Skip to content

Commit 939f2e3

Browse files
thelamerthelamer
committed
bump selkies add token auth ability
1 parent fea3e4e commit 939f2e3

4 files changed

Lines changed: 82 additions & 4 deletions

File tree

‎Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ RUN \
1616
https://github.com/selkies-project/selkies.git \
1717
/src && \
1818
cd /src && \
19-
git checkout -f 3a7d4d4ee868c85af205d786455ece6a2d4a8935
19+
git checkout -f 1b07e20bfcf18aca8989783d88b50eaf18ffd16f
2020

2121
RUN \
2222
echo "**** build shared core library ****" && \
@@ -190,7 +190,7 @@ RUN \
190190
| awk '/tag_name/{print $4;exit}' FS='[""]') && \
191191
curl -o \
192192
/tmp/selkies.tar.gz -L \
193-
"https://github.com/selkies-project/selkies/archive/3a7d4d4ee868c85af205d786455ece6a2d4a8935.tar.gz" && \
193+
"https://github.com/selkies-project/selkies/archive/1b07e20bfcf18aca8989783d88b50eaf18ffd16f.tar.gz" && \
194194
cd /tmp && \
195195
tar xf selkies.tar.gz && \
196196
cd selkies-* && \

‎Dockerfile.aarch64‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ RUN \
1616
https://github.com/selkies-project/selkies.git \
1717
/src && \
1818
cd /src && \
19-
git checkout -f 3a7d4d4ee868c85af205d786455ece6a2d4a8935
19+
git checkout -f 1b07e20bfcf18aca8989783d88b50eaf18ffd16f
2020

2121
RUN \
2222
echo "**** build shared core library ****" && \
@@ -188,7 +188,7 @@ RUN \
188188
| awk '/tag_name/{print $4;exit}' FS='[""]') && \
189189
curl -o \
190190
/tmp/selkies.tar.gz -L \
191-
"https://github.com/selkies-project/selkies/archive/3a7d4d4ee868c85af205d786455ece6a2d4a8935.tar.gz" && \
191+
"https://github.com/selkies-project/selkies/archive/1b07e20bfcf18aca8989783d88b50eaf18ffd16f.tar.gz" && \
192192
cd /tmp && \
193193
tar xf selkies.tar.gz && \
194194
cd selkies-* && \

‎README.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,8 @@ The server can be forced to use a single, fixed resolution for all connecting cl
176176
| `SELKIES_USE_BROWSER_CURSORS` | `False` | Use browser CSS cursors instead of rendering to canvas. |
177177
| `SELKIES_USE_CSS_SCALING` | `False` | HiDPI when false, if true a lower resolution is sent from the client and the canvas is stretched. |
178178
| `SELKIES_PORT` (or `CUSTOM_WS_PORT`) | `8082` | Port for the data websocket server. |
179+
| `SELKIES_CONTROL_PORT` | `8083` | Port for the internal control plane API, used for managing access tokens when in secure mode. |
180+
| `SELKIES_MASTER_TOKEN` | `''` | Master token to enable secure mode. If set, clients must authenticate using tokens provided via the control plane API. |
179181
| `SELKIES_DRI_NODE` (or `DRI_NODE`) | `''` | Path to the DRI render node for VA-API. |
180182
| `SELKIES_AUDIO_DEVICE_NAME` | `'output.monitor'` | Audio device name for pcmflux capture. |
181183
| `SELKIES_WATERMARK_PATH` (or `WATERMARK_PNG`) | `''` | Absolute path to the watermark PNG file. |
@@ -209,6 +211,43 @@ All base images are built for x86_64 and aarch64 platforms.
209211
| Kali | kali |
210212
| Ubuntu | ubuntunoble |
211213

214+
### Control Plane API for Token Management
215+
216+
When secure mode is enabled (`SELKIES_MASTER_TOKEN` is set), the server runs a control plane API on the `control_port` (default: 8083). This API is used to dynamically set and update the access tokens that clients can use to connect. This control plane port is meant for integrators that want to wrap the baseimage in their own platforms and handle authentication, this port should never be exposed publically.
217+
218+
**Endpoint:** `POST /tokens`
219+
220+
**Authentication:** The request must include an `Authorization` header with the master token: `Authorization: Bearer <your-master-token>`
221+
222+
**Request Body:** A JSON object where each key is a unique access token string you create, and the value is a permissions object defining that token's capabilities.
223+
224+
**Permissions Object Fields:**
225+
* `"role"`: (String, required) Can be one of the following:
226+
* `"controller"`: Full access. Can send keyboard, mouse, and all other input events.
227+
* `"viewer"`: Restricted access. Primarily for viewing the stream. Can be granted specific input rights via the `slot` property.
228+
* `"slot"`: (Integer or `null`, required) Assigns an input slot, for gamepads.
229+
* `null`: No specific input slot. A viewer with a `null` slot has no input capabilities.
230+
* `1`: Grants the `viewer` control over the **Player 1** gamepad *only*.
231+
* `2`: Grants the `viewer` control over the **Player 2** gamepad *only*.
232+
* `3`: Grants the `viewer` control over the **Player 3** gamepad *only*.
233+
* `4`: Grants the `viewer` control over the **Player 4** gamepad *only*.
234+
235+
**Behavior:** When a valid request is received, the server replaces its entire set of active tokens with the new set provided in the payload. It then runs a reconciliation process: any connected client whose token is now invalid or has changed permissions will be disconnected and users input capabilities will be modified live.
236+
237+
**Example `curl` Command:**
238+
```bash
239+
curl -X POST http://localhost:8083/tokens \
240+
-H "Authorization: Bearer my-secret-master-token" \
241+
-H "Content-Type: application/json" \
242+
-d '{
243+
"user-token-1": {"role": "controller", "slot": null},
244+
"user-token-2": {"role": "viewer", "slot": 1},
245+
"user-token-3": {"role": "viewer", "slot": null}
246+
}'
247+
```
248+
249+
Clients in this mode must connect with a valid token (`?token=...`) to establish a WebSocket connection.
250+
212251
### DRI3 GPU Acceleration
213252
214253
For accelerated apps or games, render devices can be mounted into the container and leveraged by applications using:

‎readme-vars.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,8 @@ full_custom_readme: |
180180
| `SELKIES_USE_BROWSER_CURSORS` | `False` | Use browser CSS cursors instead of rendering to canvas. |
181181
| `SELKIES_USE_CSS_SCALING` | `False` | HiDPI when false, if true a lower resolution is sent from the client and the canvas is stretched. |
182182
| `SELKIES_PORT` (or `CUSTOM_WS_PORT`) | `8082` | Port for the data websocket server. |
183+
| `SELKIES_CONTROL_PORT` | `8083` | Port for the internal control plane API, used for managing access tokens when in secure mode. |
184+
| `SELKIES_MASTER_TOKEN` | `''` | Master token to enable secure mode. If set, clients must authenticate using tokens provided via the control plane API. |
183185
| `SELKIES_DRI_NODE` (or `DRI_NODE`) | `''` | Path to the DRI render node for VA-API. |
184186
| `SELKIES_AUDIO_DEVICE_NAME` | `'output.monitor'` | Audio device name for pcmflux capture. |
185187
| `SELKIES_WATERMARK_PATH` (or `WATERMARK_PNG`) | `''` | Absolute path to the watermark PNG file. |
@@ -213,6 +215,43 @@ full_custom_readme: |
213215
| Kali | kali |
214216
| Ubuntu | ubuntunoble |
215217
218+
### Control Plane API for Token Management
219+
220+
When secure mode is enabled (`SELKIES_MASTER_TOKEN` is set), the server runs a control plane API on the `control_port` (default: 8083). This API is used to dynamically set and update the access tokens that clients can use to connect. This control plane port is meant for integrators that want to wrap the baseimage in their own platforms and handle authentication, this port should never be exposed publically.
221+
222+
**Endpoint:** `POST /tokens`
223+
224+
**Authentication:** The request must include an `Authorization` header with the master token: `Authorization: Bearer <your-master-token>`
225+
226+
**Request Body:** A JSON object where each key is a unique access token string you create, and the value is a permissions object defining that token's capabilities.
227+
228+
**Permissions Object Fields:**
229+
* `"role"`: (String, required) Can be one of the following:
230+
* `"controller"`: Full access. Can send keyboard, mouse, and all other input events.
231+
* `"viewer"`: Restricted access. Primarily for viewing the stream. Can be granted specific input rights via the `slot` property.
232+
* `"slot"`: (Integer or `null`, required) Assigns an input slot, for gamepads.
233+
* `null`: No specific input slot. A viewer with a `null` slot has no input capabilities.
234+
* `1`: Grants the `viewer` control over the **Player 1** gamepad *only*.
235+
* `2`: Grants the `viewer` control over the **Player 2** gamepad *only*.
236+
* `3`: Grants the `viewer` control over the **Player 3** gamepad *only*.
237+
* `4`: Grants the `viewer` control over the **Player 4** gamepad *only*.
238+
239+
**Behavior:** When a valid request is received, the server replaces its entire set of active tokens with the new set provided in the payload. It then runs a reconciliation process: any connected client whose token is now invalid or has changed permissions will be disconnected and users input capabilities will be modified live.
240+
241+
**Example `curl` Command:**
242+
```bash
243+
curl -X POST http://localhost:8083/tokens \
244+
-H "Authorization: Bearer my-secret-master-token" \
245+
-H "Content-Type: application/json" \
246+
-d '{
247+
"user-token-1": {"role": "controller", "slot": null},
248+
"user-token-2": {"role": "viewer", "slot": 1},
249+
"user-token-3": {"role": "viewer", "slot": null}
250+
}'
251+
```
252+
253+
Clients in this mode must connect with a valid token (`?token=...`) to establish a WebSocket connection.
254+
216255
### DRI3 GPU Acceleration
217256
218257
For accelerated apps or games, render devices can be mounted into the container and leveraged by applications using:

0 commit comments

Comments
 (0)