Problem in overriding authInternalUsers configuration

[sizoune]

Question

hi, im using dokploy to deploy the mediamtx app. in there i set the environment like this

MTX_AUTHINTERNALUSERS_PERMISSIONS_ACTION=api
MTX_AUTHINTERNALUSERS_PERMISSIONS_PATH=
MTX_API=yes 
MTX_HLSVARIANT=fmp4 
MTX_RTSPTRANSPORT=tcp 
MTX_RTSPANYPORT=yes 
MTX_SOURCEONDEMAND=yes 
MTX_HLSALWAYSREMUX=yes 
MTX_READTIMEOUT=1000s
MTX_PROTOCOLS=tcp

im trying to add action:api in the default authInternalUsers permissions.
the problem is the mediamtx docs is not clear about how to set multiple authInternalUsers action ?

[moenodedev]

Try MTX_AUTHINTERNALUSERS_0_PERMISSIONS_0_ACTION=api

MTX_API=yes
MTX_APIENCRYPTION=yes
MTX_APISERVERCERT=/etc/mtx/server.crt
MTX_APISERVERKEY=/etc/mtx/server.key

MTX_AUTHINTERNALUSERS_0_USER=username
MTX_AUTHINTERNALUSERS_0_PASS=password
MTX_AUTHINTERNALUSERS_0_PERMISSIONS_0_ACTION=api
MTX_AUTHINTERNALUSERS_0_PERMISSIONS_1_ACTION=metrics
MTX_AUTHINTERNALUSERS_0_PERMISSIONS_2_ACTION=pprof

MTX_HLSENCRYPTION=yes
MTX_HLSSERVERCERT=/etc/mtx/server.crt
MTX_HLSSERVERKEY=/etc/mtx/server.key

MTX_METRICS=yes

MTX_PLAYBACK=yes
MTX_PLAYBACKENCRYPTION=yes
MTX_PLAYBACKSERVERCERT=/etc/mtx/server.crt
MTX_PLAYBACKSERVERKEY=/etc/mtx/server.key

MTX_WEBRTCICESERVERS2_0_URL=turn:localhost:3478
MTX_WEBRTCICESERVERS2_0_USERNAME=username
MTX_WEBRTCICESERVERS2_0_PASSWORD=password
MTX_WEBRTCENCRYPTION=yes
MTX_WEBRTCSERVERCERT=/etc/mtx/server.crt
MTX_WEBRTCSERVERKEY=/etc/mtx/server.key
MTX_WEBRTCADDITIONALHOSTS=1.1.1.1,1.0.0.1

[sizoune]

wah thank you, now the problem how can i access the API, let say using postman ? how can i put the user and pass ? in the body ?

[moenodedev]

The MediaMTX API docs are available at https://bluenviron.github.io/mediamtx/ and https://github.com/bluenviron/mediamtx/blob/main/apidocs/openapi.yaml but here are some examples to get you started.

MEDIAMTX_BASEURL='http://localhost:9997'
MEDIAMTX_CREDENTIALS='username:password'

GET the global configuration

curl --silent --show-error \
  -u "${MEDIAMTX_CREDENTIALS}" \
  "${MEDIAMTX_BASEURL}"/v3/config/global/get

LIST all paths
(WARNING: includes default settings for paths in an all_others key)

curl --silent --show-error \
  -u "${MEDIAMTX_CREDENTIALS}" \
  "${MEDIAMTX_BASEURL}"/v3/config/paths/list

CREATE path

curl --silent --show-error \
  -u "${MEDIAMTX_CREDENTIALS}" \    
  -X POST \    
  --data '{"source": "publisher"}' \    
  "${MEDIAMTX_BASEURL}"/v3/config/paths/add/skycam

GET path

curl --silent --show-error \
  -u "${MEDIAMTX_CREDENTIALS}" \    
  "${MEDIAMTX_BASEURL}"/v3/config/paths/get/skycam

UPDATE path

curl --silent --show-error \
  -u "${MEDIAMTX_CREDENTIALS}" \    
  -X PATCH \    
  --data '{"record": true, "recordFormat": "fmp4", "recordSegmentDuration": "1m"}' \        
  "${MEDIAMTX_BASEURL}"/v3/config/paths/patch/skycam

DELETE path

curl --silent --show-error \
  -u "${MEDIAMTX_CREDENTIALS}" \    
  -X DELETE \    
  "${MEDIAMTX_BASEURL}"/v3/config/paths/delete/skycam

[Arcitec]

Just be careful. While techniques such as MTX_AUTHINTERNALUSERS_0_USER technically works to modify the contents of an array, it only supports overwriting values. It does not support removing values.

What the parser does is:

• Look for all env variables with MTX_ prefix.
• Split the remainder on _: So AUTHINTERNALUSERS_0_USER = AUTHINTERNALUSERS, 0, USER.
• Search in the settings for the matching settings and write the data to the settings dictionary/arrays.

Here's the problem:

The default built-in configuration already contains settings for authenticated users:

• 0th entry: "Any user" is allowed to publish streams, watch streams, and watch recorded streams (VODs, which are off by default).
• 1st entry: Localhost IPs are allowed to access the control API, metrics and pprof endpoints.

So the default MediaMTX configuration is like a "test" configuration with wide-open permissions for unauthenticated users. It's not safe for production usage.

Now, if you want to replace that with your own user configuration, you need to do two things:

• Manually overwrite every array entry with your own values instead. But if you want to "remove" entries to give LESS rights than default, then I don't even know how to do that, because the default "any user" permission has 3 permissions. If you only want to give it "read" permission, perhaps you could do it by replacing all 3 permissions with the word "read", but either way it's super weird.
• Ensure that the MediaMTX default configuration never changes, otherwise your "patches" will become nonsense and become corrupted. But you can actually never be sure that it won't change. So you aren't safe when patching authInternalUsers via environment variables!

Instead, it's MUCH better that you do this:

• Clone the official config file to an external location.
• Edit it to set your own user authentication rules.
• Provide the external config file to the container via -v "${PWD}/mediamtx.yml:/mediamtx.yml", as described here (although their example unsafely lacks double quotes, I've submitted a PR for that at fix: improve unsafe path handling #3927, so use the quoted method I just described instead of the current readme-example): https://github.com/bluenviron/mediamtx?tab=readme-ov-file#configuration

PS: I wish that MediaMTX had a way to set the JSON value of an option via environment. If that was possible, we would be able to safely overwrite options by passing the entire MTX_AUTHINTERNALUSERS value as pure JSON to completely replace all of the default values. But that's unfortunately not possible. So if you need to overwrite internal user authentication, you should always use the external configuration file method instead! I know... the environment method seems super convenient... but it's... not... safe!