rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

go2rtc: bind to loopback; isolate the camera from routing

Browse source 
The go2rtc API is unauthenticated and echoes producer URLs, so
GET /api/streams handed out the camera's RTSP password to anything
on the LAN. Bind api/rtsp/webrtc to 127.0.0.1 and add an `isolated`
device flag that drops the camera in the forward chain.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-09-12 12:52:27 +01:00
parent d9b4c34b6b
commit 33db456c4c
3 changed files with 54 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

9
devices.toml
View file

@ -8,10 +8,17 @@
# Must be OUTSIDE the DHCP pool 10.0.0.100-250.
# blocked — true drops all traffic from this MAC on the LAN interface.
# Omitted rather than written as false, which is what the UI does.
# isolated — true refuses to route anything for this MAC: no internet, no
# other LAN host. It can still reach services on the router
# itself (DHCP, DNS, and go2rtc pulling its feed all terminate
# here, so they never hit the forward chain). Stand-in for the
# camera VLAN this network can't build. Unlike `blocked`, the
# device keeps working for its one intended job.
# note — free text, shown in the UI only
[[device]]
mac = "f0:a7:31:6c:50:4b"
name = "camera-bedroom"
ip = "10.0.0.39"
note = "go2rtc / RTSP source"
isolated = true
note = "go2rtc / RTSP source; no route off-LAN — see isolated flag above"