Peeklio gateway (rproxy)¶

Peeklio is a reverse-proxy gateway embedded in Sapsan. A lightweight agent installed next to a camera (behind NAT) connects out to Sapsan and maintains a tunnel; through this tunnel Sapsan pulls the device's video and traffic as if it were on the local network.

Gateway configuration¶

rproxy:
  streampoint_key: <key for streampoint connections>
  endpoint_auth_url: http://backend.example.com/agent-auth
  agents:
  - agent_id: a1b2c3
    password: <agent password>
    salt: <salt>
    streampoint_url: http://this-server:5080

Agents can be authorized in two ways: a local agents list in the config, or an external endpoint_auth_url backend. Without endpoint_auth_url the gateway runs in "streampoint-only" mode — it accepts tunnels but does not register new agents.

On the agent side you set the server address, agent_id, password, ping interval, and a host ACL — the list of addresses that may be reached through this agent at all; everything else is rejected.

Ingesting a stream through an agent¶

A stream input specifies via_agent with the agent identifier:

streams:
  cam-behind-nat:
    inputs:
    - rtsp:
        url: rtsp://admin:password@192.168.1.10/stream0
        via_agent: "agent://a1b2c3"

The address in url is the camera's local address in the agent's network. The RTSP handshake and the stream go through the tunnel.

Error behavior¶

Connection errors through an agent are distinguishable: closed port (connection refused), host not in the agent's ACL (permission denied), unresolvable name. The server can remotely send an agent reset and reboot commands.

Agent monitoring¶

GET /streamer/api-v4/rproxy/streampoint-agents returns per-agent counters: pings, bytes both ways, attempted/opened/current connections. See the Admin API.