# services/go2rtc.nix — Native go2rtc camera streaming
# RTSP credentials kept out of the nix store via runtime config templating
#
# Every listener binds to loopback. go2rtc's API has no authentication of its
# own and `GET /api/streams` returns each producer URL verbatim — for this
# camera that string contains its RTSP username and password. A bare ":1984"
# binds every interface, and the router's input chain accepts the whole LAN
# ("iifname eth0 accept" in services/router.nix), so any device on the wifi
# could read those credentials and then talk to the camera directly, out of
# band of this server entirely. Port 8554 leaked the video itself the same way.
#
# Nothing off-box needs these: nginx reverse-proxies 1984 from localhost behind
# Authelia (camera.nordhammer.it) and frigate.nix, when it is enabled, pulls
# rtsp://127.0.0.1:8554. Browsers lose direct WebRTC and fall back to MSE over
# the proxied websocket — a little more latency, no loss of function.
{ config, lib, pkgs, ... }:
let
  listeners = {
    api.listen = "127.0.0.1:1984";
    rtsp.listen = "127.0.0.1:8554";
    webrtc.listen = "127.0.0.1:8555";
  };

  # Template config with placeholder — real URL injected at runtime
  configTemplate = pkgs.writeText "go2rtc-template.yaml" (builtins.toJSON (
    listeners // { streams.kids_bedroom = "@RTSP_URL@"; }
  ));

  injectSecrets = pkgs.writeShellScript "go2rtc-inject-secrets" ''
    set -euo pipefail
    SECRETS="/var/secrets/go2rtc-rtsp-url"
    if [ -f "$SECRETS" ]; then
      RTSP_URL=$(tr -d '\n' < "$SECRETS")
      ${pkgs.gnused}/bin/sed "s|@RTSP_URL@|$RTSP_URL|g" ${configTemplate} > /run/go2rtc/config.yaml
    else
      echo "WARNING: $SECRETS not found, camera stream will not work" >&2
      cp ${configTemplate} /run/go2rtc/config.yaml
    fi
  '';
in
{
  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {

    # settings is not what the daemon reads (ExecStart below points at the
    # templated config), but keep it identical so the two can't drift.
    services.go2rtc = {
      enable = true;
      settings = listeners;
    };

    # Override to use runtime-templated config with secrets
    systemd.services.go2rtc.serviceConfig = {
      RuntimeDirectory = "go2rtc";
      ExecStartPre = [ "!${injectSecrets}" ];
      ExecStart = lib.mkForce "${config.services.go2rtc.package}/bin/go2rtc -config /run/go2rtc/config.yaml";
    };

  };
}