Repository navigation
v0.5.0
What's new
Unauthenticated local-network liveness probe (GET /healthz).
The app discovers a direct Ethernet/USB link by probing candidate LAN addresses, but it only holds the device API key after bootstrapping one through the backend relay — which needs the camera to be online. Every endpoint that could serve as a liveness signal (GET /camera) required X-API-Key, so a keyless probe always got a 401 and a camera reachable only over the direct link could never be auto-detected.
GET /healthz closes that gap. It sits on the public router, is gated to local clients like the other unauthenticated surfaces (HLS preview, setup UI), and returns just {"status": "ok", "service": "relab-rpi-cam"} — enough for a prober to tell an RPi cam from any other LAN host that answers 200, and nothing more.
Security improvement. Because liveness no longer needs a credential, the app stops attaching the device API key to probe requests. The key is no longer sprayed at every server-supplied candidate URL during discovery — it now only ever reaches the single host that wins the probe, on real use.
Maintenance
Upgrading
Deploy this firmware before or together with the app release that consumes it. Cameras still on v0.4.0 will 404 the probe, and the app quietly falls back to relay transport — direct-connection discovery stops working, but nothing breaks.
No configuration changes. openapi.rpi-cam.json is regenerated; /healthz is the only added path.