rope
33db456c4c
The go2rtc API is unauthenticated and echoes producer URLs, so GET /api/streams handed out the camera's RTSP password to anything on the LAN. Bind api/rtsp/webrtc to 127.0.0.1 and add an `isolated` device flag that drops the camera in the forward chain. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
24 lines
1.2 KiB
TOML
24 lines
1.2 KiB
TOML
# devices.toml — LAN device registry for the router (services/router.nix)
|
|
#
|
|
# Written by the router UI (router.nordhammer.it), safe to edit by hand.
|
|
# Fields:
|
|
# mac — device MAC, lowercase hex with colons (required)
|
|
# name — DHCP hostname / label (required)
|
|
# ip — static reservation. Omit for a normal pool lease.
|
|
# Must be OUTSIDE the DHCP pool 10.0.0.100-250.
|
|
# blocked — true drops all traffic from this MAC on the LAN interface.
|
|
# Omitted rather than written as false, which is what the UI does.
|
|
# isolated — true refuses to route anything for this MAC: no internet, no
|
|
# other LAN host. It can still reach services on the router
|
|
# itself (DHCP, DNS, and go2rtc pulling its feed all terminate
|
|
# here, so they never hit the forward chain). Stand-in for the
|
|
# camera VLAN this network can't build. Unlike `blocked`, the
|
|
# device keeps working for its one intended job.
|
|
# note — free text, shown in the UI only
|
|
|
|
[[device]]
|
|
mac = "f0:a7:31:6c:50:4b"
|
|
name = "camera-bedroom"
|
|
ip = "10.0.0.39"
|
|
isolated = true
|
|
note = "go2rtc / RTSP source; no route off-LAN — see isolated flag above"
|