Settings for the database of operational data, e.g. processes, metadata, persisted session summaries, and so on.

Configuration

{
   "db": {
      "dir": "./config"
   },
}

CORE_DB_DIR="./config"

dir (string)

Directory for holding the operational data. The path is relative to where the binary is executed and the directory must exist.

The default value is ./config

Docker way

Systemd way

Settings for the host datarhei Core is running on.

Configuration

{
   "host": {
        "name": ["domain.com"],
        "auto": true
   }
}

CORE_HOST_NAME=domain.com
CORE_HOST_AUTO=true

name (array)

A list of public host/domain names or IPs this host is reacheable under. For the ENV use a comma separated list of public host/domain names or IPs.

The default is an empty list.

auto (bool)

Enable detection of public IP addresses in case the list of names is empty.

By default this is set to true.

The API allows you to manipulate the contents of the available filesystems.

Logging settings for the datarhei Core.

Configuration

level (string)

The verbosity of the logging. The datarhei Core is writing the logs to stderr. Possible values are:

• silent No logging at all.

• error Only errors will be logged.

• warn Warnings and errors will be logged.

• info General information, warnings, and errors will be logged.

• debug Debug messages and every thing else will be logged. This is very chatty.

The default logging level is info.

topics (array)

Logging topics allow you to restrict what type of messages will be logged. This is practical if you enable debug logging and want to see only the logs you're interested in. An empty list of topics means that all topics will be logged.

An non-exhaustive list of logging topics:

• cleanup

• config

• core

• diskfs

• http

• httpcache

• https

• let's encrypt

• memfs

• process

• processstore

• rtmp

• rtmp/s

• rtmps

• update

• service

• session

• sessionstore

• srt

By default all topics are logged.

max_lines (integer)

The log is also kept in memory for retrieval via the API. This value defines how many lines shoul dbe kept in memory.

The default is 1000 lines.

Restreamer-UI

The Restreamer-UI is an easy interface to manage multiple live and restreams on different platforms like the website, YouTube, Facebook and more.

Quick start

1. Start the Core

2. Start the Interface

3. Open the Interface and connect it to the running Core

The datarhei Core includes a simple RTMP server for publishing and playing streams. It is not enabled by default. You have to enable it in the config in the or via the corresponding environemnt variables.

Example:

In the above example /live is the RTMP app and 12345.stream is the name of the resource.

Token

In order to protect access to the RTMP server you should define a token in the configuration. Only with a valid token it is possible to publish or play resources. The token has to be appended to the RTMP URL as a query string, e.g. rtmp://127.0.0.1:1935/live/12345.stream?token=abc.

As of version 16.12.0 you can write the token as last part of the path in URL instead of as a query string. The above example will looke like rtmp://127.0.0.1:1935/live/12345.stream/abc. This allows you to enter the token into the "stream key" field in some clients.

API

Via the in the API you can gather a list of the currently publishing RTMP resources.

The profiling endpoint allows you to fetch profiling information from a running datarhei Core instance. It has to be enabled with debug.profiling in the config.

Navigate you browser to /profiling where you can access different diagnostic solutions as described in https://go.dev/doc/diagnostics.

The datarhei Core is a process management solution for FFmpeg that offers a range of interfaces for media content, including HTTP, RTMP, SRT, and storage options. It is optimized for use in virtual environments such as Docker. It has been implemented in various contexts, from small-scale applications like Restreamer to large-scale, multi-instance frameworks spanning multiple locations, such as dedicated servers, cloud instances, and single-board computers. The datarhei Core stands out from traditional media servers by emphasizing FFmpeg and its capabilities rather than focusing on media conversion.

__

Objectives of development

The objectives of development are:

• Unhindered use of FFmpeg processes

• Portability of FFmpeg, including management across development and production environments

• Scalability of FFmpeg-based applications through the ability to offload processes to additional instances

• Streamlining of media product development by focusing on features and design.

What issues have been resolved thus far?

Process management

• Run multiple processes via API

• Unrestricted FFmpeg commands in process configuration.

• Error detection and recovery (e.g., FFmpeg stalls, dumps)

• Referencing for process chaining (pipelines)

• Placeholders for storage, RTMP, and SRT usage (automatic credentials management and URL resolution)

• Logs (access to current stdout/stderr)

• Log history (configurable log history, e.g., for error analysis)

• Resource limitation (max. CPU and MEMORY usage per process)

• Statistics (like FFmpeg progress per input and output, CPU and MEMORY, state, uptime)

• Input verification (like FFprobe)

• Metadata (option to store additional information like a title)

Media delivery

• Configurable file systems (in-memory, disk-mount, S3)

• HTTP/S, RTMP/S, and SRT services, including Let's Encrypt

• Bandwidth and session limiting for HLS/MPEG DASH sessions (protects restreams from congestion)

• Viewer session API and logging

Misc

• HTTP REST and GraphQL API

• Swagger documentation

• Metrics incl. Prometheus support (also detects POSIX and cgroups resources)

• Docker images for fast setup of development environments up to the integration of cloud resources

Quick start

Changelog

Releases

The documentation of the API is available on /api/swagger/index.html

Example:

docker run -d --name core -p 8080:8080 datarhei/core:latest

make init swagger
make run

Public demo:

The /ping endpoint returns a plain text pong response. This can be used for liveliness and/or latency checks.

curl http://127.0.0.1:8080/ping

Quick start

1. Install Docker if not present

2. Continue with the Beginner's Guide

Docker images

Select the CPU architecture and, if desired, the GPU support:

Docker run {...params}

All default values can be changed and are described on the page.

Complete example:

Directory exports

$HOST_DIR can be adjusted without reconfiguring the app. For the $CORE_DIR, check the configuration instructions.

Configuration directory

Directory for holding the config and operational data.

Data directory

Directory on disk, exposed on HTTP path “/“.

Port

Environment variables

More in the instructions.

Device access

Allow FFmpeg to access GPU's, USB and other devices available in the container.

Network issues (seccomp)

If seccomp is active and no internal-to-external communication is possible:

Docker commands

Start in background

Stop

Kill and remove the instance

Update the local image and restart the Core

Top

Logging

Systemd

To manage the Core container via systemd (systemd is a Linux process daemon.)

Service file

Commands

Install

Uninstall

Start

Stop

Update image

Status

Logging

Settings for accessing the available storage types. The storages are accessible via HTTP, mounted to different paths.

Configuration

mimetypes_file (string)

Path to a file with the mime-type definitions. This is a file with the MIME types has one MIME type per line followed by a list of file extensions (including the "."). Files served from the storages will have the matching mime-type associated to it.

Example:

Default: ./mime.types

cors.origins (array)

Define a list of allowed CORS origin for accessing the storages.

By default it contains the only element *, allowing access from anywhere.

Disk

The disk storage is mounted at / via the HTTP server.

In-memory

The memory storage is mounted at /memfs via the HTTP server.

S3

The S3 storage is mounted at the configured path via the HTTP server.

The settings for the in-memory filesystem. This filesystem is accessible on /memfs via HTTP. This filesystem can only be accessed via HTTP. Writing to and deleting from the filesystem can be restricted by HTTP basic auth.

Configuration

auth.enable (bool)

Set this value to true in order to enable basic auth for PUT, POST, and DELETE operations on /memfs. Read access (GET, HEAD) is not restricted. If enabled, you have to define a username and a password.

By default this value is set to false.

auth.username (string)

Username for Basic-Auth of /memfs. This has to be set if basic auth is enabled.

By default this value is not set, i.e. an empty string.

auth.password (string)

Password for Basic-Auth of /memfs. This has to be set if basic auth is enabled.

By default this value is not set, i.e. an empty string.

max_size_mbytes (unsigned integer)

The maximum amount of data that is allowed to be stored in this filesystem. The value is interpreted as megabytes. A 507 Insufficient Storage will be returned if you hit the limit. Use a value equal to or smaller than 0 to not set any limits. The limit will be the available memory.

By default no limit is set, i.e. a value of 0.

purge (bool)

Whether to automatically remove the oldest files if the filesystem is full.

By default this value is set to false.

The settings for the built-in SRT server. Check out our for more information.

Configuration

enable (bool)

Set this value to true in order to enable the built-in RTMP server.

By default the RTMP server is disabled.

enable_tls (bool)

Set this value to true to enable the RTMPS server that will run in parallel with the RTMP server on a different port. You have to have set to true in order for enabling the RTMPS server because it will use the same certificate as for the HTTPS server.

By default TLS is disabled.

address (string)

If the RTMP server is enabled, it will listen on this address. The default address is :1935.

address_tls (string)

If the RTMPS server is enabled, it will listen on this address. The default address is :1936.

app (string)

Define the app a stream can be published on, e.g. /live to require the path in an RTMP URLs to start with /live.

The default app is /.

token (string)

To prevent anybody from publish or playing streams, define token to be a secret only known to the publishers and subscribers. The token has to be put in the query of the stream URL, e.g. /live/stream?token=abc123.

As of version 16.12.0 the token can be appended to the path instead of a query parameter, e.g. /live/stream/abc123. With this the token corresponds to a stream key.

By default the token is not set (i.e. an empty string).

The settings for the built-in SRT server. Check out our for more information.

Configuration

enable (bool)

Set this value to true in order to enable the built-in SRT server.

By default the SRT server is disabled.

address (string)

If the SRT server is enabled, it will listen on this address. The default address is :6000.

passphrase (string)

Define a passphrase in order to enable SRT encryption. If the passphrase is set it is required and applies to all connections.

By default the passphrase is not set (i.e. an empty string).

token (string)

The token is an arbitrary string that needs to be comunicated in the streamid. Only with a valid token it is possible to publish or request streams. If the token is not set, anybody could publish and request streams.

By default the token is not set (i.e. an empty string).

log.enable (bool)

Set this value to true in order to enable logging for the SRT server. This will log events on the SRT protocol level. You have to provide the topics you are interested in, otherwise nothing will be logged.

By default the logging is disabled.

log.topic (array)

Logging topics allow you to define what type of messages will be logged. This is practical if you want to debug a SRT connection. An empty list of topics means that no topics will be logged.

Find a list of known logging topics on the .

By default no topics are logged (i.e. an empty array).

Settings for session capturing. Sessions for HLS, RTMP, SRT, HTTP, and FFmpeg are captured.

Configurations

enable (bool)

Set this value to true in order to enable session capturing.

By default this value is set to true.

ip_ignorelist (array)

List of IP ranges in CIDR notation to ignore for session capturing. If either end of a connection falls into this list of IPs, the session will not be captured. For the environment variable provide a comma-separated list of IP ranges in CIDR notation.

By default this value is set to ["127.0.0.1/32","::1/128"].

session_timeout_sec (integer)

The timeout in seconds for an idle session. After this timeout the session is considered as closed. Applies only to HTTP and HLS sessions.

By default this value is set to 30 seconds.

persist (bool)

Whether to persist the session history. The session history is stored as sessions.json in . If the session history is not persisted it will be kept only in memory.

By default the session history is not persisted, i.e. this value is set to false.

persist_interval_sec (integer)

Interval in seconds in which to persist the current session history. This setting has only effect if persisting the session history is enabled.

By default this value is set to 300 seconds.

max_bitrate_mbit (unsigned integer)

The maximum allowed outgoing bitrate in mbit/s. If the limit is reached, any new HLS sessions will be rejected. A value of 0 means no limitation of the outgoing bitrate.

By default this is value is set to 0, i.e. unlimited.

max_sessions (unsigned integer)

The maximum allowed number of simultaneous sessions. If the limit is reached, any new HLS sessions will be rejected. A value of 0 means no limitation of the number of sessions.

By default this value is set to 0, i.e. unlimited.

Settings for collecting metrics of the core and FFmpeg processes.

Configuration

enable (bool)

Enable collecting metrics data of the datarhei Core itself and the FFmpeg processes. The metrics can be queried via the .

By default collecting the metrics is disabled.

enable_prometheus (bool)

Enable prometheus endpoint at /metrics. This requires that collecting metrics is enabled.

By default this is disabled.

range_sec (integer)

Define for how many seconds historic metrics data should be kept.

By default this value is set to 300.

interval_sec (integer)

Define in which interval (in seconds) the metrics should be collected.

By default this value is set to 2.

Settings for static HTTP routes.

Configuration

blocked_prefixes (array)

List of path prefixes that are not allowed to be overwritten by a static route. If a static route would overwrite one of the blocked prefixes, an error will be thrown at startup. For the environment variable, provide a comma-separated list of prefixes, e.g. /prefix1,/prefix2.

By default this value is set to ["/api"].

routes (map)

A list of static routes. This maps a path to a different path and results in a HTTP redirect, e.g. {"/foo.txt": "/bar.txt"} will redirect requests from /foo.txt to /bar.txt. Path have to start with a / and they are based on on the filesystem.

The special suffix /* of a route allows you to serve whole directories from another root than storage.disk.dir, e.g. {"/ui/*", "/path/to/ui"}. If you use a relative path as target, then it will be added to the current working directory.

By default no routes are defined.

ui_path (string)

A path to a directory holding UI files. This will be mounted as /ui.

By default this value is not set, i.e. an empty string.

The debugging settings can help to find and solve issues with the datarhei Core.

Configuration

profiling (bool)

By setting this to true, the endpoint /profiling will be established where you can access different diagnostic solutions as described in .

By default this setting is set to false.

force_gc (integer)

Golang is usually quite greedy when it comes to claim memory to itself. This settings lets you define the number of seconds between forcing the garbage collector to run in order return memory to the OS. If this is not set, the runtime will decide on its own when to run the garbage collector.

Alternatively, you can set the environment variable GOMEMLIMIT to a value in bytes in order to set a soft memory limit. This will influence the garbage colltector when the consumed memory comes close to this limit. If you use the GOMEMLIMIT environment variable you are advised to leave the force_gc option disabled.

The default for this setting is 0 (i.e. disabled).

memory_limit_mbytes (integer)

As of version 16.12.0 use this valuess to impose a soft limit to the memory consumption of the Core application itselft (i.e. with out the memory consumption of the ffmpeg processes). This has the same effect as setting the GOMEMLIMIT environment variable.

The provided value is the number of megabytes the Core application is allowed to consumed.

The default for this setting is 0 (i.e. no limit).

Golang

Example

Repository

Python3

Install

Example

Repository

The datarhei Core provides two filesystem abstractions that you can use in your FFmpeg process configurations.

Disk

The disk filesystem is the directory you defined in the configuration at . Any FFmpeg command will be restricted to this directory (or its subdirectories) for file access (read or write). One exception is /dev in order to access, e.g. USB cameras.

In a process configuration you can use the , such that you don't need to remember and write the configured path.

The contents of the disk filesystem are accessible read-only via the / path of the datarhei core HTTP server.

In order to access and modify the contents of the filesystem programmatically, you can use the corresponding .

Memory

The datarhei Core has built-in memory filesystem. It is enabled by default and it is only accessible via HTTP. Its contents can be accessed via the /memfs path of the datarhei Core HTTP server.

In the configuration in the section you can define different aspects of the memory file system, such as the maximum size of the filesystem, the maximum file size, password protection, and so on.

In a process configuration you can use the , such that you don't need to remember and write the whole base URL.

The /memfs path is not read-only. Write access is protected via HTTP BasicAuth.

In order to access and modify the contents of the filesystem programmatically, you can use the corresponding .

S3

The datarhei Core allows you to mount a S3 compatible filesystem. It is only accessible via HTTP. Its contents can be accessed via the configured path of the datarhei Core HTTP server.

In the configuration in the section you can define different aspects of the S3 filesystem, such as the login credentials, bucket name, and so on.

In a process configuration you can use the , such that you don't need to remember and write the whole base URL, where [name] is the configured name of the S3 filesystem, e.g. {fs:aws}.

The S3 filesystem HTTP mountpoint is not read-only. Write access is protected via HTTP BasicAuth.

In order to access and modify the contents of the filesystem programmatically, you can use the corresponding .

The datarhei Core includes a simple SRT server for publishing and playing streams. It is not enabled by default. You have to enable it in the config in the or via the corresponding environment variables.

SRT is a modern live streaming protocol with a low latency and network failure tolerance. .

The SRT server supports publishing and requesting streams, similar to an RTMP server. With your SRT client you have to connect to the SRT server always in caller mode and live transmission mode.

Example:

Passphrase

If a passphrase is set in the config (or via environment variable), you have to provide the passphrase in the SRT URL. Example SRT URL with the passphrase foobarfoobar:

StreamID

In order to define whether you want to publish or request a resource, you have to provide your intent in the streamid.

The streamid is formatted as follows:

The resource is the name of the stream. This can be anything. You can publish only one stream with that same name.

The mode is either request or publish. If you don't provide a mode, request will be assumed. You can only request resources that are currently publishing. You can only publish resources that are not already publishing.

The token is the one defined in the config (see ). If no token is configured, you can omit the token in the streamid.

Examples

Publishing the resource 12345 with the token foobar:

Publishing the resource 12345 with no token defined in the configuration:

Requesting the resource 12345 with no token defined in the configuration:

Requesting the resource 12345 with the token foobar:

The whole SRT URL might look like this for the last example:

API

Via the in the API you can gather statistics about the currently connected SRT clients.

The last log events are kept in memory and are accessible via the /api/v3/log endpoint. You can either retrieve the log lines in the format the Core is writing them to the console (?format=console) or in raw format (?format=raw). By default they are returned in "console" format.

You can define the number of last log lines kept in memory by either setting an appropriate value in the config (log.max_lines) or via an enviroment variable (CORE_LOG_MAX_LINES).

Read

Example:

Description:

The datarhei Core includes a simple RTMP server for publishing and playing streams. Check out the and the . This API endpoint will list the names of all currently publishing streams.

A/V Processing

1. Core launches and monitors FFmpeg processes

2. FFmpeg can use HTTP, RTMP, and SRT services as streaming backends for processing incoming and outgoing A/V content.

3. Several storage locations are available for the HTTP service: In-memory file system, aka MemFS (very fast without disk I/O.) Disk file system, aka DiskFS, for storage on the HDD/SSD of the host system.

4. Optionally, FFmpeg can access host system devices such as GPU and USB interfaces (requires FFmpeg built-in support).

These are the settings for securing the API from unwanted access.

Configuration

{
   "api": {
      "read_only": false,
      "access": {
         "http": {
            "allow": [],
            "block": []
         },
         "https": {
            "allow": [],
            "block": []
         }
      },
      "auth": {
         "enable": fals,
         "disable_localhost": false,
         "username": "",
         "password": "",
         "jwt": {
            "secret": ""
         },
         "auth0": {
            "enable": false,
            "tenants": []
         }
      }
   }
}

CORE_API_READ_ONLY=false
CORE_API_ACCESS_HTTP_ALLOW="127.0.0.1/32,::1/128"
CORE_API_ACCESS_HTTP_BLOCK="127.0.0.1/32,::1/128"
CORE_API_ACCESS_HTTPS_ALLOW="127.0.0.1/32,::1/128"
CORE_API_ACCESS_HTTPS_DENY="127.0.0.1/32,::1/128"
CORE_API_AUTH_ENABLE=true
CORE_API_AUTH_DISABLE_LOCALHOST=true
CORE_API_AUTH_USERNAME=
CORE_API_AUTH_PASSWORD=
CORE_API_AUTH_JWT_SECRET=mySecret
CORE_API_AUTH_AUTH0_ENABLE=false
CORE_API_AUTH_AUTH0_TENANTS=

read_only (bool)

Set this value to true in order to allow only ready access to the API. All API endpoints for writing will not be mounted.

By default this value is set to false.

access.http.allow (array)

A list of IPs that are allowed to access the API via HTTP. Each entry has to be an IP range in CIDR notation, e.g. ["127.0.0.1/32","::1/128"]. Provide the list as comma-separated values for the environment variable, e.g. 127.0.0.1/32,::1/128. If the list is empty, then all IPs are allowed. If the list contains any invalid IP range, the server will refuse to start.

By default the list is empty.

access.http.block (array)

A list of IPs that are not allowed to access the API via HTTP. Each entry has to be an IP range in CIDR notation. Provide the list as comma-separated values for the environment variable. If the list is empty, then no IPs will be blocked. If the list contains any invalid IP range, the server will refuse to start.

By default the list is empty.

access.https.allow (array)

A list of IPs that are allowed to access the API via HTTPS. Each entry has to be an IP range in CIDR notation. Provide the list as comma-separated values for the environment variable. If the list is empty, then all IPs are allowed. If the list contains any invalid IP range, the server will refuse to start.

By default the list is empty.

access.https.block (array)

A list of IPs that are not allowed to access the API via HTTPS. Each entry has to be an IP range in CIDR notation. Provide the list as comma-separated values for the environment variable. If the list is empty, then no IPs will be blocked. If the list contains any invalid IP range, the server will refuse to start.

By default the list is empty.

auth.enable (bool)

Set this value to true to enable JWT authentication for the API. If it is enabled, you have to provide a username and password. The username and password will be sent to the /api/login endpoint in order to obtain an access and refresh JWT.

By default this value is set to false.

auth.disable_localhost (bool)

Set this value to true in order to allow unprotected access from localhost.

Be default this value is set to false.

auth.username (string)

The username for JWT authentication. If JWT authentication is enabled, a username must be defined.

By default this value is empty, i.e. no username defined.

auth.password (string)

The password for JWT authentication. If JWT authentication is enabled, a password must be defined.

By default this value is empty, i.e. no password defined.

auth.jwt.secret (string)

A secret for signing the JWT. If you leave this value empty, a random secret will be generated for you.

By default this value is empty.

auth.auth0.enable (bool)

Set this value to true in order to enable API auth0 protection. With this a valid Auth0 access JWT can be used instead of a username/password in order to obtain the access and refresh JWT. Additionally you have to provide a list of tenants and their users to validate the Auth0 access JWT against.

By default this value is set to false.

auth.auth0.tenants (array)

A list of allowed tenants and their users. A tenant is a JSON object:

{
    "domain": "",
    "audience": "",
    "clientid": "",
    "users": [],
}

You can obtain the domain, audience, and clientid from your Auth0 account. You also have to provide a list of allowed users that are member of that tenant.

For providing the list of tenants and their users as an environement variable you have to provide a comma-separated list of base64 encoded tenant JSON objects.

As of version 16.12.0 there's a different syntax available for providing the tenants as environment variable. A list of comma separated URLs of this form:

auth0://[clientid]@[domain]?aud=[audience]&user=...&user=...

By default this list is empty.

There are basically two commands you can give to a process: start or stop. This is the order for the process.

Additionally to these two commands are the commands restart which is sending a stop followed by a start command packed in one command, and reload which is the same as if you would update the process config with itself, e.g. in order to update references to another process.

• start the process. If the process is already started, this won't have any effect.

• stop the process. If the process is already stopped, this won't have any effect.

• restart the process. If the process is not running, this won't have any effect.

• reload the process. If the process was running, the reloaded process will start automatically.

Example:

Description:

Raspberry Pi 4

Date: 12.02.2021 Version: 2.1.0 (non-public release)

Goal: Bandwidth Limitation Test (HLS Sessions)

Settings

CORE_SESSION_BANDWIDTH_LIMIT=800

sysctl -w net.core.netdev_budget_usecs=60000
sysctl -w net.core.netdev_budget=900
sysctl -w net.core.rmem_max=26214400
sysctl -w net.core.wmem_max=2621440

echo "6" > /proc/irq/33/smp_affinity
echo "1-2" > /proc/irq/33/smp_affinity_list
echo c > /sys/class/net/eth0/queues/rx-0/rps_cpus
echo c > /sys/class/net/eth1/queues/rx-0/rps_cpus
echo c > /sys/class/net/eth0/queues/tx-0/xps_cpus
echo c > /sys/class/net/eth0/queues/tx-1/xps_cpus
echo c > /sys/class/net/eth0/queues/tx-2/xps_cpus
echo c > /sys/class/net/eth0/queues/tx-3/xps_cpus
echo c > /sys/class/net/eth0/queues/tx-4/xps_cpus
/sbin/ethtool -K eth0 rx-checksum on
/sbin/ethtool -K eth1 rx-checksum on

Results

The settings for the disk filesystem. This filesystem is accessible on / via HTTP. This filesystem can only be accessed for reading via HTTP. Writing to and deleting from the filesystem is possible .

Configuration

dir (string)

Path to a directory on disk. It will be exposed on / for reading.

By default it is set to ./data.

max_size_mbytes (unsigned integer)

The maximum amount of data that is allowed to be stored in this filesystem. The value is interpreted as megabytes. A 507 Insufficient Storage will be returned if you hit the limit. Use a value equal to or smaller than 0 to not impose any limits. Then all the available space on the disk is the limit.

By default no limit is set, i.e. a value of 0.

cache.enable (bool)

Set this value to true in order to enable the cache for the disk. The cache is an LRU cache, i.e. the least recently accessed files in the cache will be removed in case the cache is full and a new file wants to be added.

By default the value is set to true.

cache.max_size_mbytes (unsigned integer)

Limit for the size of the cache in megabytes. A value of 0 doesn't impose any limit. The limit will be the available memory.

By default no limit is set, i.e. a value of 0.

cache.ttl_seconds (integer)

Number of seconds to keep a file in the cache.

By default this value is set to 300 seconds.

cache.max_file_size_mbytes (unsigned integer)

Limit for the size of a file to be allowed to be put in the cache in megabytes.

By default this value is set to 1 megabyte.

cache.types.allow (array)

A list of file extensions to cache, e.g. [".ts", ".mp4"]. Leave the list empty in order to cache all files. Use a space-separated list of extensions for the environment variable, e.g. .ts .mp4.

By default the list is empty.

cache.types.block (array)

A list of file extensions not to cache, e.g. [".m3u8", ".mpd"]. Leave the list empty in order to block no extension. Use a space-separated list of extensions for the environment variable, e.g. .m3u8 .mpd.

By default the manifest files for HLS and DASH are blocked from caching, i.e. [".m3u8", ".mpd"].

Sessions are tracking user actions regarding pushing and pulling video data to and from the core. There are different kind of sessions that are captured:

• HLS Sessions (hls collector) How many users are watching an HLS stream

• HLS Ingress Sessions (hlsingress collector) How many users are publishing a stream via the in-memory filesystem

• HTTP Sessions (http collector) How many users are reading or writing http data via the build-in HTTP server

• RTMP Sessions (rtmp collector) How many users are publishing or watching a stream via the built-in RTMP server

• SRT Sessions (srt collector) How many users are publishing or watching a stream via the built-in SRT server

• FFmpeg Sessions (ffmpeg collector) How many streams is FFmpeg using as an input or as an output

The data for each session include the current ingress and egress bandwidth, the total amount of data, an identifier for the session itself, the local end of the stream and the remote end of the stream.

The following API endpoints allow to extract information about the currently active sessions or additionally a summary of the already finished sessions. Each endpoint requires a comma-separated list of collectors as query parameter collectors.

Active sessions with summary

Example:

Description:

Active sessions

Example:

Description:

The settings for the S3 filesystem. This filesystem is accessible on the configured path via HTTP. This filesystem can only be accessed via HTTP. Writing to and deleting from the filesystem can be restricted by HTTP basic auth.

Any S3 compatible service can be used, e.g. Amazon, Minio, Backblaze, ...

Configuration

{
    "storage": {
        "s3": [
            {
                "name": "aws",
                "mountpoint": "/aws",
                "auth": {
                    "enable": true,
                    "username": "foo",
                    "password": "bar"
                },
                "endpoint": "...",
                "access_key_id": "...,
                "secret_access_key": "...",
                "bucket": "...",
                "region": "...",
                "use_ssl": true,
            },
            ...
        ]
    }
}

CORE_STORAGE_S3=https://access_key_id:[email protected]/bucket?name=aaa&mount=/abc&username=xxx&password=yyy

name (string)

The name for this storage. The name will be used in placeholders, e.g. {fs:aws}, and for accessing the filesystem via the api, e.g. /api/v3/fs/aws. The name memfs is reserved for the in-memory filesystem.

By default this value is not set, but is required.

mountpoint (string)

The path where the filesystem will be mounted in the HTTP server. It needs to be an absolute path. A mountpoint is required.

By default this value is not set, but is required.

auth.enable (bool)

Set this value to true in order to enable basic auth for PUT, POST, and DELETE operations on the configured mountpoint. Read access (GET, HEAD) is not restricted. If enabled, you have to define a username and a password.

By default this value is set to false.

auth.username (string)

Username for Basic-Auth of the configured mountpoint. This has to be set if basic auth is enabled.

By default this value is not set, i.e. an empty string.

auth.password (string)

Password for Basic-Auth of the configured mountpoint. This has to be set if basic auth is enabled.

By default this value is not set, i.e. an empty string.

endpoint (string)

The endpoint for the S3 storage. For Amazon AWS S3 it would be e.g. s3.amazonaws.com. Ask your S3 storage provider to the necessary credentials.

By default this value is not set, i.e. an empty string.

access_key_id (string)

Your access key ID for the S3 storage. Ask your S3 storage provider to the necessary credentials.

By default this value is not set, i.e. an empty string.

secret_access_key (string)

Your secret access key for the S3 storage. Ask your S3 storage provider to the necessary credentials.

By default this value is not set, i.e. an empty string.

bucket (string)

The name of the bucket you want to use. If the bucket does not exist already it will be created.

By default this value is not set, i.e. an empty string.

region (string)

Identifier for the region the storage is located, e.g. eu, us-west1, ... . If your S3 storage provider doesn't support regions, leave this field empty.

By default this value is not set, i.e. an empty string.

use_ssl (bool)

Whether to use HTTPS or HTTP. It is strongly recommended to enable this setting.

By default this is set to false.

Location

You have to provide the location of the config file by setting the environment variable CORE_CONFIGFILE to path to the config file. Example:

export CORE_CONFIGFILE=./config/config.json

The config file is written in JSON format.

A minimal valid config file must contain at least the config version:

{
    "version": 3
}

Configuration

Configuration values can be changed by either editing the config file directly, or via the JSON API (API for short) or via environment variables (ENV for short). All environment variables have the prefix CORE_ followed by the JSON names in uppercase. Example:

{
   "version": 3,
   "id": "1",
   "name": "super-core-1337",
   "address": ":8080",
   "log": {
      "level": "warn"
   }
}

CORE_ID=1
CORE_NAME=super-core-1337
CORE_ADDRESS=:8080
CORE_LOG_LEVEL=warn

Following, every field of the configuration file will be described in detail:

id (string)

ID of the Core. If not set, a UUIDv4 will be generated. Default: unset

name (string)

Human-readable name of the Core. If not set a custom name will be generated. Default: unset

address (string)

HTTP listening address. Default: :8080

log

Log settings.

db

Database (processes, metadata, ...) endpoint.

host

Configuration to detect or set the host-/domainname.

api

API Security options.

tls

TLS/HTTPS settings (also required for RTMPS).

storage

General configuration, DiskFS, MemFS, and S3.

rtmp

RTMP server for publishing and playing streams.

srt

SRT server for publishing and playing streams.

ffmpeg

General FFmpeg settings.

session

HLS-/MPEG-DASH session management and bandwidth limitations.

metrics

General metrics settings.

route

HTTP/S route configuration (e.g., to inject UI's).

debug

Core / Golang debugging options.

update_check (bool)

All about datarhei Update-Checks and data tracking.

{
   "update_check": true,
   "service": {
      "url": "https://service.datarhei.com"
   }
}

Check for updates and send anonymized data (default: false). Requires service.url.

service.url (string)

URL for the update_check Service API. Default: https://service.datarhei.com

About anonymizied data:

We receive: id, os architecture, uptime, process stats (total: running, failed, killed), viewer count

The data is used exclusively for the further development of the products and error detection. Domains/IP addresses, companies, and persons remain anonymous.

The metadata for a process allows you to store arbitrary JSON data with that process, e.g. if you have an app that uses the datarhei Core API you can store app-specific information in the metadata.

In order not to conflict with other apps that might write to the metadata as well, you have to provide a key under which your metadata is stored. Think of a namespace or similar.

Create, Update

Add or update the metadata for a process and key.

Example: Write a metadata object into the metadata for the process test and key desc.

curl http://127.0.0.1:8080/api/v3/process/test/metadata/desc \
   -H 'accept: application/json' \
   -H 'Content-Type: application/json' \
   -X POST \
   -d '{
         "title": "My title",
         "description": "My description."
      }'

from core_client import Client

client = Client(
    base_url="http://127.0.0.1:8080"
)
client.login()

client.v3_process_put_metadata(
    id="test",
    key="desc",
    data={
        "title": "My title",
        "description": "My description."
    }
)

import (
    "github.com/datarhei/core-client-go/v16"
)

client, _ := coreclient.New(coreclient.Config{
    Address: "https://127.0.0.1:8080",
})

data := map[string]string{
    "title": "My title",
    "description": "My description.",
}

err := client.ProcessMetadataSet("test", "desc", data)
if err != nil {
    ...
}

Description:

Read

Read out the stored metadata. The key is optional. If the key is not provided, all stored metadata for that process will be in the result.

Example: read the metadata object for process test that is stored under the key desc.

curl http://127.0.0.1:8080/api/v3/process/test/metadata/desc \
   -H 'accept: application/json' \
   -X GET

from core_client import Client

client = Client(
    base_url="http://127.0.0.1:8080"
)
client.login()

client.v3_process_get_metadata(
    id="test",
    key="desc"
)

import (
    "fmt"
    "github.com/datarhei/core-client-go/v16"
)

client, _ := coreclient.New(coreclient.Config{
    Address: "https://127.0.0.1:8080",
})

metadata, err := client.ProcessMetadata("test", "desc")
if err != nil {
    ...
}

fmt.Printf("%+v\n", metadata)

Description:

These settings are for configuring the TLS / HTTPS support for datarhei Core.

Configuration

address (string)

If TLS is enabled, the HTTPS server will listen on this address. The default address is :8181.

enable (bool)

Set this value to true in order to enable TLS / HTTPS support. If enabled you have to either provide your own certificate (see and ) or enable automatic certificate from Let's Encrypt (see ).

If TLS is enabled, a HTTP server listening on will be additionally started. This server provides access to everything as the HTTPS server, additionally it will allow ACME http-1 challenges in case Let's Encrypt (auto) certificates are enabled.

By default this is set to false.

auto (bool)

Enable automatic certificate generation from Let's Encrypt. This only works if enable is set to true and at least one public hostname is defined in . All listed hostnames will be included in the certificate. All listed public hostnames is required to point to the host where datarhei Core is running on.

The obtained certificates will be stored in the /cert subdirectory of to be available after a restart.

Any provided paths in cert_file and key_file will be ignored.

By default this is set to false.

mail (string)

An email address that is required for Let's Encrypt in order to receive a certificate.

By default the email address [email protected] is used.

cert_file (string)

If you bring your own certificate, provide the path to the certificate file in PEM format.

By default this is not set.

key_file (string)

If you bring your own certificate, provide the path to the key file in PEM format

By default this is not set.

Examples

Let's Encrypt

If you want to use automatic certificates from Let's Encrypt, set and to true. and has to be set to the domain name this host will be reachable. Otherwise the ACME http-1 challenge will not work.

Self-Signed certificates

To create a self-signed certificate and key file pair, run this command and provide a reasonable value for the Common Name (CN). The CN is the fully qualified name of the host the instance is running on (e.g., localhost). You can also use an IP address or a wildcard name, e.g., *.example.com.

RSA SSL certificate

ECDSA SSL certificate

Call openssl ecparam -list_curves to see all available supported curves listed.

Skills denote the capabilities of the used FFmpeg binary. It includes version information, supported input and output protocols, available hardware accelerators, supported formats for muxing and demuxing, filters, and available input and output devices.

Read

Example:

Description:

Reload

Reloading the skills might be necessary if you plug e.g. an USB device. It will only show up in the list of available devices if they are probed again.

Example:

The Core-FFmpeg bundle uses Docker's multi-stage process so that FFmpeg and the Core can be updated and maintained independently.

When building the Core-FFmpeg bundle, an FFmpeg image is used. The previously created Golang libraries and folder structures are copied into this image.

This process speeds up the creation of the final Core-FFmpeg bundle, as existing or previously created images can be used, and compiling all the code is no longer required.

The following base images are available:

• docker.io/datarhei/base:alpine-ffmpeg-latest

• docker.io/datarhei/base:alpine-ffmpeg-rpi-latest

• docker.io/datarhei/base:ubuntu-ffmpeg-cuda-latest

• docker.io/datarhei/base:ubuntu-ffmpeg-vaapi-latest

• docker.io/datarhei/base:alpine-core-latest

• docker.io/datarhei/base:ubuntu-core-latest

Specific versions are available on the Docker website:

1. Create a custom FFmpeg image

1.1 Clone the FFmpeg build files

Repository

1.2 Switch to the cloned folder

1.2 Change a Dockerfile

1.3 Build a custom image

Arguments:

• default Dockerfile: Dockerfile.alpine Image name: datarhei/base:alpine-ffmpeg-latest

• rpi Dockerfile: Dockerfile.alpine.rpi Image name: datarhei/base:alpine-ffmpeg-rpi-latest

• cuda Dockerfile: Dockerfile.ubuntu.cuda Image name: datarhei/base:ubuntu-ffmpeg-cuda-latest

• vaapi Dockerfile: Dockerfile.ubuntu.vaapi Image name: datarhei/base:alpine-ffmpeg-vaapi-latest

2. Create a custom Core image

2.1 Clone the Core build files

Repository

2.2 Switch into the cloned folder

2.3 Build a custom image

3. Create a custom Core-FFmpeg bundle

You can find the Dockerfile for the bundle (Dockerfile.bundle) in the cloned Core repository.

3.1 Build a custom image

Helping Hands

To ensure your project's success, we offer installation services and ongoing support from the datarhei team. Helping Hands includes installing a datarhei Restreamer or datarhei Core on a server instance and managing the server as a managed service.

1. Installation

2. Configuration

3. Updates

4. Fix errors

Communication and assistance can be accessed through email or chat on our and conducted in English and German. We appreciate your support of "Helping Hands."

Within 48 hours of becoming a patron or sponsor on Open Collective, a representative from will contact you for further information regarding the installation process.

Service level agreements are in effect for the duration of the active donation.

If you have questions about the Helping Hands Service Level Agreement (SLA), contact us on or by email at [email protected]. We're here to help!"

Book now

Business Inquiries

We're the team at FOSS GmbH () from Switzerland, the creators of . We'll do our best to get back to you within 1-2 days during our regular business hours, excluding weekends and holidays in Switzerland and Germany. No matter what you need help with, we're here to provide professional support, software development, and consulting for anything related to datarhei software.

If you have a commercial request, such as a bug fix or feature enhancement, just let us know, and we'll be happy to provide a quote.

Business contact

Please fill out this form to help us respond to your request as quickly as possible. We're able to assist you in both German and English. However, please remember that we cannot process any requests not submitted through this form.

Community

Private and non-commercial requests can be discussed and resolved on and public channels.

Open issue on GitHub

Say hello on Discord

Donation

Every little bit helps! Consider becoming a patron on Patreon or backer on Open Collective to support keeping the software free.

Rate on Google

💙💚🧡💜 Help datarhei with a rating or review on Google. #feelsgoodtobeloved

>>

💛 Thanks for using datarhei software. Your datarhei.com team

Requirements

• Go v1.18+ ()

Build

Clone the repository and build the binary:

After the build process, the binary is available as core

For more build options, run make help.

Repository

Cross Compile

If you want to run the binary on a different operating system and/or architecture, you create the appropriate binary by simply setting some environment variables, e.g.

Docker

Build the Docker image and run it to try out the API with FFmpeg

How to customize FFmpeg

Code style

The source code is formatted with go fmt, or run make fmt. Static analysis of the source code is done with staticcheck (see ), or run make lint.

Before committing changes, you should run make commit to ensure that the source code is in shape.

This class of endpoints provide access to information that can be used for widgets in a website. These endpoints are not protected by the API access control.

Process

Fetch minimal statistics about a process. You need to know the process ID.

With auth enabled, you have to retrieve a JWT token before you can access the API calls.

Username/password login

Send the username and password, as defined in and , in the body of the request to the /api/login endpoint in order to obtain valid access and refresh JWT.

Example:

Description:

Auth0 login

Send a valid Auth0 access JWT in the Authorization header to the /api/login endpoint in order to obtain an access and refresh JWT. The Auth0 tenant and the allowed users must be defined in the .

Example:

JWT refresh

In order to obtain a new access token, use the refresh_token for a call to /api/login/refresh. Example:

Once the refresh token expires, you have to login again with your username and password, or a valid Auth0 token.

Description:

The disk filesystem gives access to the actual directory that has been provided in the configuration as . It accessible only for retrieval via HTTP under /.

Given that the requested file exists, the returned Content-Type is based solely on the file extension. For a list of known mime-types and their extensions see in the configuration.

Access

API

The contents of the disk filesystem at / are also accessible via the API in the same way as described above, but with the same protection as the API (see ) for all operations. It is also possible to list all files that are currently in the filesystem.

Create, Update

Example:

After the successful upload the file is available at /example.txt and /api/v3/fs/disk/example.txt.

Description:

Read

List all files

Listing all currently stored files is done by calling /api/v3/fs/disk. It also accepts the query parameters pattern, sort (name, size, or lastmod) and order (asc or desc). If none of the parameters are given, all files will be listed sorted by their last modification time in ascending order.

With the pattern parameter you can filter the list based on a , with the addition of the ** placeholder to include multiple subdirectories, e.g. listing all .ts file in the root directory has the pattern /*.ts, listing all .ts file in the whole filesystem has the pattern /**.ts.Example:

Description:

Download a file

For downloading a file you have to specify the complete path and filename. The Content-Type will always be application/data.

Example:

Description:

Delete

For deleting a file you have to specify the complete path and filename.

Example:

Description:

Configuration

Probing a process means to detect the vitals of the inputs of a process, e.g. frames, bitrate, codec, ... for each input and stream, e.g. a video file on disk may contain two video streams (low and high resolution, audio and subtitle streams in different languages).

A process must already exists before it can be probed. During probing only the global FFmpeg options and the inputs are used to construct the FFmpeg command line.

The probe returns an object with an array of the detected streams and any array of lines from the output from the ffmpeg command.

In the following example we assume the process config with these inputs for the process test. Parts that are not relevant for probing have been left out for brevity:

The expected result would be:

The field index refers to the input and the field stream refers to the stream of an input.

Example: probe the inputs of a process with the ID test:

Description: