[matteius]

The bundled go2rtc API was exposed independently of LightNVR's authentication, and the images ran the recorder and media subprocess as root. Bind the generated/default API listener to loopback, remove port 1984 publishing, keep browser signaling on the dashboard origin, and run both images as UID:GID 10001:10001. Update the go2rtc submodule to 41c9dfd38c513d73a8265259dcda19a1932f6174, which validates sources and redirects, uses FFmpeg argument vectors, and requires administrative API authentication.

Depends on opensensor/go2rtc#2. Merge that PR first while retaining the pinned commit in the repository history, or update this pin to the resulting merge commit before merging LightNVR.

Deployment changes:

• MSE/WebRTC require authenticated same-origin reverse-proxy routes for exactly /go2rtc/api/ws and /go2rtc/api/webrtc; HLS and snapshots retain LightNVR's authenticated proxy. The proxy must share the recorder's network namespace to reach loopback. Documentation replaces wildcard nginx, Caddy, and Traefik routes and explains that gateway credentials do not enforce per-camera permissions.
• Compose uses named config/database/model volumes and a recordings-only bind mount. Existing deployments must preserve or migrate their data and prepare volume ownership for UID:GID 10001:10001. The entrypoint no longer recursively changes mounted-file ownership or permissions.
• The container PID path moves to /var/run/lightnvr/lightnvr.pid. Existing configuration files need that path updated. Review persisted go2rtc overrides for explicit public listeners.
• go2rtc rejects unsafe command sources and unsupported raw FFmpeg/local-device inputs. Administrative config/restart/exit endpoints are disabled without credentials and require authentication even on loopback when configured.

Validation:

• LightNVR builds locally; all 6 generated-config tests and 6 frontend routing tests pass.
• Shell syntax, Compose configuration, and diff whitespace checks pass.
• Focused go2rtc security/race tests and rebuilt-binary HTTP/transcoding smoke checks pass. Broader FFmpeg test failures reproduce unchanged on the pinned baseline.
• A runtime test using an existing Debian image plus the rebuilt binaries and new runtime-user setup starts LightNVR and managed go2rtc as UID 10001 with all capabilities dropped. It verifies loopback-only API access, administrative request rejection, protected application assets, and H.264 snapshots using the generated codec templates.
• The documented nginx configuration passes nginx -t; live checks reject anonymous media/admin requests and allow authenticated WebSocket upgrades.

Full multi-architecture image builds and end-user camera/browser revalidation remain release checks.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!