# dahua-camera-server
axum HTTP, SSE and WebSocket API for the
[`dahua-camera`](https://crates.io/crates/dahua-camera) stack.
Most people should depend on the facade instead of this crate directly.
Handlers are thin: extract, call a port, translate back to HTTP. Anything that
looks like logic belongs upstream.
## Transports are never multiplexed
Video goes over its own WebSocket, one socket per viewer, carrying fMP4
fragments and nothing else. Events go over a **separate** SSE stream. They are
deliberately not merged: a chatty event feed must never be able to delay a
frame, and an event client that stops reading must never apply backpressure to
video.
## Security
`router` installs a permissive CORS layer. That is safe only under the assumed
deployment: the listener binds to loopback and a local shell is the only
client. This service holds credentials for every camera and performs no
authentication of its own, so **binding it to a routable address exposes every
camera** to anything that can reach the port.
## License
MIT OR Apache-2.0