rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

go2rtc: bind to loopback; isolate the camera from routing

Browse source 
The go2rtc API is unauthenticated and echoes producer URLs, so
GET /api/streams handed out the camera's RTSP password to anything
on the LAN. Bind api/rtsp/webrtc to 127.0.0.1 and add an `isolated`
device flag that drops the camera in the forward chain.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-09-12 12:52:27 +01:00
parent d9b4c34b6b
commit 33db456c4c
3 changed files with 54 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

34
services/go2rtc.nix
View file

@ -1,13 +1,30 @@
# services/go2rtc.nix — Native go2rtc camera streaming
# RTSP credentials kept out of the nix store via runtime config templating
#
# Every listener binds to loopback. go2rtc's API has no authentication of its
# own and `GET /api/streams` returns each producer URL verbatim — for this
# camera that string contains its RTSP username and password. A bare ":1984"
# binds every interface, and the router's input chain accepts the whole LAN
# ("iifname eth0 accept" in services/router.nix), so any device on the wifi
# could read those credentials and then talk to the camera directly, out of
# band of this server entirely. Port 8554 leaked the video itself the same way.
#
# Nothing off-box needs these: nginx reverse-proxies 1984 from localhost behind
# Authelia (camera.nordhammer.it) and frigate.nix, when it is enabled, pulls
# rtsp://127.0.0.1:8554. Browsers lose direct WebRTC and fall back to MSE over
# the proxied websocket — a little more latency, no loss of function.
{ config, lib, pkgs, ... }:
let
listeners = {
api.listen = "127.0.0.1:1984";
rtsp.listen = "127.0.0.1:8554";
webrtc.listen = "127.0.0.1:8555";
};
# Template config with placeholder — real URL injected at runtime
configTemplate = pkgs.writeText "go2rtc-template.yaml" (builtins.toJSON {
streams.kids_bedroom = "@RTSP_URL@";
api.listen = ":1984";
webrtc.listen = ":8555";
});
configTemplate = pkgs.writeText "go2rtc-template.yaml" (builtins.toJSON (
listeners // { streams.kids_bedroom = "@RTSP_URL@"; }
));
injectSecrets = pkgs.writeShellScript "go2rtc-inject-secrets" ''
set -euo pipefail
@ -24,12 +41,11 @@ in
{
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
# settings is not what the daemon reads (ExecStart below points at the
# templated config), but keep it identical so the two can't drift.
services.go2rtc = {
enable = true;
settings = {
api.listen = ":1984";
webrtc.listen = ":8555";
};
settings = listeners;
};
# Override to use runtime-templated config with secrets