# --- Logging ---
logLevel: info

# --- Control API (geschützt) ---
api: yes
apiAddress: :9997
apiEncryption: no
apiAllowOrigin: "*"

# --- Metrics (optional) ---
metrics: yes
metricsAddress: :9998
metricsEncryption: no
metricsAllowOrigin: "*"

# --- RTMP (Ingest) ---
rtmp: yes
rtmpAddress: :1935
rtmpEncryption: "no"

# --- HLS (Playback) ---
hls: yes
hlsAddress: :8888
hlsEncryption: no
hlsVariant: lowLatency         # <— statt mpegts
hlsSegmentDuration: 1s         # 1–2s (Segment = GOP-Vielfaches, s.u.)
hlsPartDuration: 200ms         # 200–350ms
hlsSegmentCount: 7             # hat keinen Einfluss auf Latenz, aber genügt
hlsAlwaysRemux: yes            # schneller Join / weniger Anlaufzeit

# Nicht benötigt
rtsp: no
webrtc: no
srt: no
pprof: no
playback: no

# --- AUTH: Intern (API + Publish) ---
# authMethod: internal
authInternalUsers:
  # Admin für API (und optional metrics)
  - user: sha256:jGl25bVBBBW96Qi9Te4V37Fnqchz/Eu4qB9vKrRIqRg=
    pass: sha256:jGl25bVBBBW96Qi9Te4V37Fnqchz/Eu4qB9vKrRIqRg=
    permissions:
      - action: api
      - action: metrics

  # Publisher für stream1
  - user: sha256:CCgj5KGMqEZgxOc5o4drwj9BVDg46eOLxuPMHhSRKAc=
    pass: sha256:XohImNooBHFR0OVvjcYpJ3NgPQ1qq73WKhHvch0VQtg=
    permissions:
      - action: publish
        path: stream1

  # NEU: jeder darf lesen (HLS/RTMP/RTSP)
  - user: any
    permissions:
      - action: read
        path:

# --- Paths ---
paths:
  # keine Legacy-Creds mehr hier!
  all: {}