Bash installer that works on any Linux distro:
- Auto-detects OS and architecture
- Installs Docker via get.docker.com if missing
- Installs Docker Compose plugin if missing
- Auto-discovers local Frigate and go2rtc instances
- Interactive dialogs with 10s timeouts
- Generates docker-compose.yml and .env in /opt/strix/
- Supports install and update modes
- CLI flags for non-interactive use (--yes, --version, --no-logo)
- Returns machine-readable status for parent scripts (Proxmox LXC)
Cameras under load may accept TCP connection but never respond,
hanging tester workers indefinitely. Context timeout on the HTTP
request ensures workers are released.
Register http, https, httpx handlers with content-type detection:
- image/jpeg: single JPEG snapshots via go2rtc image.Open
- multipart/x-mixed-replace: MJPEG streams via mpjpeg.Open
- application/vnd.apple.mpegurl: HLS via hls.OpenURL
- auto-detect fallback via magic.Open (MPEG-TS, raw MJPEG, etc.)
Uses go2rtc tcp.Do for Basic + Digest auth and TLS handling.
Bubble protocol uses net.DialTimeout with u.Host directly,
which requires explicit port. Add portRequired set to force
port in generated URLs for such protocols.
Frontend:
- index.html: probe device, navigate to standard/homekit by type
- standard.html: camera config, model search with multi-select
- create.html: stream URL list, custom URL input, create test session
- homekit.html: HomeKit device info, contact links, fallback to standard
Backend:
- Move static files to www/ package with embed (go2rtc pattern)
- Add initStatic() in api with FileServer
- Add width/height to test results from H264 SPS parsing
- Contribute links to gostrix.github.io with auto-filled params
- Dockerfile: multi-stage build with golang:1.26 and alpine + ffmpeg
- SQLite: use file: URI with immutable=1 for read-only access
- URL builder: encode user/pass with PathEscape/QueryEscape for
special characters (@, \, :, etc.)
- Health endpoint: truncate uptime to seconds
- Release skill: update smoke test to /api endpoint
- Remove unused ValidateID function
Complete architecture rewrite following go2rtc patterns:
- pkg/ for pure logic (camdb, tester, probe, generate)
- internal/ for application glue with Init() modules
- Single HTTP server on :4567 with all endpoints
- zerolog with password masking and memory ring buffer
- Environment-based config only (no YAML files)
API endpoints: /api/search, /api/streams, /api/test,
/api/probe, /api/generate, /api/health, /api/log
Dependencies: go2rtc v1.9.14, go-sqlite3, miekg/dns, zerolog
Document NET_RAW and NET_ADMIN capabilities needed for network
scanning when running Strix with Podman. Includes podman run,
podman-compose, and Quadlet (systemd) setup instructions.
Addresses #6
Document NET_RAW and NET_ADMIN capabilities needed for network
scanning when running Strix with Podman. Includes podman run,
podman-compose, and Quadlet (systemd) setup instructions.
Addresses #6
Move SetupLogger() to a standalone function called before config.Load()
so the logger is available from the very start. Replace all fmt.Printf
calls in config.go with slog calls. Redirect banner and endpoint info
to stderr, keeping stdout clean for structured log output (JSON/text).
Fixes#5
Passwords containing @, #, :, ?, /, %, &, space and other special
characters broke URL parsing, causing streams to not be detected.
Replaced fmt.Sprintf string concatenation with url.URL struct for
building RTSP/HTTP URLs. Credentials in userinfo are now handled via
url.UserPassword() which encodes special chars automatically.
Split replacePlaceholders into two phases:
- Phase 1: safe placeholders (channel, width, IP, port)
- Phase 2: credential placeholders with context-aware encoding:
- Query string: url.Values.Set + Encode (auto percent-encoding)
- Path segments: url.PathEscape
Normal passwords (letters, digits, -._~) produce identical URLs
as before -- encoding is a no-op for safe characters.
Fixes#10
SecretStore.Add now registers both plain text and URL-encoded forms
of the password. Fixes cases where passwords with special characters
(e.g. @, #, :) appear percent-encoded in URLs but were not matched
by the masking handler.
Add a secret-masking slog.Handler that automatically replaces registered
passwords with "***" in all log output. Secrets are registered per-scan
when a discovery request arrives and unregistered when it completes.
This approach masks credentials everywhere they appear in logs — URL
userinfo, query parameters, path segments, and Go HTTP error messages —
without modifying any business logic in scanner, builder, tester, or
ONVIF components. API responses are unaffected and still return full
URLs with credentials for frontend use.
eduard256