dahua_camera_server/lib.rs
1//! HTTP, Server-Sent Events and WebSocket delivery.
2//!
3//! Handlers are thin: each one extracts, calls into a port or into
4//! `dahua-camera-rtsp`, and translates the result back to HTTP. Anything that
5//! looks like logic belongs upstream of this crate.
6//!
7//! # Transports are never multiplexed
8//!
9//! Video goes over its own WebSocket, one socket per viewer, carrying fMP4
10//! fragments and nothing else. Events go over a *separate* stream. They are
11//! deliberately not merged onto one connection: a chatty event feed must never
12//! be able to delay a frame, and an event client that stops reading must never
13//! apply backpressure to video.
14//!
15//! # Security
16//!
17//! [`router()`] installs a permissive CORS layer. That is safe only under the
18//! deployment this workspace assumes — the listener binds to loopback and a
19//! local shell is the only client. This service holds credentials for every
20//! camera and performs no authentication of its own, so binding it to a
21//! routable address exposes every camera to anything that can reach the port.
22
23#![warn(missing_docs)]
24#![forbid(unsafe_code)]
25
26pub mod dto;
27pub mod handlers;
28pub mod router;
29pub mod state;
30
31pub use router::{router, router_with_assets};
32pub use state::{AppState, AppStateInner};