (rc < 0) {
         crm_perror(LOG_ERR, "Local address reuse not allowed on %s", buffer);
         close(fd);
         return -1;
     }
 
     if (addr->ai_family == AF_INET6) {
         optval = 0;
         rc = setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &optval, sizeof(optval));
         if (rc < 0) {
             crm_perror(LOG_INFO, "Couldn't disable IPV6-only on %s", buffer);
             close(fd);
             return -1;
         }
     }
 
     if (bind(fd, addr->ai_addr, addr->ai_addrlen) != 0) {
         crm_perror(LOG_ERR, "Cannot bind to %s", buffer);
         close(fd);
         return -1;
     }
 
     if (listen(fd, 10) == -1) {
         crm_perror(LOG_ERR, "Cannot listen on %s", buffer);
         close(fd);
         return -1;
     }
     return fd;
 }
 
 int
 lrmd_init_remote_tls_server()
 {
     int rc;
     int filter;
     int port = crm_default_remote_port();
     struct addrinfo hints, *res = NULL, *iter;
     char port_str[6]; // at most "65535"
     gnutls_datum_t psk_key = { NULL, 0 };
+    const char *bind_name = getenv("PCMK_remote_address");
 
     static struct mainloop_fd_callbacks remote_listen_fd_callbacks = {
         .dispatch = lrmd_remote_listen,
         .destroy = lrmd_remote_connection_destroy,
     };
 
-    crm_debug("Starting TLS listener on port %d", port);
+    crm_debug("Starting TLS listener on %s port %d",
+              (bind_name? bind_name : "all addresses on"), port);
     crm_gnutls_global_init();
     gnutls_global_set_log_function(debug_log);
 
     if (pcmk__init_tls_dh(&dh_params) != GNUTLS_E_SUCCESS) {
         return -1;
     }
     gnutls_psk_allocate_server_credentials(&psk_cred_s);
     gnutls_psk_set_server_credentials_function(psk_cred_s, lrmd_tls_server_key_cb);
     gnutls_psk_set_server_dh_params(psk_cred_s, dh_params);
 
     /* The key callback won't get called until the first client connection
      * attempt. Do it once here, so we can warn the user at start-up if we can't
      * read the key. We don't error out, though, because it's fine if the key is
      * going to be added later.
      */
     rc = lrmd_tls_set_key(&psk_key);
     if (rc != 0) {
         crm_warn("A cluster connection will not be possible until the key is available");
     }
     gnutls_free(psk_key.data);
 
     memset(&hints, 0, sizeof(struct addrinfo));
-    /* Bind to the wildcard address (INADDR_ANY or IN6ADDR_ANY_INIT).
-     * @TODO allow user to specify a specific address
-     */
     hints.ai_flags = AI_PASSIVE;
     hints.ai_family = AF_UNSPEC; /* Return IPv6 or IPv4 */
     hints.ai_socktype = SOCK_STREAM;
     hints.ai_protocol = IPPROTO_TCP;
 
     snprintf(port_str, sizeof(port_str), "%d", port);
-    rc = getaddrinfo(NULL, port_str, &hints, &res);
+    rc = getaddrinfo(bind_name, port_str, &hints, &res);
     if (rc) {
-        crm_err("Unable to get IP address info for local node: %s",
-                gai_strerror(rc));
+        crm_err("Unable to get IP address(es) for %s: %s",
+                (bind_name? bind_name : "local node"), gai_strerror(rc));
         return -1;
     }
 
+    /* Currently we listen on only one address from the resulting list (the
+     * first IPv6 address we can bind to if possible, otherwise the first IPv4
+     * address we can bind to). When bind_name is NULL, this should be the
+     * respective wildcard address.
+     *
+     * @TODO If there is demand for specifying more than one address, allow
+     * bind_name to be a space-separated list, call getaddrinfo() for each,
+     * and create a socket for each result (set IPV6_V6ONLY on IPv6 sockets
+     * since IPv4 listeners will have their own sockets).
+     */
     iter = res;
     filter = AF_INET6;
-    /* Try IPv6 addresses first, then IPv4 */
     while (iter) {
         if (iter->ai_family == filter) {
             ssock = bind_and_listen(iter);
         }
         if (ssock != -1) {
             break;
         }
 
         iter = iter->ai_next;
         if (iter == NULL && filter == AF_INET6) {
             iter = res;
             filter = AF_INET;
         }
     }
 
     if (ssock < 0) {
         goto init_remote_cleanup;
     }
 
     mainloop_add_fd("pacemaker-remote-server", G_PRIORITY_DEFAULT, ssock, NULL,
                     &remote_listen_fd_callbacks);
 
     rc = ssock;
 
   init_remote_cleanup:
     if (rc < 0) {
         close(ssock);
         ssock = 0;
     } else {
-        crm_debug("Started TLS listener on port %d", port);
+        crm_debug("Started TLS listener on %s port %d",
+                  (bind_name? bind_name : "all addresses on"), port);
     }
     freeaddrinfo(res);
     return rc;
 }
 
 void
 lrmd_tls_server_destroy(void)
 {
     if (psk_cred_s) {
         gnutls_psk_free_server_credentials(psk_cred_s);
         psk_cred_s = 0;
     }
 
     if (ssock > 0) {
         close(ssock);
         ssock = 0;
     }
 }
 #endif
diff --git a/daemons/pacemakerd/pacemaker.sysconfig b/daemons/pacemakerd/pacemaker.sysconfig
index 27002a4b0d..c7745d85dd 100644
--- a/daemons/pacemakerd/pacemaker.sysconfig
+++ b/daemons/pacemakerd/pacemaker.sysconfig
@@ -1,160 +1,168 @@
 #==#==# Variables that control logging
 
 # Enable debug logging globally (yes|no) or by subsystem. Multiple subsystems
 # may be comma-separated, for example: PCMK_debug=pacemakerd,pacemaker-execd
 # Subsystems are:
 #  pacemakerd
 #  pacemaker-attrd
 #  pacemaker-based
 #  pacemaker-controld
 #  pacemaker-execd
 #  pacemaker-fenced
 #  pacemaker-schedulerd
 # PCMK_debug=no
 
 # Send detailed log messages to the specified file. Compared to messages logged
 # via syslog, messages in this file may have extended information, and will
 # include messages of "info" severity (and, if debug and/or trace logging
 # has been enabled, those as well). This log is of more use to developers and
 # advanced system administrators, and when reporting problems.
 # PCMK_logfile=/var/log/pacemaker/pacemaker.log
 
 # Enable logging via syslog, using the specified syslog facility. Messages sent
 # here are of value to all Pacemaker users. This can be disabled using "none",
 # but that is not recommended. The default is "daemon".
 # PCMK_logfacility=none|daemon|user|local0|local1|local2|local3|local4|local5|local6|local7
 
 # Unless syslog logging is disabled using PCMK_logfacility=none, messages of
 # the specified severity and higher will be sent to syslog. The default value
 # of "notice" is appropriate for most installations; "info" is highly verbose
 # and "debug" is almost certain to send you blind (which is why there is a
 # separate detail log specified by PCMK_logfile).
 # PCMK_logpriority=emerg|alert|crit|error|warning|notice|info|debug
 
 # Log all messages from a comma-separated list of functions.
 # PCMK_trace_functions=function1,function2,function3
 
 # Log all messages from a comma-separated list of files (no path).
 # Wildcards are supported, e.g. PCMK_trace_files=prefix*.c
 # PCMK_trace_files=file.c,other.h
 
 # Log all messages matching comma-separated list of formats.
 # PCMK_trace_formats="Sent delete %d"
 
 # Log all messages from a comma-separated list of tags.
 # PCMK_trace_tags=tag1,tag2
 
 # Dump the blackbox whenever the message at function and line is emitted,
 # e.g. PCMK_trace_blackbox=te_graph_trigger:223,unpack_clone:81
 # PCMK_trace_blackbox=fn:line,fn2:line2,...
 
 # Enable blackbox logging globally or per-subsystem. The blackbox contains a
 # rolling buffer of all logs (including info, debug, and trace) and is written
 # after a crash or assertion failure, and/or when SIGTRAP is received. The
 # blackbox recorder can also be enabled for Pacemaker daemons at runtime by
 # sending SIGUSR1 (or SIGTRAP), and disabled by sending SIGUSR2. Specify value
 # as for PCMK_debug above.
 # PCMK_blackbox=no
 
 #==#==# Advanced use only
 
 # By default, nodes will join the cluster in an online state when they first
 # start, unless they were previously put into standby mode. If this variable is
 # set to "standby" or "online", it will force this node to join in the
 # specified state when starting.
 # (only supported for cluster nodes, not Pacemaker Remote nodes)
 # PCMK_node_start_state=default
 
 # Specify an alternate location for RNG schemas and XSL transforms.
 # (This is of use only to developers.)
 # PCMK_schema_directory=/some/path
 
 # Pacemaker consists of a master process with multiple subsidiary daemons. If
 # one of the daemons crashes, the master process will normally attempt to
 # restart it. If this is set to "true", the master process will instead panic
 # the host (see PCMK_panic_action). The default is unset.
 # PCMK_fail_fast=no
 
 # Pacemaker will panic its host under certain conditions. If this is set to
 # "crash", Pacemaker will trigger a kernel crash (which is useful if you want a
 # kernel dump to investigate). For any other value, Pacemaker will trigger a
 # host reboot. The default is unset.
 # PCMK_panic_action=crash
 
 #==#==# Pacemaker Remote
 # Use the contents of this file as the authorization key to use with Pacemaker
 # Remote connections. This file must be readable by Pacemaker daemons (that is,
 # it must allow read permissions to either the hacluster user or the haclient
 # group), and its contents must be identical on all nodes. The default is
 # "/etc/pacemaker/authkey".
 # PCMK_authkey_location=/etc/pacemaker/authkey
 
+# If the Pacemaker Remote service is run on the local node, it will listen
+# for connections on this address. The value may be a resolvable hostname or an
+# IPv4 or IPv6 numeric address. When resolving names or using the default
+# wildcard address (i.e. listen on all available addresses), IPv6 will be
+# preferred if available. When listening on an IPv6 address, IPv4 clients will
+# be supported (via IPv4-mapped IPv6 addresses).
+# PCMK_remote_address="192.0.2.1"
+
 # Use this TCP port number when connecting to a Pacemaker Remote node. This
 # value must be the same on all nodes. The default is "3121".
 # PCMK_remote_port=3121
 
 # Use these GnuTLS cipher priorities for TLS connections. See:
 #
 #   https://gnutls.org/manual/html_node/Priority-Strings.html
 #
 # Pacemaker will append ":+ANON-DH" for remote CIB access (when enabled) and
 # ":+DHE-PSK:+PSK" for Pacemaker Remote connections, as they are required for
 # the respective functionality.
 # PCMK_tls_priorities="NORMAL"
 
 # Set bounds on the bit length of the prime number generated for Diffie-Hellman
 # parameters needed by TLS connections. The default is not to set any bounds.
 #
 # If these values are specified, the server (Pacemaker Remote daemon, or CIB
 # manager configured to accept remote clients) will use these values to provide
 # a floor and/or ceiling for the value recommended by the GnuTLS library. The
 # library will only accept a limited number of specific values, which vary by
 # library version, so setting these is recommended only when required for
 # compatibility with specific client versions.
 #
 # If PCMK_dh_min_bits is specified, the client (connecting cluster node or
 # remote CIB command) will require that the server use a prime of at least this
 # size. This is only recommended when the value must be lowered in order for
 # the client's GnuTLS library to accept a connection to an older server.
 # The client side does not use PCMK_dh_max_bits.
 # 
 # PCMK_dh_min_bits=1024
 # PCMK_dh_max_bits=2048
 
 #==#==# IPC
 
 # Force use of a particular class of IPC connection.
 # PCMK_ipc_type=shared-mem|socket|posix|sysv
 
 # Specify an IPC buffer size in bytes. This is useful when connecting to really
 # big clusters that exceed the default 128KB buffer.
 # PCMK_ipc_buffer=131072
 
 #==#==# Profiling and memory leak testing (mainly useful to developers)
 
 # Affect the behavior of glib's memory allocator. Setting to "always-malloc"
 # when running under valgrind will help valgrind track malloc/free better;
 # setting to "debug-blocks" when not running under valgrind will perform
 # (somewhat expensive) memory checks.
 # G_SLICE=always-malloc
 
 # Uncommenting this will make malloc() initialize newly allocated memory
 # and free() wipe it (to help catch uninitialized-memory/use-after-free).
 # MALLOC_PERTURB_=221
 
 # Uncommenting this will make malloc() and friends print to stderr and abort
 # for some (inexpensive) memory checks.
 # MALLOC_CHECK_=3
 
 # Set as for PCMK_debug above to run some or all daemons under valgrind.
 # PCMK_valgrind_enabled=no
 
 # Set as for PCMK_debug above to run some or all daemons under valgrind with
 # the callgrind tool enabled.
 # PCMK_callgrind_enabled=no
 
 # Set the options to pass to valgrind, when valgrind is enabled. See
 # valgrind(1) man page for details. "--vgdb=no" is specified because
 # pacemaker-execd can lower privileges when executing commands, which would
 # otherwise leave a bunch of unremovable files in /tmp.
 VALGRIND_OPTS="--leak-check=full --trace-children=no --vgdb=no --num-callers=25 --log-file=/var/lib/pacemaker/valgrind-%p --suppressions=/usr/share/pacemaker/tests/valgrind-pcmk.suppressions --gen-suppressions=all"