Security

Security

Security model

Tailnet IRL Server is designed for trusted production devices inside one Tailscale Tailnet.

• Every remote listener binds to the server's validated Tailscale IPv4 address.
• MediaMTX API and metrics bind to localhost only.
• Publisher and reader roles use independent random credentials.
• The dashboard emits working URLs and therefore requires restricted Tailnet reachability.
• No public deployment mode is supported.

Tailscale encryption protects traffic in transit between devices. It does not make every Tailnet member automatically trusted to view credentials.

Roles and least privilege

Role	Capability
mobile	Publish only to live
studio	Read/playback only from live
Localhost	Access MediaMTX API and metrics

MediaMTX receives SHA-256 hashes in the rendered configuration. Plaintext credentials remain in the local credentials.env because clients need the original values.

Restrict Tailnet access

Use current Tailscale grants or ACLs to allow only:

• iPhone → server UDP 8890 and, if needed, TCP 1935/8090
• OBS computer → server UDP 8890, TCP 8554, preview ports and TCP 8090
• Administrators → dashboard and SSH/management paths as required

Do not blindly copy an access-policy example without adapting device tags and identities. Validate the policy with Tailscale's tooling before saving it.

Files and permissions

Item	Sensitivity
credentials.env	Plaintext publisher/reader secrets
Rendered mediamtx.yml	Credential hashes and runtime settings
Recordings	Potentially sensitive media
Connection history	Timestamps and durations, no URLs/secrets

On macOS, credentials use mode 0600, the state directory uses 0700, and the history file uses 0600. On Linux, configuration is owned by root:irl-server with restricted group access and services run as the unprivileged irl-server account.

Dashboard hardening

Responses include:

• Content Security Policy restricted to the application origin
• Referrer-Policy: no-referrer
• X-Content-Type-Options: nosniff
• Permissions Policy disabling camera, microphone and geolocation
• Cache prevention for live status and dashboard responses

The dashboard has no write endpoint.

Rotate exposed credentials

Rotation replaces both publisher and reader secrets atomically and restarts services.

macOS:

"$HOME/Library/Application Support/IRL Server/app/rotate-credentials.sh" --yes

Linux:

sudo /opt/irl-server/rotate-credentials.sh --yes

After rotation:

1. Re-import the Moblin profile.
2. Replace the URL in every OBS/VLC/FFmpeg receiver.
3. Remove old URLs from notes, automation and scene collections.
4. Test publish and read before production.

Never do this

• Forward ports 8090, 8890, 8554, 1935, 8888, 8889 or 8189 from the public internet.
• Put the dashboard behind a public tunnel.
• Commit credentials.env or a rendered runtime configuration.
• Paste complete URLs, credentials or private Tailnet addresses into public issues.
• Share recordings without reviewing their contents and permissions.

Dependency integrity

Installers download a pinned MediaMTX version and verify the archive against the official release SHA-256 manifest before installation. Keep this verification enabled.

Report a vulnerability

Use GitHub private vulnerability reporting. Do not create a public issue containing credentials, private addresses, exploit details or recording content.