Merge remote-tracking branch 'origin/260201-readonly' into beta

# Conflicts:
#	README.md
#	www/index.html

internal/xiaomi/xiaomi.go

@@ -219,6 +219,10 @@ func wakeUpCamera(url *url.URL) error {
 }
 
 func apiXiaomi(w http.ResponseWriter, r *http.Request) {
+	if api.IsReadOnly() && r.Method != "GET" {
+		api.ReadOnlyError(w)
+		return
+	}
 	switch r.Method {
 	case "GET":
 		apiDeviceList(w, r)

internal/xiaomi/xiaomi_readonly_test.go

@@ -0,0 +1,26 @@
+package xiaomi
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/AlexxIT/go2rtc/internal/api"
+	"github.com/stretchr/testify/require"
+)
+
+func TestApiXiaomiReadOnly(t *testing.T) {
+	prevReadOnly := api.ReadOnly
+	t.Cleanup(func() {
+		api.ReadOnly = prevReadOnly
+	})
+
+	api.ReadOnly = true
+
+	req := httptest.NewRequest("POST", "/api/xiaomi", nil)
+	w := httptest.NewRecorder()
+
+	apiXiaomi(w, req)
+
+	require.Equal(t, http.StatusForbidden, w.Code)
+}