Go Live: MediaMTX credentials via X-Stream-Auth -> Authorization on the Caddy->MediaMTX hop (WebRTC ignores query params); fix WHIP session DELETE path

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
2026-10-31 00:56:56 -05:00
parent dff31b0b37
commit 4b4c7eaedf
2 changed files with 14 additions and 4 deletions

View File

@@ -164,6 +164,13 @@ def write_caddy(domain, auth_host="", watch_host="", git_host="", bot_host="", l
reverse_proxy 127.0.0.1:9997
}}
handle_path /webrtc/* {{
# Go Live sends MediaMTX credentials in X-Stream-Auth so Authentik's forward-auth never sees an
# Authorization header; Caddy turns it into Authorization only on the hop to MediaMTX.
@creds header X-Stream-Auth *
reverse_proxy @creds 127.0.0.1:8889 {{
header_up Authorization {{http.request.header.X-Stream-Auth}}
header_up -X-Stream-Auth
}}
reverse_proxy 127.0.0.1:8889
}}
handle_path /hls/* {{