Agent tunnels¶

gateway.tunnel.agents

Peeklio is a reverse-proxy gateway embedded in Sapsan. A lightweight agent installed next to a camera (behind NAT) connects out to Sapsan and maintains a tunnel; through this tunnel Sapsan pulls the device's video and traffic as if it were on the local network.

Gateway configuration¶

rproxy:
  streampoint_key: <key for streampoint connections>
  endpoint_auth_url: http://backend.example.com/agent-auth
  agents:
  - agent_id: a1b2c3
    password: <agent password>
    salt: <salt>
    streampoint_url: http://this-server:5080

Agents can be authorized through the local agents list or an external endpoint_auth_url backend. When endpoint_auth_url is set, the backend is used and agents is ignored. Without a backend, a nonempty agents list provides local authorization. Streampoint-only mode, without registering new agents, applies when neither a backend nor local agent credentials are configured.

On the agent side you set the server address, agent_id, password, ping interval, and a host ACL — the list of addresses that may be reached through this agent at all; everything else is rejected.

Gateway state is preserved across configuration reloads. Changes to streampoint_key or endpoint_auth_url take effect on reload and reconnect agent control sessions with the new settings.

Ingesting a stream through an agent¶

A stream input specifies via_agent with the agent identifier:

streams:
  - name: cam-behind-nat
    inputs:
    - rtsp:
        url: rtsp://admin:password@192.168.1.10/stream0
        via_agent: "agent://a1b2c3"

The address in url is the camera's local address in the agent's network. The RTSP handshake and the stream go through the tunnel.

Error behavior¶

Connection errors through an agent are distinguishable: closed port (connection refused), host not in the agent's ACL (permission denied), unresolvable name. The server can remotely send an agent reset and reboot commands.

Agent monitoring¶

GET /streamer/api-v4/rproxy/streampoint-agents returns per-agent counters: pings, bytes both ways, attempted/opened/current connections. See the Admin API.