rope
33db456c4c
The go2rtc API is unauthenticated and echoes producer URLs, so GET /api/streams handed out the camera's RTSP password to anything on the LAN. Bind api/rtsp/webrtc to 127.0.0.1 and add an `isolated` device flag that drops the camera in the forward chain. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
59 lines
2.4 KiB
Nix
59 lines
2.4 KiB
Nix
# services/go2rtc.nix — Native go2rtc camera streaming
|
|
# RTSP credentials kept out of the nix store via runtime config templating
|
|
#
|
|
# Every listener binds to loopback. go2rtc's API has no authentication of its
|
|
# own and `GET /api/streams` returns each producer URL verbatim — for this
|
|
# camera that string contains its RTSP username and password. A bare ":1984"
|
|
# binds every interface, and the router's input chain accepts the whole LAN
|
|
# ("iifname eth0 accept" in services/router.nix), so any device on the wifi
|
|
# could read those credentials and then talk to the camera directly, out of
|
|
# band of this server entirely. Port 8554 leaked the video itself the same way.
|
|
#
|
|
# Nothing off-box needs these: nginx reverse-proxies 1984 from localhost behind
|
|
# Authelia (camera.nordhammer.it) and frigate.nix, when it is enabled, pulls
|
|
# rtsp://127.0.0.1:8554. Browsers lose direct WebRTC and fall back to MSE over
|
|
# the proxied websocket — a little more latency, no loss of function.
|
|
{ config, lib, pkgs, ... }:
|
|
let
|
|
listeners = {
|
|
api.listen = "127.0.0.1:1984";
|
|
rtsp.listen = "127.0.0.1:8554";
|
|
webrtc.listen = "127.0.0.1:8555";
|
|
};
|
|
|
|
# Template config with placeholder — real URL injected at runtime
|
|
configTemplate = pkgs.writeText "go2rtc-template.yaml" (builtins.toJSON (
|
|
listeners // { streams.kids_bedroom = "@RTSP_URL@"; }
|
|
));
|
|
|
|
injectSecrets = pkgs.writeShellScript "go2rtc-inject-secrets" ''
|
|
set -euo pipefail
|
|
SECRETS="/var/secrets/go2rtc-rtsp-url"
|
|
if [ -f "$SECRETS" ]; then
|
|
RTSP_URL=$(tr -d '\n' < "$SECRETS")
|
|
${pkgs.gnused}/bin/sed "s|@RTSP_URL@|$RTSP_URL|g" ${configTemplate} > /run/go2rtc/config.yaml
|
|
else
|
|
echo "WARNING: $SECRETS not found, camera stream will not work" >&2
|
|
cp ${configTemplate} /run/go2rtc/config.yaml
|
|
fi
|
|
'';
|
|
in
|
|
{
|
|
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
|
|
|
|
# settings is not what the daemon reads (ExecStart below points at the
|
|
# templated config), but keep it identical so the two can't drift.
|
|
services.go2rtc = {
|
|
enable = true;
|
|
settings = listeners;
|
|
};
|
|
|
|
# Override to use runtime-templated config with secrets
|
|
systemd.services.go2rtc.serviceConfig = {
|
|
RuntimeDirectory = "go2rtc";
|
|
ExecStartPre = [ "!${injectSecrets}" ];
|
|
ExecStart = lib.mkForce "${config.services.go2rtc.package}/bin/go2rtc -config /run/go2rtc/config.yaml";
|
|
};
|
|
|
|
};
|
|
}
|