WebRTC output

output.http.webrtc.enabled defaults to false. When enabled, the WHEP entry point is POST /whep/{encoded-streamId} on the shared viewer-facing HTTP listener. The returned resource URL owns later Trickle ICE PATCH and session DELETE requests. Operational and control routes remain on the separate operational listener.

Local SRT push and managed pull inputs publish their current normalized generation to WebRTC. With input.srt.cascade enabled, a WHEP request for an absent local stream starts the same bounded on-demand upstream pull used by LL-HLS. Local ownership wins. A source generation change closes existing viewers instead of moving them to the replacement.

"http": {
  "listener": {"host": "0.0.0.0", "port": 8080},
  "webrtc": {
    "enabled": true,
    "network": {"udpPort": 50000},
    "security": {"mode": "anonymous"}
  }
}

Closed networks only: anonymous mode is for a trusted network. Use bearer credentials, an explicit browser-origin allowlist and TURN where untrusted clients can reach the listener.

Construct an absolute endpoint such as https://media.example.com/whep/camera-a and percent-encode the complete stream ID. Use HTTPS outside loopback. A cross-origin player must send an allowed Origin and the server response must expose Location, ETag and Link to browser code.

Before creating RTCPeerConnection, send an empty authenticated POST to the endpoint with /ice-servers appended. Pass the returned iceServers array into the peer connection. Direct or STUN-only configurations return no secret credential; TURN configurations return short-lived credentials that must not be logged or persisted.

Add receive-only audio and video transceivers, create the SDP offer, then send it to the WHEP endpoint with Content-Type: application/sdp. Apply the SDP answer from the 201 Created response. Use the returned resource URL and strong ETag for optional application/trickle-ice-sdpfrag PATCH requests. Stop playback with a conditional DELETE carrying If-Match, then close the local peer connection and tracks.

Muted autoplay is the portable first attempt. Keep visible Play and Unmute controls for browsers that require a user gesture.

Video is H.264 Constrained Baseline. The current profile accepts only the validated 42c0 and 42e0 source forms with 8-bit 4:2:0 progressive video, supported level and parameter sets, Annex-B framing and no B frames. Unsupported profiles or syntax are rejected. Viewer packetization is private to WebRTC and does not change the normalized source used by other outputs.

AAC or MPEG audio is converted on demand to one fixed mono 48 kHz, 64 kbit/s Opus profile. Viewers of the same source track and generation share a bounded encoder feed while keeping independent RTP state. Audio worker capacity or failure closes only the affected WebRTC session; other outputs remain active.

ffmpeg -re \
  -f lavfi -i 'testsrc2=size=1280x720:rate=25' \
  -f lavfi -i 'sine=frequency=1000:sample_rate=48000' \
  -map 0:v:0 -map 1:a:0 \
  -c:v libx264 -preset veryfast -tune zerolatency \
  -profile:v baseline -level:v 3.1 -pix_fmt yuv420p \
  -g 25 -keyint_min 25 -sc_threshold 0 -bf 0 \
  -c:a aac -ac 1 -ar 48000 -b:a 64k \
  -muxdelay 0 -muxpreload 0 -pes_payload_size 0 -flush_packets 1 \
  -f mpegts \
  'srt://127.0.0.1:6001?mode=caller&streamid=demo'

network.udpPort is required. tcpPort enables ICE over TCP. WebRTC ports must not overlap HTTP, operational, SRT ingest or cascade-output listeners on a shared bind address. IPv4 is the default; IPv6 can be enabled explicitly. Direct candidates can use selected local addresses, or candidateMode: "rewrite" can map canonical local CIDRs to same-family external addresses.

Use stun: for STUN and turn: or turns: with an explicit UDP or TCP transport for TURN. TURN requires bearer mode and turnSharedSecret. internetReady: true also requires a TURN-over-TLS route. The server derives temporary credentials for bootstrap and signaling responses.

Bearer credentials contain a principal, a 32 to 512 printable ASCII byte token and an allowed stream list. A sole "*" entry allows every valid stream ID. The complete configuration page shows the accepted network, admission, rate, timeout, ICE, audio and tracing fields.

Admission bounds published sessions, half-open setup work and ICE bootstrap independently. WHEP POST, bootstrap, PATCH and DELETE requests have separate global and scoped token buckets. Setup, request, idle and maximum-lifetime deadlines are explicit.

Enabled WebRTC output registers process-level WHEP, session, setup, first-RTP, candidate, RTP, RTCP, queue and Opus metrics on the operational /metrics endpoint. Optional sampled setup traces use identity-free bounded fields. Disabled WebRTC output creates no WebRTC network resources or metric families.

Complete configuration lists every accepted field and current example bound.