Skip to content

Experimental HomeKit Secure Video open-source (WebRTC + HEVC + CMAF recording) - #2343

Open
rursache wants to merge 8 commits into
AlexxIT:masterfrom
rursache:feature/hksv-open-source-2297
Open

Experimental HomeKit Secure Video open-source (WebRTC + HEVC + CMAF recording)#2343
rursache wants to merge 8 commits into
AlexxIT:masterfrom
rursache:feature/hksv-open-source-2297

Conversation

@rursache

@rursache rursache commented Jul 10, 2026

Copy link
Copy Markdown

Summary

Implements the HAP services from Apple's HomeKit Secure Video Open Source Compatibility Guide (Developer Preview, capabilities 17.99) for issue #2297

Closes nothing yet (experimental). Tracking: #2297

What is included

  • Camera Capabilities, Global Operating Mode, Motion Zones
  • Multi-tier RTP stream management (High/Medium/Low, HEVC + H.264, Opus)
  • WebRTC Stream Management over HAP (solicit-offer / provide-answer / reoffer / update / end, min 6 sessions)
  • Classic RTP kept with 5 concurrent stream slots
  • Full CMAF recording stack:
    • 8s ring pre-buffer attached to the source stream
    • Client CSR generation + certificate install for mTLS ingest
    • Content key management (keys stored; clear fMP4 upload, transport protected by mTLS)
    • Publishing point URL + server CAs from the controller
    • Buffer activity, upload, and event queue with HAP write-response + sequence notifies
    • DASH-IF Interface-1 POST of init + media segments to the publishing point

Config

streams:
  cam1:
    - rtsp://user:pass@192.168.1.10/stream
    - ffmpeg:cam1#video=h265#hardware  # HEVC preferred for HKSV
    - ffmpeg:cam1#audio=opus

homekit:
  cam1:
    pin: 12345678
    name: Front door
    hksv: true  # experimental

Without hksv: true behavior is unchanged (classic H264 RTP HomeKit camera)

Notes

  • Spec is a Developer Preview and may change
  • End-to-end Secure Video in Apple Home still depends on Apple accepting the accessory after pairing and providing a live publishing point
  • CENC sample encryption is prepared (keys stored); current upload is clear CMAF over mTLS so local HTTP ingest tests work without a real Apple CA chain
  • Longer HAP type IDs and tlv8 bool handling are required for the new characteristics

Test plan

  • Unit tests for WebRTC session manager
  • Unit tests for credentials CSR/cert/TLS config
  • Unit tests for ring buffer, fMP4 clip builder, NTP timestamps
  • Unit tests for CMAF HTTP client against local httptest
  • Unit tests for recording manager (motion, events, upload session)
  • HAP accessory/service TLV8 round-trips for new types
  • Pair accessory with hksv: true on a real Apple Home hub (developer account / preview)
  • Confirm WebRTC live view starts from Home app
  • Confirm controller provisions CSR/cert + publishing point
  • Confirm buffer upload posts init + segments to publishing point

rursache added 6 commits July 10, 2026 17:39
InitIID keeps packed IIDs for legacy 3-char types so existing
pairings stay valid, and assigns sequential high-range IIDs for
4-char types from the HKSV open-source guide. Also add write-response
permission helpers and boolean TLV8 encode/decode
Implements the Developer Preview 17.99 services and characteristics
from Apple's HomeKit Secure Video Open Source Compatibility Guide:
camera capabilities, multi-tier RTP/WebRTC stream management with
mandatory HEVC tiers, buffer/key/cert management, and accessory builder
Session manager implements solicit-offer, provide-answer, reoffer,
update-session, end, SFrame key storage, and CMAF client CSR/cert
provisioning. Skip empty-string TLV8 fields so optional values do not
emit zero-length items. Consumer accepts H.265 tracks for HKSV
HomeKit server handles WebRTC/multi-tier/buffer/cert characteristics
with HAP write-response, streaming gates, and stream consumer attach.
Enable with homekit.<stream>.hksv: true (capabilities version 17.99)
Cover TLV8 round-trips, accessory service inventory, WebRTC session
lifecycle, CSR generation, and README/config examples for issue 2297
Wire the open-source Secure Video recording path end to end:
credentials (CSR/cert/keys/publishing point), 8s ring pre-buffer,
fMP4 clip builder, DASH-IF mTLS ingest client, event queue, and
buffer activity/upload handlers on the HomeKit server when hksv is on

Refs: AlexxIT#2297
@rursache rursache changed the title Experimental HomeKit Secure Video open-source support (WebRTC + HEVC) Experimental HomeKit Secure Video open-source (WebRTC + HEVC + CMAF recording) Jul 10, 2026
rursache added 2 commits July 10, 2026 18:11
Expand unit coverage for buffer trim, concurrent push, clip encrypt,
upload cancel/stop, empty buffer, missing publishing point, and CMAF
error mapping. Run clean under -race.

Emit 0x00 TLV item separators to match real HomeKit accessories and
golden dumps; keep unmarshaling 0xFF for interoperability. Fix buffer
Stop so it does not replace in-flight sessions
Cover CSR/cert, keys, publishing point, buffer activity/upload/events,
WebRTC solicit/privacy/end, RTP control, invalid TLV, and concurrent
access through SetCharacteristic/GetCharacteristic without a real hub

Serialize wrValues and related characteristic updates under wrMu so
handler paths stay race-free. Accept empty TLV on unmarshal for valid
empty write-responses
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant