# ovenemprex

OvenMediaEngine management middleware


# Reqirements

This project tries to be pretty lean. Requirements should be roughly...

- OvenMediaEngine 0.10.30 or greater
- Python 3.8 or greater
- python-cherrypy
- python-requests


# Setup

1. Install and configure Ovenmediaengine. The following components are required:
   1. WebRTC publishing
   2. The API enabled with a user/password set
   3. Some number of applications
   4. Applications configured with a producer webhook of `http://localhost:8080`
2. Extract or clone this repository somewhere
3. Configure your HTTP daemon/proxy/etc to proxy HTTPS to `http://localhost:8080/admission`
4. Set up environment variables to your liking. The OvenMediaEngine API key and password are mandatory; see Configuration below
5. Start the management engine with either `python3 main.py` or a systemd unit as noted in `examples/`


# Usage

By default this provides a few things:

- `https://<domain>/<appname>` will provide a "Discord like" interface to every stream live in the current app
- `https://<domain>/<appname>/<streamname>` will display only that stream
- `https://<domain>/<appname>/<management>` will, if configured, display a management interface to allow basic stream management


# Configuration

All configuration is done with environment variables. If using systemd you can configure systemd unit overrides. If you're using your own management script you can set your environment variables any way you wish.

Check out the config files in the `examples/` dir to see available configuration arguments.


# Customization

There's only a couple supported methods of customization at this time:

1. `assets/webhook_avatars` can provide for a way to assign stream keys an avatar that the webhook will use when announcing that key has gone live
2. `assets/errorlogo.gif` can be replaced to replace the throbber on any interface waiting for a stream to start
3. Anything in `templates/` can be edited as desired but will likely be reverted in a future update


# Security

For the moment, security is the responsibility of the HTTP proxy. The CherryPy app does not do any kind of authentication (and you want to do authentication). You *should not* simply proxy all HTTPS traffic to the app. You should add basic authentication for your `/management*` endpoints, and also add authentication to the endpoint named after your OvenMediaEngine apps if you want to secure them.

Even still, someone who knows an exact stream key can currently get the Websocket for your WebRTC sessions and the RTMP URL to push. This is an inherited weakness from OvenMediaEngine and would be a 2.0 goal to add viewer authentication and passphrases to the Admission Webhook.

tl;dr: This is no more or less secure than an RTMP server sitting on the open internet.