techy/Media-Server-Setup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 7+11: token-based publishing — MediaMTX authMethod http -> dumpd /mtx-auth (bridge-only port 8081); dumpd mints 12 h HMAC tokens for Discord-authenticated streamers; dock rewritten (no passwords, naming rules with live preview, prefix/suffix, manual-setup accordion with hidden token); portal uses tokens; configure.py drops streamers; MediaMTX hot-reload, Caddy reload — no stream interruption

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Brandyn / Techy
2026-10-31 15:22:15 -05:00
parent 2a74cb7b40
commit dcc347e1ea
11 changed files with 301 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
firewall/nftables.conf
View File

@@ -55,6 +55,9 @@ table inet vanguard {
tcp dport 3306 ct state new limit rate over 30/minute burst 20 packets drop
tcp dport 3306 ct state new accept
# dumpd /mtx-auth for MediaMTX (container -> host gateway): only from Docker bridge interfaces
iifname { "docker0", "br-*" } tcp dport 8081 accept
# NOT opened on purpose — these bind to 127.0.0.1 only and are reached via Caddy or an ssh tunnel:
# 9000 authentik · 8096 jellyfin · 3923 copyparty · 8384 syncthing UI · 8080 dumpd
# Docker publishes them on loopback, so its NAT never forwards outside traffic to them either.