server: verup

Co-authored-by: Gianluca Ruocco <gianluca.ruocco@xarvio.com>

.github/ISSUE_TEMPLATE/bug_report.md

@@ -7,17 +7,31 @@ assignees: ''
 
 ---
 
-# Github Issues is not a Forum
+# Github Issues are not a Support or Discussion Forum
 
-**This issue tracker is not for hardware support or feature requests**. If you are troubleshooting adding a device for the first time, use Discord, Reddit, or Github Discussions. However, if something **was working**, and is now **no longer working**, you may create a Github issue.
+Before opening an issue, view the device's Console logs in the Scrypted Management web interface.
+
+**DO NOT OPEN ISSUES FOR ANY OF THE FOLLOWING:**
+
+* Server or hardware setup assistance. Use Discord, Reddit, or Github Discussions.
+* Feature Requests. Use Discord, Reddit, or Github Discussions.
+* Packet loss in your camera logs. This is wifi/network congestion.
+* HomeKit weirdness. See HomeKit troubleshooting guide.
+* Release schedules or timelines. Releases are rolled out unevenly across the different server platforms.
+
+However, if something **was working**, and is now **no longer working**, you may create a Github issue.
 Created issues that do not meet these requirements or are improperly filled out will be immediately closed.
 
-
 # New Issue Instructions
 
 1. Delete this section and everything above it.
 2. Fill out the sections below.
 
+** Before You Submit**
+
+- [ ] I checked that my issue isn't already filed: [Search open issues](https://github.com/koush/scrypted/issues).
+- [ ] I checked the relevant camera/device and/or plugin `Log` in the `Management Console` for errors or warnings that may help identify and resolve the issue myself.
+
 **Describe the bug**
 A clear and concise description of what the bug is. The issue tracker is only for reporting bugs in Scrypted, for general support check Discord. Hardrware support requests or assistance requests will be immediately closed.
 
@@ -34,16 +48,18 @@ A clear and concise description of what you expected to happen.
 **Screenshots**
 If applicable, add screenshots to help explain your problem.
 
-**Desktop (please complete the following information):**
- - OS: [e.g. iOS]
- - Browser [e.g. chrome, safari]
- - Version [e.g. 22]
+**Logs**
+Include a `Log` from the device/camera in the management console (and if applicable, the affacted plugin, like HomeKit).
 
-**Smartphone (please complete the following information):**
- - Device: [e.g. iPhone6]
- - OS: [e.g. iOS8.1]
- - Browser [e.g. stock browser, safari]
- - Version [e.g. 22]
+**Server (please complete the following information):**
+ - OS: [e.g. Ubuntu]
+ - Installation Method: [e.g. Desktop App, Docker, Local]
+
+**Hardware Model (please complete the following information):**
+ - Device: [e.g. Amcrest]
+
+**Client (please complete the following information, if applicable):**
+ - Software: [e.g. Home app, NVR app, Alexa, Browser]
 
 **Additional context**
 Add any other context about the problem here.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,2 @@
+# disable blank issue creation
+blank_issues_enabled: false

.github/workflows/build-plugins-changed.yml

@@ -0,0 +1,51 @@
+name: Build changed plugins
+
+on:
+#   push:
+#     branches: ["main"]
+#     paths: ["plugins/**"]
+#   pull_request:
+#     paths: ["plugins/**"]
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:  
+            fetch-depth: 2
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Set up base packages
+        run: ./npm-install.sh
+
+      - name: Build changed plugins
+        run: |
+            # Get the list of changed directories in /plugins
+            changed_dirs=$(git diff --name-only HEAD^ HEAD ./plugins | awk -F/ '{print $2}' | uniq)
+            
+            # Loop through each changed directory
+            for dir in $changed_dirs; do
+                pushd "./plugins/$dir"
+
+                if [[ "$dir" == "core" ]]; then
+                  # core plugin requires ui to be built
+                  pushd "./ui"
+                  echo "plugins/$dir/ui > npm install"
+                  npm install
+                  echo "plugins/$dir/ui > npm run build"
+                  npm run build
+                  popd
+                fi
+
+                echo "plugins/$dir > npm install"
+                npm install
+                echo "plugins/$dir > npm run build"
+                npm run build
+                popd
+            done

.github/workflows/build-sdk.yml

@@ -0,0 +1,25 @@
+name: Build SDK
+
+on:
+  push:
+    branches: ["main"]
+    paths: ["sdk/**"]
+  pull_request:
+    paths: ["sdk/**"]
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./sdk
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.4.1
+      - run: npm ci
+      - run: npm run build

.github/workflows/docker-common.yml

@@ -7,15 +7,12 @@ jobs:
   build:
     name: Push Docker image to Docker Hub
     runs-on: self-hosted
-#     runs-on: ubuntu-latest
+    env:
+      NODE_VERSION: '22'
     strategy:
       matrix:
-        NODE_VERSION: [
-          "18",
-          # "20"
-        ]
-        BASE: ["jammy"]
-        FLAVOR: ["full", "lite", "thin"]
+        BASE: ["noble"]
+        FLAVOR: ["full", "lite"]
     steps:
       - name: Check out the repo
         uses: actions/checkout@v3
@@ -23,12 +20,26 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2
 
+      - name: Set up SSH
+        uses: MrSquaare/ssh-setup-action@v2
+        with:
+          host: ${{ secrets.DOCKER_SSH_HOST_AMD64 }}
+          private-key: ${{ secrets.DOCKER_SSH_PRIVATE_KEY }}
+
       - name: Set up SSH
         uses: MrSquaare/ssh-setup-action@v2
         with:
           host: ${{ secrets.DOCKER_SSH_HOST_ARM64 }}
           private-key: ${{ secrets.DOCKER_SSH_PRIVATE_KEY }}
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          platforms: linux/amd64
+          append: |
+            - endpoint: ssh://${{ secrets.DOCKER_SSH_USER }}@${{ secrets.DOCKER_SSH_HOST_AMD64 }}
+              platforms: linux/amd64
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
         with:
@@ -54,14 +65,85 @@ jobs:
         uses: docker/build-push-action@v4
         with:
           build-args: |
-            NODE_VERSION=${{ matrix.NODE_VERSION }}
+            NODE_VERSION=${{ env.NODE_VERSION }}
             BASE=${{ matrix.BASE }}
           context: install/docker/
           file: install/docker/Dockerfile.${{ matrix.FLAVOR }}
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            koush/scrypted-common:${{ matrix.NODE_VERSION }}-${{ matrix.BASE }}-${{ matrix.FLAVOR }}
-            ghcr.io/koush/scrypted-common:${{ matrix.NODE_VERSION }}-${{ matrix.BASE }}-${{ matrix.FLAVOR }}
+            koush/scrypted-common:${{ matrix.BASE }}-${{ matrix.FLAVOR }}
+            ghcr.io/koush/scrypted-common:${{ matrix.BASE }}-${{ matrix.FLAVOR }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  build-vendor:
+    name: Push Vendor Docker image to Docker Hub
+    needs: build
+    runs-on: self-hosted
+    strategy:
+      matrix:
+        BASE: ["noble"]
+        VENDOR: ["nvidia", "intel"]
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up SSH
+        uses: MrSquaare/ssh-setup-action@v2
+        with:
+          host: ${{ secrets.DOCKER_SSH_HOST_AMD64 }}
+          private-key: ${{ secrets.DOCKER_SSH_PRIVATE_KEY }}
+
+      - name: Set up SSH
+        uses: MrSquaare/ssh-setup-action@v2
+        with:
+          host: ${{ secrets.DOCKER_SSH_HOST_ARM64 }}
+          private-key: ${{ secrets.DOCKER_SSH_PRIVATE_KEY }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          platforms: linux/amd64
+          append: |
+            - endpoint: ssh://${{ secrets.DOCKER_SSH_USER }}@${{ secrets.DOCKER_SSH_HOST_AMD64 }}
+              platforms: linux/amd64
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          platforms: linux/arm64
+          append: |
+            - endpoint: ssh://${{ secrets.DOCKER_SSH_USER }}@${{ secrets.DOCKER_SSH_HOST_ARM64 }}
+              platforms: linux/arm64
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Login to Github Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push Docker image (scrypted-common)
+        uses: docker/build-push-action@v4
+        with:
+          build-args: |
+            BASE=ghcr.io/koush/scrypted-common:${{ matrix.BASE }}-full
+          context: install/docker/
+          file: install/docker/Dockerfile.${{ matrix.VENDOR }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            koush/scrypted-common:${{ matrix.BASE }}-${{ matrix.VENDOR }}
+            ghcr.io/koush/scrypted-common:${{ matrix.BASE }}-${{ matrix.VENDOR }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/docker.yml

@@ -20,14 +20,12 @@ jobs:
     strategy:
       matrix:
         BASE: [
-          "18-jammy-full",
-          "18-jammy-lite",
-          # "18-jammy-thin",
-          # "20-jammy-full",
-          # "20-jammy-lite",
-          # "20-jammy-thin",
+          ["noble-nvidia", ".s6", "noble-nvidia", "nvidia"],
+          ["noble-intel", ".s6", "noble-intel", "intel"],
+          ["noble-full", ".s6", "noble-full", "full"],
+          ["noble-lite", "", "noble-lite", "lite"],
+          ["noble-lite", ".router", "noble-router", "router"],
         ]
-        SUPERVISOR: ["", ".s6"]
     steps:
       - name: Check out the repo
         uses: actions/checkout@v3
@@ -46,12 +44,26 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2
 
+      - name: Set up SSH
+        uses: MrSquaare/ssh-setup-action@v2
+        with:
+          host: ${{ secrets.DOCKER_SSH_HOST_AMD64 }}
+          private-key: ${{ secrets.DOCKER_SSH_PRIVATE_KEY }}
+
       - name: Set up SSH
         uses: MrSquaare/ssh-setup-action@v2
         with:
           host: ${{ secrets.DOCKER_SSH_HOST_ARM64 }}
           private-key: ${{ secrets.DOCKER_SSH_PRIVATE_KEY }}
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          platforms: linux/amd64
+          append: |
+            - endpoint: ssh://${{ secrets.DOCKER_SSH_USER }}@${{ secrets.DOCKER_SSH_HOST_AMD64 }}
+              platforms: linux/amd64
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
         with:
@@ -77,27 +89,31 @@ jobs:
         uses: docker/build-push-action@v4
         with:
           build-args: |
-            BASE=${{ matrix.BASE }}
+            BASE=${{ matrix.BASE[0] }}
             SCRYPTED_INSTALL_VERSION=${{ steps.package-version.outputs.NPM_VERSION }}
           context: install/docker/
-          file: install/docker/Dockerfile${{ matrix.SUPERVISOR }}
+          file: install/docker/Dockerfile${{ matrix.BASE[1] }}
           platforms: linux/amd64,linux/arm64
           push: true
-          tags: |
-            ${{ format('koush/scrypted:{0}{1}-v{2}', matrix.BASE, matrix.SUPERVISOR, github.event.inputs.publish_tag || steps.package-version.outputs.NPM_VERSION) }}
-            ${{ matrix.BASE == '18-jammy-full' && matrix.SUPERVISOR == '.s6' && format('koush/scrypted:{0}', github.event.inputs.tag) || '' }}
-            ${{ github.event.inputs.tag == 'latest' && matrix.BASE == '18-jammy-full' && matrix.SUPERVISOR == '' && 'koush/scrypted:full' || '' }}
-            ${{ github.event.inputs.tag == 'latest' && matrix.BASE == '18-jammy-lite' && matrix.SUPERVISOR == '' && 'koush/scrypted:lite' || '' }}
-            ${{ github.event.inputs.tag == 'latest' && matrix.BASE == '18-jammy-thin' && matrix.SUPERVISOR == '' && 'koush/scrypted:thin' || '' }}
-            ${{ github.event.inputs.tag == 'latest' && matrix.BASE == '18-jammy-lite' && matrix.SUPERVISOR == '.s6' && 'koush/scrypted:lite-s6' || '' }}
-            ${{ github.event.inputs.tag == 'latest' && matrix.BASE == '18-jammy-thin' && matrix.SUPERVISOR == '.s6' && 'koush/scrypted:thin-s6' || '' }}
+          # when publishing a tag (beta or latest), platform and version, create some tags as follows.
+          # using beta 0.0.1 as an example
+          # koush/scrypted:v0.0.1-noble-full
+          # koush/scrypted:beta
+          # koush/scrypted:beta-nvidia|intel|full|router|lite
 
-            ${{ format('ghcr.io/koush/scrypted:{0}{1}-v{2}', matrix.BASE, matrix.SUPERVISOR, github.event.inputs.publish_tag || steps.package-version.outputs.NPM_VERSION) }}
-            ${{ matrix.BASE == '18-jammy-full' && matrix.SUPERVISOR == '.s6' && format('ghcr.io/koush/scrypted:{0}', github.event.inputs.tag) || '' }}
-            ${{ github.event.inputs.tag == 'latest' && matrix.BASE == '18-jammy-full' && matrix.SUPERVISOR == '' && 'ghcr.io/koush/scrypted:full' || '' }}
-            ${{ github.event.inputs.tag == 'latest' && matrix.BASE == '18-jammy-lite' && matrix.SUPERVISOR == '' && 'ghcr.io/koush/scrypted:lite' || '' }}
-            ${{ github.event.inputs.tag == 'latest' && matrix.BASE == '18-jammy-thin' && matrix.SUPERVISOR == '' && 'ghcr.io/koush/scrypted:thin' || '' }}
-            ${{ github.event.inputs.tag == 'latest' && matrix.BASE == '18-jammy-lite' && matrix.SUPERVISOR == '.s6' && 'ghcr.io/koush/scrypted:lite-s6' || '' }}
-            ${{ github.event.inputs.tag == 'latest' && matrix.BASE == '18-jammy-thin' && matrix.SUPERVISOR == '.s6' && 'ghcr.io/koush/scrypted:thin-s6' || '' }}
+          # using latest 0.0.2 as an example:
+          # koush/scrypted:v0.0.2-noble-full
+          # koush/scrypted:latest
+          # koush/scrypted:nvidia|intel|full|router|lite
+          tags: |
+            ${{ format('koush/scrypted:v{0}-{1}', github.event.inputs.publish_tag || steps.package-version.outputs.NPM_VERSION, matrix.BASE[2]) }}
+            ${{ matrix.BASE[2] == 'noble-full' && format('koush/scrypted:{0}', github.event.inputs.tag) || '' }}
+            ${{ github.event.inputs.tag == 'latest' && format('koush/scrypted:{0}', matrix.BASE[3]) || '' }}
+            ${{ github.event.inputs.tag != 'latest' && format('koush/scrypted:{0}-{1}', github.event.inputs.tag, matrix.BASE[3]) }}
+
+            ${{ format('ghcr.io/koush/scrypted:v{1}-{0}', matrix.BASE[0], github.event.inputs.publish_tag || steps.package-version.outputs.NPM_VERSION) }}
+            ${{ matrix.BASE[2] == 'noble-full' && format('ghcr.io/koush/scrypted:{0}', github.event.inputs.tag) || '' }}
+            ${{ github.event.inputs.tag == 'latest' && format('ghcr.io/koush/scrypted:{0}', matrix.BASE[3]) || ''}}
+            ${{ github.event.inputs.tag != 'latest' && format('ghcr.io/koush/scrypted:{0}-{1}', github.event.inputs.tag, matrix.BASE[3]) || '' }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/static-sites.yml

@@ -0,0 +1,44 @@
+# Simple workflow for deploying static content to GitHub Pages
+name: Deploy static content to Pages
+
+on:
+  # Runs on pushes targeting the default branch
+  push:
+    branches: ["main"]
+    paths: ["sites/static/**", ".github/workflows/static-sites.yml"]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
+# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+
+jobs:
+  # Single deploy job since we're just deploying
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Pages
+        uses: actions/configure-pages@v5
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          # Upload entire repository
+          path: './sites/static'
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/test.yml

@@ -9,52 +9,28 @@ on:
   workflow_dispatch:
   
 jobs:
-  test_linux_local:
-    name: Test Linux local installation
-    runs-on: ubuntu-latest
+  test_local:
+    name: Test local installation on ${{ matrix.runner }}
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-latest, ubuntu-24.04-arm, macos-14, macos-13, windows-latest]
     
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3
-        
-      - name: Run install script
+
+      - name: Parse latest server release
+        id: parse_server
+        shell: bash
         run: |
-          cat ./install/local/install-scrypted-dependencies-linux.sh | sudo SERVICE_USER=$USER bash
-          
-      - name: Test server is running
-        run: |
-          systemctl status scrypted.service
-          curl -k --retry 20 --retry-all-errors --retry-max-time 600 https://localhost:10443/
-          
-  test_mac_local:
-    name: Test Mac local installation
-    runs-on: macos-latest
-    
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-        
-      - name: Run install script
-        run: |
-          mkdir -p ~/.scrypted
-          bash ./install/local/install-scrypted-dependencies-mac.sh
-          
-      - name: Test server is running
-        run: |
-          curl -k --retry 20 --retry-all-errors --retry-max-time 600 https://localhost:10443/
-          
-  test_windows_local:
-    name: Test Windows local installation
-    runs-on: windows-latest
-    
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-        
-      - name: Run install script
-        run: |
-          .\install\local\install-scrypted-dependencies-win.ps1
-          
-      - name: Test server is running
-        run: |
-          curl -k --retry 20 --retry-all-errors --retry-max-time 600 https://localhost:10443/
+          VERSION=$(cat ./server/package-lock.json | jq -r '.version')
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Will test @scrypted/server@$VERSION"
+
+      - name: Install scrypted server
+        uses: scryptedapp/setup-scrypted@v0.0.2
+        with:
+          branch: ${{ github.sha }}
+          version: ${{ steps.parse_server.outputs.version }}

.gitmodules

@@ -1,15 +1,6 @@
 [submodule "plugins/unifi-protect/src/unifi-protect"]
 	path = external/unifi-protect
 	url = ../../koush/unifi-protect.git
-[submodule "plugins/myq/src/myq"]
-	path = plugins/myq/src/myq
-	url = ../../koush/myq.git
-[submodule "plugins/tensorflow/face-api.js"]
-	path = external/face-api.js
-	url = ../../koush/face-api.js
-[submodule "external/scrypted-ffmpeg"]
-	path = external/scrypted-ffmpeg
-	url = ../../koush/scrypted-ffmpeg
 [submodule "external/ring-client-api"]
 	path = external/ring-client-api
 	url = ../../koush/ring
@@ -20,12 +11,6 @@
 [submodule "external/werift"]
 	path = external/werift
 	url = ../../koush/werift-webrtc
-[submodule "plugins/zwave/file-stream-rotator"]
-	path = plugins/zwave/file-stream-rotator
-	url = ../../koush/file-stream-rotator.git
-[submodule "sdk/developer.scrypted.app"]
-	path = sdk/developer.scrypted.app
-	url = ../../koush/developer.scrypted.app
 [submodule "plugins/sample-cameraprovider"]
 	path = plugins/sample-cameraprovider
 	url = ../../koush/scrypted-sample-cameraprovider
@@ -35,6 +20,3 @@
 [submodule "plugins/wyze/docker-wyze-bridge"]
 	path = plugins/wyze/docker-wyze-bridge
 	url = ../../koush/docker-wyze-bridge.git
-[submodule "plugins/onvif/onvif"]
-	path = plugins/onvif/onvif
-	url = ../../koush/onvif.git

common/fs/@types/sdk/settings-mixin.d.ts

@@ -0,0 +1 @@
+../../../../sdk/dist/src/settings-mixin.d.ts

common/fs/@types/sdk/storage-settings.d.ts

@@ -0,0 +1 @@
+../../../../sdk/dist/src/storage-settings.d.ts

common/package.json

@@ -12,12 +12,13 @@
   "license": "ISC",
   "dependencies": {
     "@scrypted/sdk": "file:../sdk",
-    "@scrypted/server": "file:../server",
+    "@scrypted/types": "^0.5.27",
     "http-auth-utils": "^5.0.1",
-    "typescript": "^5.3.3"
+    "typescript": "^5.5.3"
   },
   "devDependencies": {
     "@types/node": "^20.11.0",
+    "monaco-editor": "^0.50.0",
     "ts-node": "^10.9.2"
   }
 }

common/src/activity-timeout.ts

@@ -0,0 +1,28 @@
+export function createActivityTimeout(timeout: number, timeoutCallback: () => void) {
+    let dataTimeout: NodeJS.Timeout;
+
+    let lastTime = Date.now();
+    function resetActivityTimer() {
+        lastTime = Date.now();
+    }
+
+    function clearActivityTimer() {
+        clearInterval(dataTimeout);
+    }
+
+    if (timeout) {
+        dataTimeout = setInterval(() => {
+            if (Date.now() > lastTime + timeout) {
+                clearInterval(dataTimeout);
+                dataTimeout = undefined;
+                timeoutCallback();
+            }
+        }, timeout);
+    }
+
+    resetActivityTimer();
+    return {
+        resetActivityTimer,
+        clearActivityTimer,
+    }
+}

common/src/async-queue.ts

@@ -40,7 +40,7 @@ export function createAsyncQueue<T>() {
             return false;
 
         if (waiting.length) {
-            const deferred = waiting.shift();
+            const deferred = waiting.shift()!;
             dequeued?.resolve();
             deferred.resolve(item);
             return true;
@@ -66,7 +66,7 @@ export function createAsyncQueue<T>() {
             dequeued?.reject(new Error('abort'));
         };
 
-        dequeued.promise.catch(() => {}).finally(() => signal.removeEventListener('abort', h));
+        dequeued?.promise.catch(() => {}).finally(() => signal.removeEventListener('abort', h));
         signal.addEventListener('abort', h);
 
         return true;
@@ -79,7 +79,7 @@ export function createAsyncQueue<T>() {
         ended = e || new EndError();
         endDeferred.resolve();
         while (waiting.length) {
-            waiting.shift().reject(ended);
+            waiting.shift()!.reject(ended);
         }
         return true;
     }
@@ -94,7 +94,7 @@ export function createAsyncQueue<T>() {
                     }
                     catch (e) {
                         // the yield above may raise an error, and the queue should be ended.
-                        end(e);
+                        end(e as Error);
                         if (e instanceof EndError)
                             return;
                         throw e;
@@ -123,6 +123,9 @@ export function createAsyncQueue<T>() {
     }
 
     return {
+        [Symbol.dispose]() {
+            end(new Error('async queue disposed'));
+        },
         get ended() {
             return ended;
         },
@@ -155,6 +158,23 @@ export function createAsyncQueue<T>() {
     }
 }
 
+export function createAsyncQueueFromGenerator<T>(generator: AsyncGenerator<T>) {
+    const q = createAsyncQueue<T>();
+    (async() => {
+        try {
+            for await (const i of generator) {
+                await q.enqueue(i);
+            }
+        }
+        catch (e) {
+            q.end(e as Error);
+        }
+        q.end();
+    })();
+
+    return q;
+}
+
 // async function testSlowEnqueue() {
 //     const asyncQueue = createAsyncQueue<number>();
 

common/src/autoconfigure-codecs.ts

@@ -0,0 +1,209 @@
+import sdk, { AudioStreamOptions, MediaStreamConfiguration, MediaStreamDestination, MediaStreamOptions, ScryptedDeviceBase, Setting } from "@scrypted/sdk";
+
+export const automaticallyConfigureSettings: Setting = {
+    key: 'autoconfigure',
+    title: 'Automatically Configure Settings',
+    description: 'Automatically configure and valdiate the camera codecs and other settings for optimal Scrypted performance. Some settings will require manual configuration via the camera web admin.',
+    type: 'boolean',
+    value: true,
+};
+
+export const onvifAutoConfigureSettings: Setting = {
+    key: 'onvif-autoconfigure',
+    type: 'html',
+    value: 'ONVIF autoconfiguration will configure the camera codecs. <b>The camera motion sensor must still be <a target="_blank" href="https://docs.scrypted.app/camera-preparation.html#motion-sensor-setup">configured manually</a>.</b>',
+};
+
+const MEGABIT = 1024 * 1000;
+
+function getBitrateForResolution(resolution: number) {
+    if (resolution >= 3840 * 2160)
+        return 8 * MEGABIT;
+    if (resolution >= 2688 * 1520)
+        return 3 * MEGABIT;
+    if (resolution >= 1920 * 1080)
+        return 2 * MEGABIT;
+    if (resolution >= 1280 * 720)
+        return MEGABIT;
+    if (resolution >= 640 * 480)
+        return MEGABIT / 2;
+    return MEGABIT / 4;
+}
+
+export async function checkPluginNeedsAutoConfigure(plugin: ScryptedDeviceBase, extraDevices = 0) {
+    if (plugin.storage.getItem('autoconfigure') === 'true')
+        return;
+
+    plugin.storage.setItem('autoconfigure', 'true');
+    if (sdk.deviceManager.getNativeIds().length <= 1 + extraDevices)
+        return;
+    plugin.log.a(`${plugin.name} now has support for automatic camera configuration for optimal performance. Cameras can be autoconfigured in their respective settings.`);
+}
+
+export async function autoconfigureCodecs(
+    getCodecs: () => Promise<MediaStreamOptions[]>,
+    configureCodecs: (options: MediaStreamOptions) => Promise<MediaStreamConfiguration>,
+    audioOptions?: AudioStreamOptions,
+) {
+    audioOptions ||= {
+        codec: 'pcm_mulaw',
+        bitrate: 64000,
+        sampleRate: 8000,
+    };
+
+    const codecs = await getCodecs();
+    const configurable: MediaStreamConfiguration[] = [];
+    for (const codec of codecs) {
+        const config = await configureCodecs({
+            id: codec.id,
+        });
+        configurable.push(config);
+    }
+
+    const used: MediaStreamConfiguration[] = [];
+
+    for (const _ of ['local', 'remote', 'low-resolution'] as MediaStreamDestination[]) {
+        // find stream with the highest configurable resolution.
+        let highest: [MediaStreamConfiguration, number] = [undefined, 0];
+        for (const codec of configurable) {
+            if (used.includes(codec))
+                continue;
+            for (const resolution of codec.video.resolutions) {
+                if (resolution[0] * resolution[1] > highest[1]) {
+                    highest = [codec, resolution[0] * resolution[1]];
+                }
+            }
+        }
+
+        const config = highest[0];
+        if (!config)
+            break;
+
+        used.push(config);
+    }
+
+    const findResolutionTarget = (config: MediaStreamConfiguration, width: number, height: number) => {
+        let diff = 999999999;
+        let ret: [number, number];
+
+        const targetArea = width * height;
+        for (const res of config.video.resolutions) {
+            const actualArea = res[0] * res[1];
+            const diffArea = Math.abs(targetArea - actualArea);            
+            if (diffArea < diff) {
+                diff = diffArea;
+                ret = res;
+            }
+        }
+
+        return ret;
+    }
+
+    // find the highest resolution
+    const l = used[0];
+    const resolution = findResolutionTarget(l, 8192, 8192);
+
+    // get the fps of 20 or highest available
+    let fps = Math.min(20, Math.max(...l.video.fpsRange));
+
+    let errors = '';
+
+    const logConfigureCodecs = async (config: MediaStreamConfiguration) => {
+        try {
+            await configureCodecs(config);
+        }
+        catch (e) {
+            errors += e;
+        }
+    }
+
+    await logConfigureCodecs({
+        id: l.id,
+        video: {
+            width: resolution[0],
+            height: resolution[1],
+            bitrateControl: 'variable',
+            codec: 'h264',
+            bitrate: getBitrateForResolution(resolution[0] * resolution[1]),
+            fps,
+            keyframeInterval: fps * 4,
+            quality: 5,
+            profile: 'main',
+        },
+        audio: audioOptions,
+    });
+
+    if (used.length === 3) {
+        // find remote and low
+        const r = used[1];
+        const l = used[2];
+
+        const rResolution = findResolutionTarget(r, 1280, 720);
+        const lResolution = findResolutionTarget(l, 640, 360);
+
+        fps = Math.min(20, Math.max(...r.video.fpsRange));
+        await logConfigureCodecs({
+            id: r.id,
+            video: {
+                width: rResolution[0],
+                height: rResolution[1],
+                bitrateControl: 'variable',
+                codec: 'h264',
+                bitrate: 1 * MEGABIT,
+                fps,
+                keyframeInterval: fps * 4,
+                quality: 5,
+                profile: 'main',
+            },
+            audio: audioOptions,
+        });
+
+        fps = Math.min(20, Math.max(...l.video.fpsRange));
+        await logConfigureCodecs({
+            id: l.id,
+            video: {
+                width: lResolution[0],
+                height: lResolution[1],
+                bitrateControl: 'variable',
+                codec: 'h264',
+                bitrate: MEGABIT / 2,
+                fps,
+                keyframeInterval: fps * 4,
+                quality: 5,
+                profile: 'main',
+            },
+            audio: audioOptions,
+        });
+    }
+    else if (used.length == 2) {
+        let target: [number, number];
+        if (resolution[0] * resolution[1] > 1920 * 1080)
+            target = [1280, 720];
+        else
+            target = [640, 360];
+
+        const rResolution = findResolutionTarget(used[1], target[0], target[1]);
+        const fps = Math.min(20, Math.max(...used[1].video.fpsRange));
+        await logConfigureCodecs({
+            id: used[1].id,
+            video: {
+                width: rResolution[0],
+                height: rResolution[1],
+                bitrateControl: 'variable',
+                codec: 'h264',
+                bitrate: getBitrateForResolution(rResolution[0] * rResolution[1]),
+                fps,
+                keyframeInterval: fps * 4,
+                quality: 5,
+                profile: 'main',
+            },
+            audio: audioOptions,
+        });
+    }
+    else if (used.length === 1) {
+        // no nop
+    }
+
+    if (errors)
+        throw new Error(errors);
+}

common/src/autoenable-mixin-provider.ts

@@ -7,7 +7,6 @@ const { systemManager } = sdk;
 export abstract class AutoenableMixinProvider extends ScryptedDeviceBase {
     hasEnabledMixin: { [id: string]: string } = {};
     pluginsComponent: Promise<any>;
-    unshiftMixin = false;
 
     constructor(nativeId?: string, public autoIncludeToken = 'v4') {
         super(nativeId);
@@ -41,11 +40,19 @@ export abstract class AutoenableMixinProvider extends ScryptedDeviceBase {
         return true;
     }
 
+    checkHasEnabledMixin(device: ScryptedDevice) {
+        return this.hasEnabledMixin[device.id] === this.autoIncludeToken;
+    }
+
+    shouldUnshiftMixin(device: ScryptedDevice) {
+        return false;
+    }
+
     async maybeEnableMixin(device: ScryptedDevice) {
         if (!device || device.mixins?.includes(this.id))
             return;
 
-        if (this.hasEnabledMixin[device.id] === this.autoIncludeToken)
+        if (this.checkHasEnabledMixin(device))
             return;
 
         const match = await this.canMixin(device.type, device.interfaces);
@@ -57,7 +64,7 @@ export abstract class AutoenableMixinProvider extends ScryptedDeviceBase {
 
         this.log.i('auto enabling mixin for ' + device.name)
         const mixins = (device.mixins || []).slice();
-        if (this.unshiftMixin)
+        if (this.shouldUnshiftMixin(device))
             mixins.unshift(this.id);
         else
             mixins.push(this.id);
@@ -73,5 +80,5 @@ export abstract class AutoenableMixinProvider extends ScryptedDeviceBase {
         this.storage.setItem('hasEnabledMixin', JSON.stringify(this.hasEnabledMixin));
     }
 
-    abstract canMixin(type: ScryptedDeviceType, interfaces: string[]): Promise<string[]>;
+    abstract canMixin(type: ScryptedDeviceType | string, interfaces: string[]): Promise<string[] | null | undefined | void>;
 }

common/src/deferred.ts

@@ -1,17 +0,0 @@
-export class Deferred<T> {
-    finished = false;
-    resolve!: (value: T|PromiseLike<T>) => this;
-    reject!: (error: Error) => this;
-    promise: Promise<T> = new Promise((resolve, reject) => {
-        this.resolve = v => {
-            this.finished = true;
-            resolve(v);
-            return this;
-        };
-        this.reject = e => {
-            this.finished = true;
-            reject(e);
-            return this;
-        };
-    });
-}

common/src/deferred.ts

@@ -0,0 +1 @@
+../../server/src/deferred.ts

common/src/devices.ts

@@ -0,0 +1,5 @@
+import type { SystemManager } from '@scrypted/types';
+
+export function getAllDevices<T>(systemManager: SystemManager) {
+    return Object.keys(systemManager.getSystemState()).map(id => systemManager.getDeviceById<T>(id));
+}

common/src/eval/monaco-libs.ts

@@ -0,0 +1,96 @@
+import type * as monacoEditor from 'monaco-editor';
+
+export interface StandardLibs {
+    '@types/node/globals.d.ts': string,
+    '@types/node/buffer.d.ts': string,
+    '@types/node/process.d.ts': string,
+    '@types/node/events.d.ts': string,
+    '@types/node/stream.d.ts': string,
+    '@types/node/fs.d.ts': string,
+    '@types/node/net.d.ts': string,
+    '@types/node/child_process.d.ts': string,
+}
+
+export interface ScryptedLibs {
+    '@types/sdk/settings-mixin.d.ts': string,
+    '@types/sdk/storage-settings.d.ts': string,
+    '@types/sdk/types.d.ts': string,
+    '@types/sdk/index.d.ts': string,
+}
+
+export function createMonacoEvalDefaultsWithLibs(standardLibs: StandardLibs, scryptedLibs: ScryptedLibs, extraLibs: { [lib: string]: string }) {
+    // const libs = Object.assign(scryptedLibs, extraLibs);
+
+    function monacoEvalDefaultsFunction(monaco: typeof monacoEditor, standardLibs: StandardLibs, scryptedLibs: ScryptedLibs, extraLibs: { [lib: string]: string }) {
+        monaco.languages.typescript.typescriptDefaults.setDiagnosticsOptions(
+            Object.assign(
+                {},
+                monaco.languages.typescript.typescriptDefaults.getDiagnosticsOptions(),
+                {
+                    diagnosticCodesToIgnore: [1108, 1375, 1378],
+                }
+            )
+        );
+
+        monaco.languages.typescript.typescriptDefaults.setCompilerOptions(
+            Object.assign(
+                {},
+                monaco.languages.typescript.typescriptDefaults.getCompilerOptions(),
+                {
+                    moduleResolution:
+                        monaco.languages.typescript.ModuleResolutionKind.NodeJs,
+                }
+            )
+        );
+
+        const libs: any = {
+            ...scryptedLibs,
+            ...extraLibs,
+        };
+
+        const catLibs = Object.values(libs).join('\n');
+        const catlibsNoExport = Object.keys(libs)
+            .map(lib => libs[lib]).map(lib =>
+                lib.toString().replace(/export /g, '').replace(/import.*?/g, ''))
+            .join('\n');
+        monaco.languages.typescript.typescriptDefaults.addExtraLib(`
+        ${catLibs}
+
+        declare global {
+            ${catlibsNoExport}
+
+            const log: Logger;
+
+            const deviceManager: DeviceManager;
+            const endpointManager: EndpointManager;
+            const mediaManager: MediaManager;
+            const systemManager: SystemManager;
+
+            const eventSource: ScryptedDevice;
+            const eventDetails: EventDetails;
+            const eventData: any;
+        }
+        `,
+
+            "node_modules/@types/scrypted__sdk/types/index.d.ts"
+        );
+
+        for (const lib of Object.keys(standardLibs)) {
+            monaco.languages.typescript.typescriptDefaults.addExtraLib(
+                standardLibs[lib as keyof StandardLibs],
+                lib,
+            );
+        }
+    }
+
+    return `(function() {
+    const standardLibs = ${JSON.stringify(standardLibs)};
+    const scryptedLibs = ${JSON.stringify(scryptedLibs)};
+    const extraLibs = ${JSON.stringify(extraLibs)};
+
+    return (monaco) => {
+        (${monacoEvalDefaultsFunction})(monaco, standardLibs, scryptedLibs, extraLibs);
+    }
+    })();
+    `;
+}

common/src/eval/monaco/script-device.ts

@@ -1,3 +1,5 @@
+import type { ScryptedDeviceBase } from "@scrypted/sdk";
+
 export interface ScriptDevice {
     /**
      * @deprecated Use the default export to specify the device handler.
@@ -6,3 +8,5 @@ export interface ScriptDevice {
     handle<T>(handler?: T & object): void;
     handleTypes(...interfaces: string[]): void;
 }
+
+export declare const device: ScryptedDeviceBase & ScriptDevice;

common/src/eval/scrypted-eval.ts

@@ -1,7 +1,10 @@
-import sdk, { MixinDeviceBase, ScryptedDeviceBase, ScryptedDeviceType, ScryptedInterface, ScryptedInterfaceDescriptors } from "@scrypted/sdk";
+import sdk, { LockState, MixinDeviceBase, PanTiltZoomMovement, ScryptedDeviceBase, ScryptedDeviceType, ScryptedInterface, ScryptedInterfaceDescriptors, ScryptedMimeTypes } from "@scrypted/sdk";
+import { SettingsMixinDeviceBase } from "@scrypted/sdk/settings-mixin";
+import { StorageSettings } from "@scrypted/sdk/storage-settings";
 import fs from 'fs';
 import type { TranspileOptions } from "typescript";
 import vm from "vm";
+import { createMonacoEvalDefaultsWithLibs, ScryptedLibs, StandardLibs } from "./monaco-libs";
 import { ScriptDevice } from "./monaco/script-device";
 
 const { systemManager, deviceManager, mediaManager, endpointManager } = sdk;
@@ -22,18 +25,22 @@ export async function tsCompile(source: string, options: TranspileOptions = null
     return ts.transpileModule(source, options).outputText;
 }
 
-function getTypeDefs() {
-    const scryptedTypesDefs = fs.readFileSync('@types/sdk/types.d.ts').toString();
-    const scryptedIndexDefs = fs.readFileSync('@types/sdk/index.d.ts').toString();
+export function readFileAsString(f: string) {
+    return fs.readFileSync(f).toString();;
+}
+
+function getScryptedLibs(): ScryptedLibs {
     return {
-        scryptedIndexDefs,
-        scryptedTypesDefs,
-    };
+        "@types/sdk/index.d.ts": readFileAsString('@types/sdk/index.d.ts'),
+        "@types/sdk/settings-mixin.d.ts": readFileAsString('@types/sdk/settings-mixin.d.ts'),
+        "@types/sdk/storage-settings.d.ts": readFileAsString('@types/sdk/storage-settings.d.ts'),
+        "@types/sdk/types.d.ts": readFileAsString('@types/sdk/types.d.ts'),
+    }
 }
 
 export async function scryptedEval(device: ScryptedDeviceBase, script: string, extraLibs: { [lib: string]: string }, params: { [name: string]: any }) {
     const libs = Object.assign({
-        types: getTypeDefs().scryptedTypesDefs,
+        types: getScryptedLibs()['@types/sdk/types.d.ts'],
     }, extraLibs);
     const allScripts = Object.values(libs).join('\n').toString() + script;
     let compiled: string;
@@ -56,9 +63,9 @@ export async function scryptedEval(device: ScryptedDeviceBase, script: string, e
 
     const allParams = Object.assign({}, params, {
         sdk,
-        fs: require('realfs'),
         ScryptedDeviceBase,
         MixinDeviceBase,
+        StorageSettings,
         systemManager,
         deviceManager,
         endpointManager,
@@ -68,6 +75,9 @@ export async function scryptedEval(device: ScryptedDeviceBase, script: string, e
         localStorage: device.storage,
         device,
         exports: {} as any,
+        PanTiltZoomMovement,
+        SettingsMixinDeviceBase,
+        ScryptedMimeTypes,
         ScryptedInterface,
         ScryptedDeviceType,
         // @ts-expect-error
@@ -104,81 +114,18 @@ export async function scryptedEval(device: ScryptedDeviceBase, script: string, e
 }
 
 export function createMonacoEvalDefaults(extraLibs: { [lib: string]: string }) {
-    const bufferTypeDefs = fs.readFileSync('@types/node/buffer.d.ts').toString();
-
-    const safeLibs = {
-        bufferTypeDefs,
+    const standardlibs: StandardLibs = {
+        "@types/node/globals.d.ts": readFileAsString('@types/node/globals.d.ts'),
+        "@types/node/buffer.d.ts": readFileAsString('@types/node/buffer.d.ts'),
+        "@types/node/process.d.ts": readFileAsString('@types/node/process.d.ts'),
+        "@types/node/events.d.ts": readFileAsString('@types/node/events.d.ts'),
+        "@types/node/stream.d.ts": readFileAsString('@types/node/stream.d.ts'),
+        "@types/node/fs.d.ts": readFileAsString('@types/node/fs.d.ts'),
+        "@types/node/net.d.ts": readFileAsString('@types/node/net.d.ts'),
+        "@types/node/child_process.d.ts": readFileAsString('@types/node/child_process.d.ts'),
     };
 
-    const libs = Object.assign(getTypeDefs(), extraLibs);
-
-    function monacoEvalDefaultsFunction(monaco: any, safeLibs: any, libs: any) {
-        monaco.languages.typescript.typescriptDefaults.setDiagnosticsOptions(
-            Object.assign(
-                {},
-                monaco.languages.typescript.typescriptDefaults.getDiagnosticsOptions(),
-                {
-                    diagnosticCodesToIgnore: [1108, 1375, 1378],
-                }
-            )
-        );
-
-        monaco.languages.typescript.typescriptDefaults.setCompilerOptions(
-            Object.assign(
-                {},
-                monaco.languages.typescript.typescriptDefaults.getCompilerOptions(),
-                {
-                    moduleResolution:
-                        monaco.languages.typescript.ModuleResolutionKind.NodeJs,
-                }
-            )
-        );
-
-        const catLibs = Object.values(libs).join('\n');
-        const catlibsNoExport = Object.keys(libs).filter(lib => lib !== 'sdk')
-            .map(lib => libs[lib]).map(lib =>
-                lib.toString().replace(/export /g, '').replace(/import.*?/g, ''))
-            .join('\n');
-        monaco.languages.typescript.typescriptDefaults.addExtraLib(`
-        ${catLibs}
-
-        declare global {
-            ${catlibsNoExport}
-
-            const log: Logger;
-
-            const deviceManager: DeviceManager;
-            const endpointManager: EndpointManager;
-            const mediaManager: MediaManager;
-            const systemManager: SystemManager;
-            const mqtt: MqttClient;
-            const device: ScryptedDeviceBase & { pathname : string };
-        }
-        `,
-
-            "node_modules/@types/scrypted__sdk/types/index.d.ts"
-        );
-
-        monaco.languages.typescript.typescriptDefaults.addExtraLib(
-            libs['sdk'],
-            "node_modules/@types/scrypted__sdk/index.d.ts"
-        );
-
-        monaco.languages.typescript.typescriptDefaults.addExtraLib(
-            safeLibs.bufferTypeDefs,
-            "node_modules/@types/node/buffer.d.ts"
-        );
-    }
-
-    return `(function() {
-    const safeLibs = ${JSON.stringify(safeLibs)};
-    const libs = ${JSON.stringify(libs)};
-
-    return (monaco) => {
-        (${monacoEvalDefaultsFunction})(monaco, safeLibs, libs);
-    }
-    })();
-    `;
+    return createMonacoEvalDefaultsWithLibs(standardlibs, getScryptedLibs(), extraLibs);
 }
 
 export interface ScriptDeviceImpl extends ScriptDevice {

common/src/ffmpeg-hardware-acceleration.ts

@@ -19,7 +19,7 @@ function isPi(model: string) {
 export function isRaspberryPi() {
     let cpuInfo: string;
     try {
-        cpuInfo = require('realfs').readFileSync('/proc/cpuinfo', { encoding: 'utf8' });
+        cpuInfo = require('fs').readFileSync('/proc/cpuinfo', { encoding: 'utf8' });
     }
     catch (e) {
         // if this fails, this is probably not a pi
@@ -70,11 +70,7 @@ export function getH264DecoderArgs(): CodecArgs {
         ],
     };
 
-    if (isRaspberryPi()) {
-        ret['Raspberry Pi'] = ['-c:v', 'h264_mmal'];
-        ret[V4L2] = ['-c:v', 'h264_v4l2m2m'];
-    }
-    else if (os.platform() === 'linux') {
+    if (os.platform() === 'linux') {
         ret[V4L2] = ['-c:v', 'h264_v4l2m2m'];
     }
     else if (os.platform() === 'win32') {

common/src/json.ts

@@ -0,0 +1,8 @@
+
+export function safeParseJson(value: string) {
+    try {
+        return JSON.parse(value);
+    }
+    catch (e) {
+    }
+}

common/src/listen-cluster.ts

@@ -79,4 +79,4 @@ export async function bind(server: dgram.Socket, port: number) {
     }
 }
 
-export { ListenZeroSingleClientTimeoutError, listenZero, listenZeroSingleClient } from "@scrypted/server/src/listen-zero";
+export { ListenZeroSingleClientTimeoutError, listenZero, listenZeroSingleClient } from "../../server/src/listen-zero";

common/src/media-helpers.ts

@@ -1 +1 @@
-export * from '@scrypted/server/src/media-helpers';
+export { safeKillFFmpeg, ffmpegLogInitialOutput, safePrintFFmpegArguments } from '../../server/src/media-helpers';

common/src/promise-utils.ts

@@ -1,96 +0,0 @@
-export interface RefreshPromise<T> {
-    promise: Promise<T>;
-    cacheDuration: number;
-}
-
-export function singletonPromise<T>(rp: undefined | RefreshPromise<T>, method: () => Promise<T>, cacheDuration = 0) {
-    if (rp?.promise)
-        return rp;
-
-    const promise = method();
-    if (!rp) {
-        rp = {
-            promise,
-            cacheDuration,
-        }
-    }
-    else {
-        rp.promise = promise;
-    }
-    promise.finally(() => setTimeout(() => rp.promise = undefined, rp.cacheDuration));
-    return rp;
-}
-
-export class TimeoutError<T> extends Error {
-    constructor(public promise: Promise<T>) {
-        super('Operation Timed Out');
-    }
-}
-
-export function timeoutPromise<T>(timeout: number, promise: Promise<T>): Promise<T> {
-    return new Promise<T>((resolve, reject) => {
-        const t = setTimeout(() => reject(new TimeoutError(promise)), timeout);
-
-        promise
-            .then(v => {
-                clearTimeout(t);
-                resolve(v);
-            })
-            .catch(e => {
-                clearTimeout(t);
-                reject(e);
-            });
-    })
-}
-
-export function timeoutFunction<T>(timeout: number, f: (isTimedOut: () => boolean) => Promise<T>): Promise<T> {
-    return new Promise<T>((resolve, reject) => {
-        let isTimedOut = false;
-        const promise = f(() => isTimedOut);
-
-        const t = setTimeout(() => {
-            isTimedOut = true;
-            reject(new TimeoutError(promise));
-        }, timeout);
-
-        promise
-            .then(v => {
-                clearTimeout(t);
-                resolve(v);
-            })
-            .catch(e => {
-                clearTimeout(t);
-                reject(e);
-            });
-    })
-}
-
-export function createPromiseDebouncer<T>() {
-    let current: Promise<T>;
-
-    return (func: () => Promise<T>): Promise<T> => {
-        if (!current)
-            current = func().finally(() => current = undefined);
-        return current;
-    }
-}
-
-export function createMapPromiseDebouncer<T>() {
-    const map = new Map<string, Promise<T>>();
-
-    return (key: any, debounce: number, func: () => Promise<T>): Promise<T> => {
-        const keyStr = JSON.stringify(key);
-        let value = map.get(keyStr);
-        if (!value) {
-            value = func().finally(() => {
-                if (!debounce) {
-                    map.delete(keyStr);
-                    return;
-                }
-                setTimeout(() => map.delete(keyStr), debounce);
-            });
-            map.set(keyStr, value);
-        }
-        return value;
-    }
-}

common/src/promise-utils.ts

@@ -0,0 +1 @@
+../../server/src/promise-utils.ts

common/src/read-stream.ts

@@ -54,18 +54,18 @@ export async function read16BELengthLoop(readable: Readable, options: {
   readable.on('readable', read);
 
   await once(readable, 'end');
-  throw new Error('stream ended');
+  throw new StreamEndError('read16BELengthLoop');
 }
 
 export class StreamEndError extends Error {
-  constructor() {
-    super('stream ended');
+  constructor(where: string) {
+    super(`stream ended: ${where}`);
   }
 }
 
 export async function readLength(readable: Readable, length: number): Promise<Buffer> {
   if (readable.readableEnded || readable.destroyed)
-    throw new StreamEndError();
+    throw new StreamEndError('readLength start');
 
   if (!length) {
     return Buffer.alloc(0);
@@ -88,12 +88,12 @@ export async function readLength(readable: Readable, length: number): Promise<Bu
       }
 
       if (readable.readableEnded || readable.destroyed)
-        reject(new Error("stream ended during read"));
+        reject(new StreamEndError('readLength readable'));
     };
 
     const e = () => {
       cleanup();
-      reject(new StreamEndError())
+      reject(new StreamEndError('readLength end'));
     };
 
     const cleanup = () => {
@@ -136,12 +136,17 @@ export async function readLine(readable: Readable) {
 }
 
 export async function readString(readable: Readable | Promise<Readable>) {
-  let data = '';
+  const buffer = await readBuffer(readable);
+  return buffer.toString();
+}
+
+export async function readBuffer(readable: Readable | Promise<Readable>) {
+  const buffers: Buffer[] = [];
   readable = await readable;
   readable.on('data', buffer => {
-    data += buffer.toString();
+    buffers.push(buffer);
   });
   readable.resume();
   await once(readable, 'end')
-  return data;
+  return Buffer.concat(buffers);
 }

common/src/rtc-connect.ts

@@ -1,5 +1,5 @@
-import { RpcPeer } from "@scrypted/server/src/rpc";
-import { createRpcSerializer } from "@scrypted/server/src/rpc-serializer";
+import { RpcPeer } from "../../server/src/rpc";
+import { createRpcSerializer } from "../../server/src/rpc-serializer";
 import type { RTCSignalingSession } from "@scrypted/sdk";
 
 export async function createBrowserSignalingSession(ws: WebSocket, localName: string, remoteName: string) {

common/src/rtc-signaling.ts

@@ -41,15 +41,15 @@ export function isPeerConnectionClosed(pc: RTCPeerConnection) {
         || pc.iceConnectionState === 'closed';
 }
 
-function silence() {
-    let ctx = new AudioContext(), oscillator = ctx.createOscillator();
-    const dest = ctx.createMediaStreamDestination();
-    oscillator.connect(dest);
-    oscillator.start();
-    const ret = dest.stream.getAudioTracks()[0];
-    ret.enabled = false;
-    return ret;
-}
+// function silence() {
+//     let ctx = new AudioContext(), oscillator = ctx.createOscillator();
+//     const dest = ctx.createMediaStreamDestination();
+//     oscillator.connect(dest);
+//     oscillator.start();
+//     const ret = dest.stream.getAudioTracks()[0];
+//     ret.enabled = false;
+//     return ret;
+// }
 
 function createOptions() {
     const options: RTCSignalingOptions = {
@@ -223,7 +223,12 @@ export class BrowserSignalingSession implements RTCSignalingSession {
         }
 
         if (type === 'offer') {
-            let offer = await this.pc.createOffer({
+            let offer: RTCSessionDescriptionInit = this.pc.localDescription;
+            if (offer) {
+                // fast path for duplicate calls to createLocalDescription
+                return toDescription(this.pc.localDescription);
+            }
+            offer = await this.pc.createOffer({
                 offerToReceiveAudio: !!setup.audio,
                 offerToReceiveVideo: !!setup.video,
             });
@@ -232,7 +237,7 @@ export class BrowserSignalingSession implements RTCSignalingSession {
                 return toDescription(offer);
             await set;
             await gatheringPromise;
-            offer = await this.pc.createOffer({
+            offer = this.pc.localDescription || await this.pc.createOffer({
                 offerToReceiveAudio: !!setup.audio,
                 offerToReceiveVideo: !!setup.video,
             });

common/src/rtsp-server.ts

@@ -89,27 +89,51 @@ export const H264_NAL_TYPE_FU_B = 29;
 export const H264_NAL_TYPE_MTAP16 = 26;
 export const H264_NAL_TYPE_MTAP32 = 27;
 
+export const H265_NAL_TYPE_AGG = 48;
+export const H265_NAL_TYPE_VPS = 32;
+export const H265_NAL_TYPE_SPS = 33;
+export const H265_NAL_TYPE_PPS = 34;
+export const H265_NAL_TYPE_BLA_W_LP = 16;
+export const H265_NAL_TYPE_BLA_W_RADL = 17;
+export const H265_NAL_TYPE_BLA_N_LP = 18;
+export const H265_NAL_TYPE_IDR_W_RADL = 19;
+export const H265_NAL_TYPE_IDR_N_LP = 20;
+export const H265_NAL_TYPE_CRA_NUT = 21;
+export const H265_NAL_TYPE_FU = 49;
+export const H265_NAL_TYPE_SEI_PREFIX = 39;
+export const H265_NAL_TYPE_SEI_SUFFIX = 40;
+
 export function findH264NaluType(streamChunk: StreamChunk, naluType: number) {
     if (streamChunk.type !== 'h264')
         return;
     return findH264NaluTypeInNalu(streamChunk.chunks[streamChunk.chunks.length - 1].subarray(12), naluType);
 }
 
+export function findH265NaluType(streamChunk: StreamChunk, naluType: number) {
+    if (streamChunk.type !== 'h265')
+        return;
+    return findH265NaluTypeInNalu(streamChunk.chunks[streamChunk.chunks.length - 1].subarray(12), naluType);
+}
+
+export function parseH264NaluType(firstNaluByte: number) {
+    return firstNaluByte & 0x1f;
+}
+
 export function findH264NaluTypeInNalu(nalu: Buffer, naluType: number) {
-    const checkNaluType = nalu[0] & 0x1f;
+    const checkNaluType = parseH264NaluType(nalu[0]);
     if (checkNaluType === H264_NAL_TYPE_STAP_A) {
         let pos = 1;
         while (pos < nalu.length) {
             const naluLength = nalu.readUInt16BE(pos);
             pos += 2;
-            const stapaType = nalu[pos] & 0x1f;
+            const stapaType = parseH264NaluType(nalu[pos]);
             if (stapaType === naluType)
                 return nalu.subarray(pos, pos + naluLength);
             pos += naluLength;
         }
     }
     else if (checkNaluType === H264_NAL_TYPE_FU_A) {
-        const fuaType = nalu[1] & 0x1f;
+        const fuaType = parseH264NaluType(nalu[1]);
         const isFuStart = !!(nalu[1] & 0x80);
 
         if (fuaType === naluType && isFuStart)
@@ -121,39 +145,52 @@ export function findH264NaluTypeInNalu(nalu: Buffer, naluType: number) {
     return;
 }
 
-export function getNaluTypes(streamChunk: StreamChunk) {
-    if (streamChunk.type !== 'h264')
-        return new Set<number>();
-    return getNaluTypesInNalu(streamChunk.chunks[streamChunk.chunks.length - 1].subarray(12))
+function parseH265NaluType(firstNaluByte: number) {
+    return (firstNaluByte & 0b01111110) >> 1;
 }
 
-export function getNaluFragmentInformation(nalu: Buffer) {
-    const naluType = nalu[0] & 0x1f;
-    const fua = naluType === H264_NAL_TYPE_FU_A;
-    return {
-        fua,
-        fuaStart: fua && !!(nalu[1] & 0x80),
-        fuaEnd: fua && !!(nalu[1] & 0x40),
+export function findH265NaluTypeInNalu(nalu: Buffer, naluType: number) {
+    const checkNaluType = parseH265NaluType(nalu[0]);
+    if (checkNaluType === H265_NAL_TYPE_AGG) {
+        let pos = 1;
+        while (pos < nalu.length) {
+            const naluLength = nalu.readUInt16BE(pos);
+            pos += 2;
+            const stapaType = parseH265NaluType(nalu[pos]);
+            if (stapaType === naluType)
+                return nalu.subarray(pos, pos + naluLength);
+            pos += naluLength;
+        }
     }
+    else if (checkNaluType === naluType) {
+        return nalu;
+    }
+    return;
+}
+
+export function getStartedH264NaluTypes(streamChunk: StreamChunk) {
+    if (streamChunk.type !== 'h264')
+        return new Set<number>();
+    return getNaluTypesInNalu(streamChunk.chunks[streamChunk.chunks.length - 1].subarray(12), true)
 }
 
 export function getNaluTypesInNalu(nalu: Buffer, fuaRequireStart = false, fuaRequireEnd = false) {
     const ret = new Set<number>();
-    const naluType = nalu[0] & 0x1f;
+    const naluType = parseH264NaluType(nalu[0]);
     if (naluType === H264_NAL_TYPE_STAP_A) {
         ret.add(H264_NAL_TYPE_STAP_A);
         let pos = 1;
         while (pos < nalu.length) {
             const naluLength = nalu.readUInt16BE(pos);
             pos += 2;
-            const stapaType = nalu[pos] & 0x1f;
+            const stapaType = parseH264NaluType(nalu[pos]);
             ret.add(stapaType);
             pos += naluLength;
         }
     }
     else if (naluType === H264_NAL_TYPE_FU_A) {
         ret.add(H264_NAL_TYPE_FU_A);
-        const fuaType = nalu[1] & 0x1f;
+        const fuaType = parseH264NaluType(nalu[1]);
         if (fuaRequireStart) {
             const isFuStart = !!(nalu[1] & 0x80);
             if (isFuStart)
@@ -175,6 +212,70 @@ export function getNaluTypesInNalu(nalu: Buffer, fuaRequireStart = false, fuaReq
     return ret;
 }
 
+export function getStartedH265NaluTypes(streamChunk: StreamChunk) {
+    if (streamChunk.type !== 'h265')
+        return new Set<number>();
+    return getNaluTypesInH265Nalu(streamChunk.chunks[streamChunk.chunks.length - 1].subarray(12), true)
+}
+
+export function getNaluTypesInH265Nalu(nalu: Buffer, fuaRequireStart = false, fuaRequireEnd = false) {
+    const ret = new Set<number>();
+    const naluType = parseH265NaluType(nalu[0]);
+    if (naluType === H265_NAL_TYPE_AGG) {
+        ret.add(H265_NAL_TYPE_AGG);
+        let pos = 2;
+        while (pos < nalu.length) {
+            const naluLength = nalu.readUInt16BE(pos);
+            pos += 2;
+            const stapaType = parseH265NaluType(nalu[pos]);
+            ret.add(stapaType);
+            pos += naluLength;
+        }
+    }
+    else if (naluType === H265_NAL_TYPE_FU) {
+        ret.add(H265_NAL_TYPE_FU);
+        const fuaType = nalu[2] & 0x3F;  // 6 bits
+        if (fuaRequireStart) {
+            const isFuStart = !!(nalu[2] & 0x80);
+            if (isFuStart)
+                ret.add(fuaType);
+        }
+        else if (fuaRequireEnd) {
+            const isFuEnd = !!(nalu[2] & 0x40);
+            if (isFuEnd)
+                ret.add(fuaType);
+        }
+        else {
+            ret.add(fuaType);
+        }
+    }
+    else {
+        ret.add(naluType);
+    }
+
+    return ret;
+}
+
+export function isH265KeyFrameRelatedInSet(naluTypes: Set<number>, allowCodecInfo = true) {
+    if (naluTypes.has(H265_NAL_TYPE_IDR_N_LP)
+        || naluTypes.has(H265_NAL_TYPE_IDR_W_RADL)
+        || naluTypes.has(H265_NAL_TYPE_CRA_NUT)
+        || naluTypes.has(H265_NAL_TYPE_BLA_N_LP)
+        || naluTypes.has(H265_NAL_TYPE_BLA_W_LP)
+        || naluTypes.has(H265_NAL_TYPE_BLA_W_RADL)) {
+        return true;
+    }
+
+    if (allowCodecInfo) {
+        if (naluTypes.has(H265_NAL_TYPE_VPS)
+            || naluTypes.has(H265_NAL_TYPE_SPS)
+            || naluTypes.has(H265_NAL_TYPE_PPS))
+            return true;
+    }
+    return false;
+}
+
+
 export function createRtspParser(options?: StreamParserOptions): RtspStreamParser {
     let resolve: any;
 
@@ -190,17 +291,25 @@ export function createRtspParser(options?: StreamParserOptions): RtspStreamParse
             'tcp',
             ...(options?.vcodec || []),
             ...(options?.acodec || []),
+            // linux and windows seem to support 64000 but darwin is 32000?
+            '-pkt_size', '32000',
             '-f', 'rtsp',
         ],
         findSyncFrame(streamChunks: StreamChunk[]) {
             for (let prebufferIndex = 0; prebufferIndex < streamChunks.length; prebufferIndex++) {
                 const streamChunk = streamChunks[prebufferIndex];
-                if (streamChunk.type !== 'h264') {
-                    continue;
+                if (streamChunk.type === 'h264') {
+                    const naluTypes = getStartedH264NaluTypes(streamChunk);
+                    if (naluTypes.has(H264_NAL_TYPE_SPS) || naluTypes.has(H264_NAL_TYPE_IDR)) {
+                        return streamChunks.slice(prebufferIndex);
+                    }
                 }
+                else if (streamChunk.type === 'h265') {
+                    const naluTypes = getStartedH265NaluTypes(streamChunk);
 
-                if (findH264NaluType(streamChunk, H264_NAL_TYPE_SPS) || findH264NaluType(streamChunk, H264_NAL_TYPE_IDR)) {
-                    return streamChunks.slice(prebufferIndex);
+                    if (isH265KeyFrameRelatedInSet(naluTypes)) {
+                        return streamChunks.slice(prebufferIndex);
+                    }
                 }
             }
 
@@ -324,8 +433,9 @@ export class RtspClient extends RtspBase {
     setupOptions = new Map<number, RtspClientTcpSetupOptions>();
     issuedTeardown = false;
     hasGetParameter = true;
+    contentBase: string;
 
-    constructor(public url: string) {
+    constructor(public readonly url: string) {
         super();
         const u = new URL(url);
         const port = parseInt(u.port) || 554;
@@ -364,13 +474,18 @@ export class RtspClient extends RtspBase {
     async writeRequest(method: string, headers?: Headers, path?: string, body?: Buffer) {
         headers = headers || {};
 
-        let fullUrl = this.url;
-        if (path) {
+        let fullUrl: string;
+        if (!path) {
+            fullUrl = this.url;
+        }
+        else {
             // a=control may be a full or "relative" url.
-            if (path.includes('rtsp://') || path.includes('rtsps://')) {
+            if (path.includes('rtsp://') || path.includes('rtsps://') || path === '*') {
                 fullUrl = path;
             }
             else {
+                fullUrl = this.contentBase || this.url;
+
                 // strangely, relative RTSP urls do not behave like expected from an HTTP-ish server.
                 // ffmpeg will happily suffix path segments after query strings:
                 // SETUP rtsp://localhost:5554/cam/realmonitor?channel=1&subtype=0/trackID=0 RTSP/1.0
@@ -432,11 +547,47 @@ export class RtspClient extends RtspBase {
             }
         }
         catch (e) {
-            this.client.destroy(e);
+            this.client.destroy(e as Error);
             throw e;
         }
     }
 
+    async *handleStream(): AsyncGenerator<{
+        rtcp: boolean,
+        header: Buffer,
+        packet: Buffer,
+        channel: number,
+    }> {
+        while (true) {
+            const header = await readLength(this.client, 4);
+            // can this even happen? since the RTSP request method isn't a fixed
+            // value like the "RTSP" in the RTSP response, I don't think so?
+            if (header[0] !== RTSP_FRAME_MAGIC) {
+                if (header.toString() !== 'RTSP')
+                    throw this.createBadHeader(header);
+
+                this.client.unshift(header);
+
+                // do what with this?
+                const message = await super.readMessage();
+                const body = await this.readBody(parseHeaders(message));
+
+                continue;
+            }
+
+            const length = header.readUInt16BE(2);
+            const packet = await readLength(this.client, length);
+            const id = header.readUInt8(1);
+
+            yield {
+                channel: id,
+                rtcp: id % 2 === 1,
+                header,
+                packet,
+            }
+        }
+    }
+
     async readLoop() {
         const deferred = new Deferred<void>();
 
@@ -498,7 +649,8 @@ export class RtspClient extends RtspBase {
                 }
             }
             catch (e) {
-                deferred.reject(e);
+                if (!deferred.finished)
+                    deferred.reject(e as Error);
                 this.client.destroy();
             }
         };
@@ -534,10 +686,15 @@ export class RtspClient extends RtspBase {
             throw new Error('no WWW-Authenticate found');
 
         const { BASIC } = await import('http-auth-utils');
+        // @ts-ignore
         const { parseHTTPHeadersQuotedKeyValueSet } = await import('http-auth-utils/dist/utils');
 
+        const authedUrl = new URL(this.url);
+        const username = decodeURIComponent(authedUrl.username);
+        const password = decodeURIComponent(authedUrl.password);
+
         if (this.wwwAuthenticate.includes('Basic')) {
-            const hash = BASIC.computeHash(url);
+            const hash = BASIC.computeHash({ username, password });
             return `Basic ${hash}`;
         }
 
@@ -557,10 +714,6 @@ export class RtspClient extends RtspBase {
             REQUIRED_WWW_AUTHENTICATE_KEYS,
         ) as DigestWWWAuthenticateData;
 
-        const authedUrl = new URL(this.url);
-        const username = decodeURIComponent(authedUrl.username);
-        const password = decodeURIComponent(authedUrl.password);
-
         const strippedUrl = new URL(url.toString());
         strippedUrl.username = '';
         strippedUrl.password = '';
@@ -645,10 +798,16 @@ export class RtspClient extends RtspBase {
     }
 
     async describe(headers?: Headers) {
-        return this.request('DESCRIBE', {
+        const response = await this.request('DESCRIBE', {
             ...(headers || {}),
             Accept: 'application/sdp',
         });
+
+        this.contentBase = response.headers['content-base'] || response.headers['content-location'];
+        // content base may be a relative path? seems odd.
+        if (this.contentBase)
+            this.contentBase = new URL(this.contentBase, this.url).toString();
+        return response;
     }
 
     async setup(options: RtspClientTcpSetupOptions | RtspClientUdpSetupOptions, headers?: Headers) {
@@ -1045,7 +1204,7 @@ export class RtspServer {
 }
 
 export async function listenSingleRtspClient<T extends RtspServer>(options?: {
-    hostname?: string,
+    hostname: string,
     pathToken?: string,
     createServer?(duplex: Duplex): T,
 }) {

common/src/sdp-utils.ts

@@ -172,8 +172,11 @@ export function parseFmtp(msection: string[]) {
 export type MSection = ReturnType<typeof parseMSection>;
 export type RTPMap = ReturnType<typeof parseRtpMap>;
 
-export function parseRtpMap(mlineType: string, rtpmap: string) {
+export function parseRtpMap(mline: ReturnType<typeof parseMLine>, rtpmap: string) {
+    const mlineType = mline.type;
     const match = rtpmap?.match(/a=rtpmap:([\d]+) (.*?)\/([\d]+)(\/([\d]+))?/);
+    let channels = parseInt(match?.[5]) || undefined;
+    let payloadType = parseInt(match?.[1]);
 
     rtpmap = rtpmap?.toLowerCase();
 
@@ -218,9 +221,45 @@ export function parseRtpMap(mlineType: string, rtpmap: string) {
         codec = 'h265';
     }
     else if (!rtpmap && mlineType === 'audio') {
-        // ffmpeg seems to omit the rtpmap type for pcm alaw when creating sdp?
-        // is this the default?
-        codec = 'pcm_alaw';
+        if (mline.payloadTypes?.includes(0)) {
+            codec = 'pcm_mulaw';
+            ffmpegEncoder = 'pcm_mulaw';
+            payloadType = 0;
+            channels = 1;
+        }
+        else if (mline.payloadTypes?.includes(8)) {
+            codec = 'pcm_alaw';
+            ffmpegEncoder = 'pcm_alaw';
+            payloadType = 8;
+            channels = 1;
+        }
+        else if (mline.payloadTypes?.includes(14)) {
+            codec = 'mp3';
+            ffmpegEncoder = 'mp3';
+            payloadType = 14;
+            channels = 2;
+        }
+        else {
+            // ffmpeg seems to omit the rtpmap type for pcm alaw when creating sdp?
+            // is this the default?
+            // 2/21/2024: the paylaod types are included in the mline, and this is legacy code
+            // that maybe should be updated to use the mline payload types when no rtpmap(s) are available.
+            // https://en.wikipedia.org/wiki/RTP_payload_formats
+            codec = 'pcm_alaw';
+            ffmpegEncoder = 'pcm_alaw';
+            payloadType = 8;
+            channels = 1;
+        }
+    }
+
+    // assigned payload types do not need to provide a clock, there is a default.
+    let clock = parseInt(match?.[3]);
+    if (!clock) {
+        clock = undefined;
+        if (codec === 'pcm_mulaw' || codec === 'pcm_alaw')
+            clock = 8000;
+        else if (codec === 'pcm_s16be')
+            clock = 16000;
     }
 
     return {
@@ -228,9 +267,9 @@ export function parseRtpMap(mlineType: string, rtpmap: string) {
         codec,
         ffmpegEncoder,
         rawCodec: match?.[2],
-        clock: parseInt(match?.[3]),
-        channels: parseInt(match?.[5]) || undefined,
-        payloadType: parseInt(match?.[1]),
+        clock,
+        channels,
+        payloadType,
     }
 }
 
@@ -240,9 +279,9 @@ export function parseMSection(msection: string[]) {
     const control = msection.find(line => line.startsWith(acontrol))?.substring(acontrol.length);
     const mline = parseMLine(msection[0]);
     const rawRtpmaps = msection.filter(line => line.startsWith(artpmap));
-    const rtpmaps = rawRtpmaps.map(line => parseRtpMap(mline.type, line));
+    const rtpmaps = rawRtpmaps.map(line => parseRtpMap(mline, line));
     // if no rtp map is specified, pcm_alaw is used. parsing a null rtpmap is valid.
-    const rtpmap = parseRtpMap(mline.type, rawRtpmaps[0]);
+    const rtpmap = parseRtpMap(mline, rawRtpmaps[0]);
     const { codec } = rtpmap;
     let direction: string;
 
@@ -340,3 +379,33 @@ export function getSpsPps(
         pps: Buffer.from(pps, 'base64'),
     }
 }
+
+export function getSpsPpsVps(
+    section: {
+        fmtp: {
+            payloadType: number;
+            parameters: {
+                [key: string]: string;
+            };
+        }[]
+    }
+) {
+    const parameters = section?.fmtp?.[0]?.parameters;
+    if (!parameters) {
+        return {
+            sps: undefined,
+            pps: undefined,
+            vps: undefined,
+        };
+    }
+
+    const sps = parameters['sprop-sps'];
+    const pps = parameters['sprop-pps'];
+    const vps = parameters['sprop-vps'];
+
+    return {
+        sps: sps ? Buffer.from(sps, 'base64') : undefined,
+        pps: pps ? Buffer.from(pps, 'base64') : undefined,
+        vps: vps ? Buffer.from(vps, 'base64') : undefined,
+    }
+}

common/src/sleep.ts

@@ -1 +1 @@
-export * from "@scrypted/server/src/sleep"
+export { sleep } from "../../server/src/sleep";

common/src/zygote.ts

@@ -1,19 +1,52 @@
-import sdk, { PluginFork } from '@scrypted/sdk';
-import worker_threads from 'worker_threads';
+import sdk, { ForkOptions, PluginFork } from '@scrypted/sdk';
 import { createAsyncQueue } from './async-queue';
 import os from 'os';
 
 export type Zygote<T> = () => PluginFork<T>;
 
-export function createZygote<T>(): Zygote<T> {
-    if (!worker_threads.isMainThread)
-        return;
+export function createService<T, V>(options: ForkOptions, create: (t: Promise<T>) => Promise<V>): {
+    getResult: () => Promise<V>,
+    terminate: () => void,
+} {
+    let killed = false;
+    let currentResult: Promise<V>;
+    let currentFork: ReturnType<typeof sdk.fork<T>>;
 
-    let zygote = sdk.fork<T>();
+    return {
+        getResult() {
+            if (killed)
+                throw new Error('service terminated');
+
+            if (currentResult)
+                return currentResult;
+
+            currentFork = sdk.fork<T>(options);
+            currentFork.worker.on('exit', () => currentResult = undefined);
+            currentResult = create(currentFork.result);
+            currentResult.catch(() => {
+                currentResult = undefined;
+            });
+            return currentResult;
+        },
+
+        terminate() {
+            if (killed)
+                return;
+
+            killed = true;
+            currentFork.worker.terminate();
+            currentFork = undefined;
+            currentResult = undefined;
+        }
+    }
+}
+
+export function createZygote<T>(options?: ForkOptions): Zygote<T> {
+    let zygote = sdk.fork<T>(options);
     function* next() {
         while (true) {
             const cur = zygote;
-            zygote = sdk.fork<T>();
+            zygote = sdk.fork<T>(options);
             yield cur;
         }
     }

common/tsconfig.json

@@ -1,6 +1,7 @@
 {
     "compilerOptions": {
         "module": "commonjs",
+        "moduleResolution": "Node16",
         "target": "esnext",
         "noImplicitAny": true,
         "outDir": "./dist",

docs/plugins/core/ui/img/icons/safari-pinned-tab.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-cpu"><rect x="4" y="4" width="16" height="16" rx="2" ry="2"></rect><rect x="9" y="9" width="6" height="6"></rect><line x1="9" y1="1" x2="9" y2="4"></line><line x1="15" y1="1" x2="15" y2="4"></line><line x1="9" y1="20" x2="9" y2="23"></line><line x1="15" y1="20" x2="15" y2="23"></line><line x1="20" y1="9" x2="23" y2="9"></line><line x1="20" y1="14" x2="23" y2="14"></line><line x1="1" y1="9" x2="4" y2="9"></line><line x1="1" y1="14" x2="4" y2="14"></line></svg>

docs/plugins/core/ui/index.html

@@ -1,26 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <meta http-equiv="X-UA-Compatible" content="IE=edge">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" />
-    <link rel="icon" href="<%= BASE_URL %>favicon.ico">
-    <title>Scrypted Management Console</title>
-
-    <link rel="preconnect" href="https://fonts.googleapis.com"> 
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> 
-
-    <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Material+Icons">
-
-    <link href="https://fonts.googleapis.com/css2?family=Lato:wght@300;400;700&display=swap" rel="stylesheet">
-
-    <link href="https://fonts.googleapis.com/css2?family=Quicksand:wght@300;400;500;600;700&display=swap" rel="stylesheet">
-  </head>
-  <body>
-    <noscript>
-      <strong>We're sorry but web doesn't work properly without JavaScript enabled. Please enable it to continue.</strong>
-    </noscript>
-    <div id="app"></div>
-    <!-- built files will be auto injected -->
-  </body>
-</html>

docs/plugins/core/ui/manifest.json

@@ -1,45 +0,0 @@
-{
-  "name": "Scrypted Management Console",
-  "short_name": "Scrypted",
-  "icons": [
-    {
-      "src": "https://koush.github.io/scrypted/plugins/core/ui/img/icons/icon-72x72.png",
-      "sizes": "72x72",
-      "type": "image/png"
-    },
-    {
-      "src": "https://koush.github.io/scrypted/plugins/core/ui/img/icons/icon-96x96.png",
-      "sizes": "96x96",
-      "type": "image/png"
-    },
-    {
-      "src": "https://koush.github.io/scrypted/plugins/core/ui/img/icons/icon-144x144.png",
-      "sizes": "144x144",
-      "type": "image/png"
-    },
-    {
-      "src": "https://koush.github.io/scrypted/plugins/core/ui/img/icons/icon-152x152.png",
-      "sizes": "152x152",
-      "type": "image/png"
-    },
-    {
-      "src": "https://koush.github.io/scrypted/plugins/core/ui/img/icons/icon-192x192.png",
-      "sizes": "192x192",
-      "type": "image/png"
-    },
-    {
-      "src": "https://koush.github.io/scrypted/plugins/core/ui/img/icons/icon-384x384.png",
-      "sizes": "384x384",
-      "type": "image/png"
-    },
-    {
-      "src": "https://koush.github.io/scrypted/plugins/core/ui/img/icons/icon-512x512.png",
-      "sizes": "512x512",
-      "type": "image/png"
-    }
-  ],
-  "start_url": "./index.html",
-  "display": "standalone",
-  "background_color": "#000000",
-  "theme_color": "#424242"
-}

docs/plugins/core/ui/robots.txt

@@ -1,2 +0,0 @@
-User-agent: *
-Disallow:

install/config.yaml

@@ -1,13 +1,12 @@
 # Home Assistant Addon Configuration
 name: Scrypted
-version: "18-jammy-full.s6-v0.80.0"
+version: "v0.139.0-noble-full"
 slug: scrypted
 description: Scrypted is a high performance home video integration and automation platform
 url: "https://github.com/koush/scrypted"
 arch:
   - amd64
   - aarch64
-  - armv7
 init: false
 ingress: true
 ingress_port: 11080

install/docker/Dockerfile

@@ -1,4 +1,4 @@
-ARG BASE="18-jammy-full"
+ARG BASE="noble-full"
 FROM ghcr.io/koush/scrypted-common:${BASE}
 
 WORKDIR /
@@ -16,6 +16,6 @@ ENV NODE_OPTIONS="--dns-result-order=ipv4first"
 
 # changing this forces pip and npm to perform reinstalls.
 # if this base image changes, this version must be updated.
-ENV SCRYPTED_BASE_VERSION="20240103"
+ENV SCRYPTED_BASE_VERSION="20250101"
 
-CMD npm --prefix /server exec scrypted-serve
+CMD ["/bin/sh", "-c", "ulimit -c 0; exec npm --prefix /server exec scrypted-serve"]

install/docker/Dockerfile.full

@@ -6,25 +6,20 @@
 # This common file will be used by both Docker and the linux
 # install script.
 ################################################################
-ARG BASE="jammy"
-FROM ubuntu:${BASE} as header
+ARG BASE="noble"
+FROM ubuntu:${BASE} AS header
 
 ENV DEBIAN_FRONTEND=noninteractive
 
 # base tools and development stuff
 RUN apt-get update && apt-get -y install \
     curl software-properties-common apt-utils \
-    build-essential \
-    cmake \
     ffmpeg \
-    gcc \
-    libcairo2-dev \
-    libgirepository1.0-dev \
     pkg-config && \
     apt-get -y update && \
     apt-get -y upgrade
 
-ARG NODE_VERSION=18
+ARG NODE_VERSION=22
 RUN apt-get install -y ca-certificates curl gnupg
 RUN mkdir -p /etc/apt/keyrings
 RUN curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor --yes -o /etc/apt/keyrings/nodesource.gpg
@@ -40,16 +35,12 @@ RUN apt-get -y install \
     python3-setuptools \
     python3-wheel
 
-# these are necessary for pillow-simd, additional on disk size is small
-# but could consider removing this.
-RUN echo "Installing pillow-simd dependencies."
-RUN apt-get -y install \
-    libjpeg-dev zlib1g-dev
-
 # gstreamer native https://gstreamer.freedesktop.org/documentation/installing/on-linux.html?gi-language=c#install-gstreamer-on-ubuntu-or-debian
 RUN echo "Installing gstreamer."
+# python-codecs pygobject dependencies
+RUN apt-get -y install libcairo2-dev libgirepository1.0-dev
 RUN apt-get -y install \
-    gstreamer1.0-tools gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-plugins-bad gstreamer1.0-libav gstreamer1.0-alsa \
+    gstreamer1.0-tools gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-plugins-bad gstreamer1.0-libav \
     gstreamer1.0-vaapi
 
 # python3 gstreamer bindings
@@ -60,8 +51,9 @@ RUN apt-get -y install \
 # allow pip to install to system
 RUN rm -f /usr/lib/python**/EXTERNALLY-MANAGED
 
-RUN python3 -m pip install --upgrade pip
-RUN python3 -m pip install debugpy typing_extensions psutil
+# ERROR: Cannot uninstall pip 24.0, RECORD file not found. Hint: The package was installed by debian.
+# RUN python3 -m pip install --upgrade pip
+RUN python3 -m pip install debugpy
 
 ################################################################
 # End section generated from template/Dockerfile.full.header
@@ -69,11 +61,20 @@ RUN python3 -m pip install debugpy typing_extensions psutil
 ################################################################
 # Begin section generated from template/Dockerfile.full.footer
 ################################################################
-FROM header as base
+FROM header AS base
 
-# intel opencl gpu for openvino
+# vulkan
+RUN apt -y install libvulkan1
+
+# intel opencl for openvino
 RUN curl https://raw.githubusercontent.com/koush/scrypted/main/install/docker/install-intel-graphics.sh | bash
 
+# NPU driver will SIGILL on openvino prior to 2024.5.0
+RUN curl https://raw.githubusercontent.com/koush/scrypted/main/install/docker/install-intel-npu.sh | bash
+
+# amd opencl
+RUN curl https://raw.githubusercontent.com/koush/scrypted/main/install/docker/install-amd-graphics.sh | bash
+
 # python 3.9 from ppa.
 # 3.9 is the version with prebuilt support for tensorflow lite
 RUN add-apt-repository -y ppa:deadsnakes/ppa && \
@@ -85,8 +86,8 @@ RUN add-apt-repository -y ppa:deadsnakes/ppa && \
 # allow pip to install to system
 RUN rm -f /usr/lib/python**/EXTERNALLY-MANAGED
 
-RUN python3.9 -m pip install --upgrade pip
-RUN python3.9 -m pip install debugpy typing_extensions psutil
+# RUN python3.9 -m pip install --upgrade pip
+RUN python3.9 -m pip install debugpy
 
 # Coral Edge TPU
 # https://coral.ai/docs/accelerator/get-started/#runtime-on-linux
@@ -94,13 +95,20 @@ RUN echo "deb https://packages.cloud.google.com/apt coral-edgetpu-stable main" |
 RUN curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
 RUN apt-get -y update && apt-get -y install libedgetpu1-std
 
+# set default shell to bash
+RUN chsh -s /bin/bash
+ENV SHELL="/bin/bash"
+
 ENV SCRYPTED_INSTALL_ENVIRONMENT="docker"
 ENV SCRYPTED_CAN_RESTART="true"
 ENV SCRYPTED_VOLUME="/server/volume"
 ENV SCRYPTED_INSTALL_PATH="/server"
 
-RUN test -f "/usr/bin/ffmpeg"
+RUN test -f "/usr/bin/ffmpeg" && test -f "/usr/bin/python3" && test -f "/usr/bin/python3.9" && test -f "/usr/bin/python3.12"
 ENV SCRYPTED_FFMPEG_PATH="/usr/bin/ffmpeg"
+ENV SCRYPTED_PYTHON_PATH="/usr/bin/python3"
+ENV SCRYPTED_PYTHON39_PATH="/usr/bin/python3.9"
+ENV SCRYPTED_PYTHON312_PATH="/usr/bin/python3.12"
 
 ENV SCRYPTED_DOCKER_FLAVOR="full"
 

install/docker/Dockerfile.intel

@@ -0,0 +1,9 @@
+ARG BASE="ghcr.io/koush/scrypted-common:20-jammy-full"
+FROM $BASE
+
+ENV SCRYPTED_DOCKER_FLAVOR="intel"
+
+RUN curl https://raw.githubusercontent.com/koush/scrypted/main/install/docker/install-intel-oneapi.sh | bash
+# these paths must be updated if oneapi is updated via the install-intel-oneapi.sh script
+# note that the 2022.2 seems to be a typo in the intel script...?
+ENV LD_LIBRARY_PATH=/opt/intel/oneapi/tcm/1.4/lib:/opt/intel/oneapi/umf/0.11/lib:/opt/intel/oneapi/tbb/2022.2/env/../lib/intel64/gcc4.8:/opt/intel/oneapi/mkl/2025.2/lib:/opt/intel/oneapi/compiler/2025.2/opt/compiler/lib:/opt/intel/oneapi/compiler/2025.2/lib

install/docker/Dockerfile.lite

@@ -1,47 +1,30 @@
 ARG BASE="jammy"
-FROM ubuntu:${BASE} as header
+FROM ubuntu:${BASE} AS header
+
+ENV SCRYPTED_DOCKER_FLAVOR="lite"
 
 ENV DEBIAN_FRONTEND=noninteractive
 
 # base tools and development stuff
 RUN apt-get update && apt-get -y install \
     curl software-properties-common apt-utils \
-    build-essential \
-    cmake \
-    ffmpeg \
-    gcc \
-    libcairo2-dev \
-    libgirepository1.0-dev \
-    pkg-config && \
+    python3 && \
     apt-get -y update && \
     apt-get -y upgrade
 
-ARG NODE_VERSION=18
+ARG NODE_VERSION=22
 RUN apt-get install -y ca-certificates curl gnupg
 RUN mkdir -p /etc/apt/keyrings
 RUN curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor --yes -o /etc/apt/keyrings/nodesource.gpg
 RUN echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_"$NODE_VERSION".x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list
 RUN apt-get update && apt-get install -y nodejs
 
-# python native
-RUN apt-get -y install \
-    python3 \
-    python3-dev \
-    python3-pip \
-    python3-setuptools \
-    python3-wheel
-
-# python pip
-RUN rm -f /usr/lib/python**/EXTERNALLY-MANAGED
-RUN python3 -m pip install --upgrade pip
-RUN python3 -m pip install debugpy typing_extensions psutil
-
 ENV SCRYPTED_INSTALL_ENVIRONMENT="docker"
 ENV SCRYPTED_CAN_RESTART="true"
 ENV SCRYPTED_VOLUME="/server/volume"
 ENV SCRYPTED_INSTALL_PATH="/server"
+ENV SHELL="/bin/bash"
 
-RUN test -f "/usr/bin/ffmpeg"
-ENV SCRYPTED_FFMPEG_PATH="/usr/bin/ffmpeg"
-
-ENV SCRYPTED_DOCKER_FLAVOR="lite"
+RUN test -f "/usr/bin/python3" && test -f "/usr/bin/python3.12"
+ENV SCRYPTED_PYTHON_PATH="/usr/bin/python3"
+ENV SCRYPTED_PYTHON312_PATH="/usr/bin/python3.12"

install/docker/Dockerfile.nvidia

@@ -1,14 +1,11 @@
-FROM ghcr.io/koush/scrypted:18-jammy-full.s6
+ARG BASE="ghcr.io/koush/scrypted-common:20-jammy-full"
+FROM $BASE
 
-WORKDIR /
+ENV SCRYPTED_DOCKER_FLAVOR="nvidia"
 
-# Install miniconda
-ENV CONDA_DIR /opt/conda
-RUN wget --quiet https://repo.anaconda.com/miniconda/Miniconda3-latest-Linux-x86_64.sh -O ~/miniconda.sh && \
-     /bin/bash ~/miniconda.sh -b -p /opt/conda
-# Put conda in path so we can use conda activate
-ENV PATH=$CONDA_DIR/bin:$PATH
+ENV NVIDIA_DRIVER_CAPABILITIES=all
+ENV NVIDIA_VISIBLE_DEVICES=all
 
-RUN conda install -c conda-forge cudatoolkit=11.2.2 cudnn=8.1.0
-ENV CONDA_PREFIX=/opt/conda
-ENV LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$CONDA_PREFIX/lib/
+# nvidia cudnn/libcublas etc.
+# for some reason this is not provided by the nvidia container toolkit
+RUN curl https://raw.githubusercontent.com/koush/scrypted/main/install/docker/install-nvidia-graphics.sh | bash

install/docker/Dockerfile.router

@@ -0,0 +1,52 @@
+ARG BASE="noble-lite"
+FROM ghcr.io/koush/scrypted-common:${BASE}
+
+ENV SCRYPTED_DOCKER_FLAVOR="router"
+
+# tools
+RUN apt -y update && apt -y install nano net-tools dnsutils dnsmasq vlan bridge-utils netplan.io nftables isc-dhcp-client cron
+RUN rm -f /etc/systemd/system/multi-user.target.wants/dnsmasq.service
+RUN rm -f /etc/systemd/system/sysinit.target.wants/systemd-resolved.service
+
+# go + caddy
+RUN apt -y install golang-go
+RUN apt install -y debian-keyring debian-archive-keyring apt-transport-https
+RUN curl -1sLf 'https://dl.cloudsmith.io/public/caddy/xcaddy/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-xcaddy-archive-keyring.gpg
+RUN curl -1sLf 'https://dl.cloudsmith.io/public/caddy/xcaddy/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-xcaddy.list
+RUN apt -y update
+RUN apt -y install xcaddy
+RUN xcaddy build --with github.com/caddy-dns/cloudflare --output /usr/local/bin/caddy
+
+# nftables
+COPY ./router/scrypted-nftables.service /etc/systemd/system
+RUN systemctl enable scrypted-nftables
+RUN bash -c 'echo include \"/etc/nftables.d/*.conf\"\; > /etc/nftables.conf'
+RUN mkdir -p /etc/nftables.d
+COPY ./router/01-scrypted.conf /etc/nftables.d
+
+# ipv6 forwarding
+COPY ./router/scrypted-ip-forwarding.service /etc/systemd/system
+RUN systemctl enable scrypted-ip-forwarding
+
+# install turn server, but disable it too set it up on a per interface basis.
+RUN apt -y update && apt -y install coturn && systemctl disable coturn && rm /usr/lib/systemd/system/coturn.service
+
+# install usbmuxd for iphone tethering
+# ensure the pairing info stays in persistent storage
+RUN apt -y update && apt -y install usbmuxd && rm /usr/lib/systemd/system/usbmuxd.service && ln -sf /server/volume/plugins/\@scrypted/router/usbmuxd /var/lib/lockdown
+
+WORKDIR /
+# cache bust
+ADD "https://www.random.org/cgi-bin/randbyte?nbytes=10&format=h" skipcache
+ARG SCRYPTED_INSTALL_VERSION="latest"
+RUN test -n "$SCRYPTED_INSTALL_VERSION"
+RUN npx -y scrypted@latest install-server ${SCRYPTED_INSTALL_VERSION}
+
+COPY ./router/scrypted-dhcp-watcher.service /etc/systemd/system/scrypted-dhcp-watcher.service
+RUN systemctl enable scrypted-dhcp-watcher
+
+COPY ./router/scrypted.service /etc/systemd/system/scrypted.service
+RUN systemctl enable scrypted
+
+WORKDIR /
+CMD ["/sbin/init"]

install/docker/Dockerfile.s6

@@ -1,4 +1,4 @@
-ARG BASE="18-jammy-full"
+ARG BASE="20-jammy-full"
 FROM ghcr.io/koush/scrypted-common:${BASE}
 
 # avahi advertiser support
@@ -8,6 +8,9 @@ RUN apt-get update && apt-get -y install \
     libavahi-compat-libdnssd-dev \
     xz-utils
 
+# killall
+RUN apt -y install psmisc
+
 # copy configurations and scripts
 COPY fs /
 
@@ -46,6 +49,6 @@ ENV NODE_OPTIONS="--dns-result-order=ipv4first"
 
 # changing this forces pip and npm to perform reinstalls.
 # if this base image changes, this version must be updated.
-ENV SCRYPTED_BASE_VERSION="20240103"
+ENV SCRYPTED_BASE_VERSION="20250101"
 
-CMD npm --prefix /server exec scrypted-serve
+CMD ["/bin/sh", "-c", "ulimit -c 0; exec npm --prefix /server exec scrypted-serve"]

install/docker/Dockerfile.thin

@@ -1,22 +0,0 @@
-ARG BASE="jammy"
-FROM ubuntu:${BASE} as header
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get -y update && \
-    apt-get -y upgrade && \
-    apt-get -y install curl software-properties-common apt-utils ffmpeg
-
-# switch to nvm?
-ARG NODE_VERSION=18
-RUN echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_VERSION.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list
-
-ENV SCRYPTED_INSTALL_ENVIRONMENT="docker"
-ENV SCRYPTED_CAN_RESTART="true"
-ENV SCRYPTED_VOLUME="/server/volume"
-ENV SCRYPTED_INSTALL_PATH="/server"
-
-RUN test -f "/usr/bin/ffmpeg"
-ENV SCRYPTED_FFMPEG_PATH="/usr/bin/ffmpeg"
-
-ENV SCRYPTED_DOCKER_FLAVOR="thin"

install/docker/docker-build-nvidia.sh

@@ -1,3 +1,3 @@
 ./docker-build.sh
 
-docker build -t ghcr.io/koush/scrypted:18-jammy-full.nvidia -f Dockerfile.nvidia .
+docker build -t ghcr.io/koush/scrypted:20-jammy-full.nvidia -f Dockerfile.nvidia .

install/docker/docker-build.sh

@@ -2,7 +2,7 @@
 
 set -x
 
-NODE_VERSION=18
+NODE_VERSION=22
 SCRYPTED_INSTALL_VERSION=beta
 IMAGE_BASE=jammy
 FLAVOR=full

install/docker/docker-compose.yml

@@ -1,5 +1,3 @@
-version: "3.5"
-
 # The Scrypted docker-compose.yml file typically resides at:
 # ~/.scrypted/docker-compose.yml
 
@@ -21,6 +19,9 @@ version: "3.5"
 
 services:
     scrypted:
+        # LXC usage only
+        # lxc privileged: true
+
         environment:
             # Scrypted NVR Storage (Part 2 of 3)
 
@@ -31,24 +32,34 @@ services:
             # section below.
             # - SCRYPTED_NVR_VOLUME=/nvr
 
-            - SCRYPTED_WEBHOOK_UPDATE_AUTHORIZATION=Bearer SET_THIS_TO_SOME_RANDOM_TEXT
+            - SCRYPTED_WEBHOOK_UPDATE_AUTHORIZATION=Bearer ${WATCHTOWER_HTTP_API_TOKEN:-env_missing_fallback}
             - SCRYPTED_WEBHOOK_UPDATE=http://localhost:10444/v1/update
 
-            # Uncomment next line to run avahi-daemon inside the container
-            # Don't use if dbus and avahi run on the host and are bind-mounted
-            # (see below under "volumes")
+            # LXC usage only
+            # lxc - SCRYPTED_INSTALL_ENVIRONMENT=lxc-docker
+
+            # Avahi can be used for network discovery by passing in the host daemon
+            # or running the daemon inside the container. Choose one or the other.
+            # Uncomment next line to run avahi-daemon inside the container.
+            # See volumes and security_opt section below to use the host daemon.
             # - SCRYPTED_DOCKER_AVAHI=true
 
-            # Uncomment next 3 lines for Nvidia GPU support.
-            # - NVIDIA_VISIBLE_DEVICES=all
-            # - NVIDIA_DRIVER_CAPABILITIES=all
-        # runtime: nvidia
+        # NVIDIA (Part 1 of 2)
+        # nvidia runtime: nvidia
+
+        # NVIDIA (Part 2 of 2) - Use NVIDIA image, and remove subsequent default image.
+        # Valid images:
+        # ghcr.io/koush/scrypted
+        # ghcr.io/koush/scrypted:nvidia
+        # ghcr.io/koush/scrypted:intel
+        # ghcr.io/koush/scrypted:lite
+        image: ghcr.io/koush/scrypted
 
         volumes:
             # Scrypted NVR Storage (Part 3 of 3)
 
             # Modify to add the additional volume for Scrypted NVR.
-            # The following example would mount the /mnt/sda/video path on the host
+            # The following example would mount the /mnt/media/video path on the host
             # to the /nvr path inside the docker container.
             # - /mnt/media/video:/nvr
 
@@ -59,14 +70,29 @@ services:
             #   volume:
             #     nocopy: true
 
-            # uncomment the following lines to expose Avahi, an mDNS advertiser.
-            # make sure Avahi is running on the host machine, otherwise this will not work.
-            # not compatible with Avahi enabled via SCRYPTED_DOCKER_AVAHI=true
+            # Uncomment the following lines to use Avahi daemon from the host.
+            # Ensure Avahi is running on the host machine:
+            # It can be installed with: sudo apt-get install avahi-daemon
+            # This is not compatible with running avahi inside the container (see above).
+            # Also, uncomment the lines under security_opt
             # - /var/run/dbus:/var/run/dbus
             # - /var/run/avahi-daemon/socket:/var/run/avahi-daemon/socket
 
             # Default volume for the Scrypted database. Typically should not be changed.
-            - ~/.scrypted/volume:/server/volume
+            # The volume will be placed relative to this docker-compose.yml.
+            - ./volume:/server/volume
+
+            # LXC usage only
+            # lxc - /var/run/docker.sock:/var/run/docker.sock
+            # lxc - /root/.scrypted/docker-compose.yml:/root/.scrypted/docker-compose.yml
+            # lxc - /root/.scrypted/docker-compose.sh:/root/.scrypted/docker-compose.sh
+            # lxc - /root/.scrypted/.env:/root/.scrypted/.env
+            # lxc - /mnt:/mnt
+
+        # Uncomment the following lines to use Avahi daemon from the host
+        # Without this, AppArmor will block the container's attempt to talk to Avahi via dbus
+        # security_opt:
+        #     - apparmor:unconfined
         devices: [
             # uncomment the common systems devices to pass
             # them through to docker.
@@ -77,6 +103,9 @@ services:
             # hardware accelerated video decoding, opencl, etc.
             # "/dev/dri:/dev/dri",
 
+            # AMD GPU
+            # "/dev/kfd:/dev/kfd",
+
             # uncomment below as necessary.
             # zwave usb serial device
 
@@ -90,27 +119,26 @@ services:
         container_name: scrypted
         restart: unless-stopped
         network_mode: host
-        image: ghcr.io/koush/scrypted
 
         # logging is noisy and will unnecessarily wear on flash storage.
         # scrypted has per device in memory logging that is preferred.
+        # enable the log file if enhanced debugging is necessary.
         logging:
-            driver: "json-file"
-            options:
-                max-size: "10m"
-                max-file: "10"
+            driver: "none"
+            # driver: "json-file"
+            # options:
+            #     max-size: "10m"
+            #     max-file: "10"
         labels:
             - "com.centurylinklabs.watchtower.scope=scrypted"
 
     # watchtower manages updates for Scrypted.
     watchtower:
         environment:
-            - WATCHTOWER_HTTP_API_TOKEN=SET_THIS_TO_SOME_RANDOM_TEXT
+            - WATCHTOWER_HTTP_API_TOKEN=${WATCHTOWER_HTTP_API_TOKEN:-env_missing_fallback}
             - WATCHTOWER_HTTP_API_UPDATE=true
             - WATCHTOWER_SCOPE=scrypted
-            # remove the following line to never allow docker to auto update.
-            # this is not recommended.
-            - WATCHTOWER_HTTP_API_PERIODIC_POLLS=true
+            - WATCHTOWER_HTTP_API_PERIODIC_POLLS=${WATCHTOWER_HTTP_API_PERIODIC_POLLS:-true}
         image: containrrr/watchtower
         container_name: scrypted-watchtower
         restart: unless-stopped

install/docker/fs/etc/s6-overlay/scripts/setup.sh

@@ -1,5 +1,9 @@
 #!/bin/bash
 
+# disable core dumps.
+# this doesn't disable core dumps on the scrypted service itself, only stuff run by init.
+ulimit -c 0
+
 if [[ "${SCRYPTED_DOCKER_AVAHI}" != "true" ]]; then
   echo "SCRYPTED_DOCKER_AVAHI != true, won't manage dbus nor avahi-daemon" >/dev/stderr
   exit 0

install/docker/install-amd-graphics.sh

@@ -0,0 +1,44 @@
+if [ "$(uname -m)" != "x86_64" ]
+then
+    echo "AMD graphics will not be installed on this architecture."
+    exit 0
+fi
+
+UBUNTU_22_04=$(lsb_release -r | grep "22.04")
+UBUNTU_24_04=$(lsb_release -r | grep "24.04")
+
+# needs either ubuntu 22.0.4 or 24.04
+if [ -z "$UBUNTU_22_04" ] && [ -z "$UBUNTU_24_04" ]
+then
+    echo "AMD graphics package can not be installed. Ubuntu version could not be detected when checking lsb-release and /etc/os-release."
+    exit 1
+fi
+
+if [ -n "$UBUNTU_22_04" ]
+then
+    distro="jammy"
+else
+    distro="noble"
+fi
+
+# https://amdgpu-install.readthedocs.io/en/latest/install-prereq.html#installing-the-installer-package
+
+FILENAME=$(curl -s -L https://repo.radeon.com/amdgpu-install/latest/ubuntu/$distro/ | grep -o 'amdgpu-install_[^ ]*' | cut -d'"' -f1)
+if [ -z "$FILENAME" ]
+then
+    echo "AMD graphics package can not be installed. Could not find the package name."
+    exit 1
+fi
+
+set -e
+mkdir -p /tmp/amd
+cd /tmp/amd
+curl -O -L http://repo.radeon.com/amdgpu-install/latest/ubuntu/$distro/$FILENAME
+apt -y update
+apt -y install rsync
+dpkg -i $FILENAME
+apt -y update
+amdgpu-install --usecase=opencl --no-dkms -y --accept-eula
+cd /tmp
+rm -rf /tmp/amd
+

install/docker/install-intel-graphics.sh

@@ -1,16 +1,109 @@
-if [ "$(uname -m)" = "x86_64" ]
+if [ "$(uname -m)" != "x86_64" ]
+then
+    echo "Intel graphics will not be installed on this architecture."
+    exit 0
+fi
+
+
+UBUNTU_22_04=$(lsb_release -r | grep "22.04")
+UBUNTU_24_04=$(lsb_release -r | grep "24.04")
+
+# needs either ubuntu 22.0.4 or 24.04
+if [ -z "$UBUNTU_22_04" ] && [ -z "$UBUNTU_24_04" ]
+then
+    echo "Intel graphics package can not be installed. Ubuntu version could not be detected when checking lsb-release and /etc/os-release."
+    exit 1
+fi
+
+if [ -n "$UBUNTU_22_04" ]
+then
+    distro="jammy"
+    
+else
+    distro="noble"
+fi
+
+# no errors beyond this point
+set -e
+
+# the intel provided script is disabled since it does not work with the 6.8 kernel in Ubuntu 24.04 or Proxmox 8.2.
+# manual installation of the Intel graphics stuff is required.
+
+# echo "Installing Intel graphics packages."
+# apt-get update && apt-get install -y gpg-agent &&
+# rm -f /usr/share/keyrings/intel-graphics.gpg &&
+# curl -L https://repositories.intel.com/graphics/intel-graphics.key | gpg --dearmor --yes --output /usr/share/keyrings/intel-graphics.gpg &&
+# echo 'deb [arch=amd64,i386 signed-by=/usr/share/keyrings/intel-graphics.gpg] https://repositories.intel.com/graphics/ubuntu jammy arc' | tee  /etc/apt/sources.list.d/intel.gpu.jammy.list &&
+# apt-get -y update &&
+# apt-get -y install intel-opencl-icd &&
+# apt-get -y dist-upgrade;
+
+# need intel-media-va-driver-non-free, but all the other intel packages are installed from Intel github.
+echo "Installing Intel graphics packages."
+
+if [ "$distro" == "jammy" ]
 then
-    echo "Installing Intel graphics packages."
     apt-get update && apt-get install -y gpg-agent &&
     rm -f /usr/share/keyrings/intel-graphics.gpg &&
     curl -L https://repositories.intel.com/graphics/intel-graphics.key | gpg --dearmor --yes --output /usr/share/keyrings/intel-graphics.gpg &&
-    echo 'deb [arch=amd64,i386 signed-by=/usr/share/keyrings/intel-graphics.gpg] https://repositories.intel.com/graphics/ubuntu jammy arc' | tee  /etc/apt/sources.list.d/intel.gpu.jammy.list &&
+    echo "deb [arch=amd64,i386 signed-by=/usr/share/keyrings/intel-graphics.gpg] https://repositories.intel.com/graphics/ubuntu $distro arc" | tee  /etc/apt/sources.list.d/intel.gpu.$distro.list &&
     apt-get -y update &&
-    apt-get -y install intel-opencl-icd intel-media-va-driver-non-free &&
+    apt-get -y install intel-media-va-driver-non-free &&
     apt-get -y dist-upgrade;
-    exit $?
 else
-    echo "Intel graphics will not be installed on this architecture."
+    apt-get update && apt-get install -y gpg-agent &&
+    rm -f /usr/share/keyrings/intel-graphics.gpg &&
+    curl -L https://repositories.intel.com/gpu/intel-graphics.key | gpg --dearmor --yes --output /usr/share/keyrings/intel-graphics.gpg &&
+    echo "deb [arch=amd64,i386 signed-by=/usr/share/keyrings/intel-graphics.gpg] https://repositories.intel.com/gpu/ubuntu $distro unified" | tee /etc/apt/sources.list.d/intel-gpu-$distro.list &&
+    apt-get -y update &&
+    apt-get -y install intel-media-va-driver-non-free &&
+    apt-get -y dist-upgrade;
 fi
 
-exit 0
+
+rm -rf /tmp/gpu && mkdir -p /tmp/gpu && cd /tmp/gpu
+
+apt-get install -y ocl-icd-libopencl1
+
+# very stupid legacy + current install process conflict.
+# install 24.35.30872.22 for legacy support. Then install latest.
+# https://github.com/intel/compute-runtime/issues/770#issuecomment-2515166915
+
+# https://github.com/intel/compute-runtime/releases/tag/24.35.30872.22
+curl -O -L https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.20/intel-igc-core_1.0.17537.20_amd64.deb
+curl -O -L https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.20/intel-igc-opencl_1.0.17537.20_amd64.deb
+# curl -O -L https://github.com/intel/compute-runtime/releases/download/24.35.30872.22/intel-level-zero-gpu-dbgsym_1.3.30872.22_amd64.ddeb
+# curl -O -L https://github.com/intel/compute-runtime/releases/download/24.35.30872.22/intel-level-zero-gpu-legacy1-dbgsym_1.3.30872.22_amd64.ddeb
+curl -O -L https://github.com/intel/compute-runtime/releases/download/24.35.30872.22/intel-level-zero-gpu-legacy1_1.3.30872.22_amd64.deb
+curl -O -L https://github.com/intel/compute-runtime/releases/download/24.35.30872.22/intel-level-zero-gpu_1.3.30872.22_amd64.deb
+# curl -O -L https://github.com/intel/compute-runtime/releases/download/24.35.30872.22/intel-opencl-icd-dbgsym_24.35.30872.22_amd64.ddeb
+# curl -O -L https://github.com/intel/compute-runtime/releases/download/24.35.30872.22/intel-opencl-icd-legacy1-dbgsym_24.35.30872.22_amd64.ddeb
+curl -O -L https://github.com/intel/compute-runtime/releases/download/24.35.30872.22/intel-opencl-icd-legacy1_24.35.30872.22_amd64.deb
+curl -O -L https://github.com/intel/compute-runtime/releases/download/24.35.30872.22/intel-opencl-icd_24.35.30872.22_amd64.deb
+curl -O -L https://github.com/intel/compute-runtime/releases/download/24.35.30872.22/libigdgmm12_22.5.0_amd64.deb
+
+dpkg -i *.deb
+rm -f *.deb
+
+# https://github.com/intel/compute-runtime/releases
+# note that at time of commit, IGC supports ubuntu 24.04 only possibly due to their builder being on 24.04.
+curl -O -L https://github.com/intel/intel-graphics-compiler/releases/download/v2.12.5/intel-igc-core-2_2.12.5+19302_amd64.deb
+curl -O -L https://github.com/intel/intel-graphics-compiler/releases/download/v2.12.5/intel-igc-opencl-2_2.12.5+19302_amd64.deb
+# curl -O -L https://github.com/intel/compute-runtime/releases/download/25.22.33944.8/intel-ocloc-dbgsym_25.22.33944.8-0_amd64.ddeb
+curl -O -L https://github.com/intel/compute-runtime/releases/download/25.22.33944.8/intel-ocloc_25.22.33944.8-0_amd64.deb
+# curl -O -L https://github.com/intel/compute-runtime/releases/download/25.22.33944.8/intel-opencl-icd-dbgsym_25.22.33944.8-0_amd64.ddeb
+curl -O -L https://github.com/intel/compute-runtime/releases/download/25.22.33944.8/intel-opencl-icd_25.22.33944.8-0_amd64.deb
+curl -O -L https://github.com/intel/compute-runtime/releases/download/25.22.33944.8/libigdgmm12_22.7.0_amd64.deb
+# curl -O -L https://github.com/intel/compute-runtime/releases/download/25.22.33944.8/libze-intel-gpu1-dbgsym_25.22.33944.8-0_amd64.ddeb
+curl -O -L https://github.com/intel/compute-runtime/releases/download/25.22.33944.8/libze-intel-gpu1_25.22.33944.8-0_amd64.deb
+
+set +e
+dpkg -i *.deb
+set -e
+# the legacy + latest process says this may be necessary but it does not seem to be in a clean environment.
+apt-get install --fix-broken
+
+
+cd /tmp && rm -rf /tmp/gpu
+
+apt-get -y dist-upgrade

install/docker/install-intel-npu.sh

@@ -0,0 +1,72 @@
+if [ "$(uname -m)" != "x86_64" ]
+then
+    echo "Intel NPU will not be installed on this architecture."
+    exit 0
+fi
+
+UBUNTU_22_04=$(lsb_release -r | grep "22.04")
+UBUNTU_24_04=$(lsb_release -r | grep "24.04")
+
+if [ -z "$UBUNTU_22_04" ] && [ -z "$UBUNTU_24_04" ]
+then
+    # proxmox is compatible with ubuntu 22.04, check for  /etc/pve directory
+    if [ -d "/etc/pve" ]
+    then
+        UBUNTU_22_04=true
+    fi
+fi
+
+# needs either ubuntu 22.0.4 or 24.04
+if [ -z "$UBUNTU_22_04" ] && [ -z "$UBUNTU_24_04" ]
+then
+    echo "Intel NPU will not be installed. Ubuntu version could not be detected when checking lsb-release and /etc/os-release."
+    exit 0
+fi
+
+if [ -n "$UBUNTU_22_04" ]
+then
+    distro="22.04_amd64"
+else
+    distro="24.04_amd64"
+fi
+
+dpkg --purge --force-remove-reinstreq intel-driver-compiler-npu intel-fw-npu intel-level-zero-npu
+
+# no errors beyond this point
+set -e
+
+rm -rf /tmp/npu && mkdir -p /tmp/npu && cd /tmp/npu
+
+# level zero must also be installed
+LEVEL_ZERO_VERSION=1.22.4
+# https://github.com/oneapi-src/level-zero
+curl -O -L https://github.com/oneapi-src/level-zero/releases/download/v"$LEVEL_ZERO_VERSION"/level-zero_"$LEVEL_ZERO_VERSION"+u$distro.deb
+curl -O -L https://github.com/oneapi-src/level-zero/releases/download/v"$LEVEL_ZERO_VERSION"/level-zero-devel_"$LEVEL_ZERO_VERSION"+u$distro.deb
+
+# npu driver
+# https://github.com/intel/linux-npu-driver
+NPU_VERSION=1.19.0
+NPU_VERSION_DATE=20250707-16111289554
+curl -O -L https://github.com/intel/linux-npu-driver/releases/download/v"$NPU_VERSION"/intel-driver-compiler-npu_$NPU_VERSION."$NPU_VERSION_DATE"_ubuntu$distro.deb
+# firmware can only be installed on host. will cause problems inside container.
+if [ -n "$INTEL_FW_NPU" ]
+then
+    curl -O -L https://github.com/intel/linux-npu-driver/releases/download/v"$NPU_VERSION"/intel-fw-npu_$NPU_VERSION."$NPU_VERSION_DATE"_ubuntu$distro.deb
+fi
+curl -O -L https://github.com/intel/linux-npu-driver/releases/download/v"$NPU_VERSION"/intel-level-zero-npu_$NPU_VERSION."$NPU_VERSION_DATE"_ubuntu$distro.deb
+
+apt -y update
+apt -y install libtbb12
+dpkg -i *.deb
+
+cd /tmp && rm -rf /tmp/npu
+
+apt-get -y dist-upgrade
+
+if [ -n "$INTEL_FW_NPU" ]
+then
+    echo
+    echo "###############################################################################"
+    echo "Intel NPU firmware was installed. Reboot the host to complete the installation."
+    echo "###############################################################################"
+fi

install/docker/install-intel-oneapi.sh

@@ -0,0 +1,18 @@
+if [ "$(uname -m)" = "x86_64" ]
+then
+    apt -y update
+    apt -y install gpg
+
+    # download the key to system keyring
+    curl -1sLf https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB | gpg --dearmor --yes --output /usr/share/keyrings/oneapi-archive-keyring.gpg
+
+    # add signed entry to apt sources and configure the APT client to use Intel repository:
+    echo "deb [signed-by=/usr/share/keyrings/oneapi-archive-keyring.gpg] https://apt.repos.intel.com/oneapi all main" | tee /etc/apt/sources.list.d/oneAPI.list
+
+    apt -y update
+    apt -y install intel-oneapi-mkl-sycl-blas intel-oneapi-runtime-dnnl intel-oneapi-runtime-compilers
+else
+    echo "NVIDIA graphics will not be installed on this architecture."
+fi
+
+exit 0

install/docker/install-nvidia-container-toolkit.sh

@@ -0,0 +1,44 @@
+UBUNTU_22_04=$(lsb_release -r | grep "22.04")
+UBUNTU_24_04=$(lsb_release -r | grep "24.04")
+
+set -e
+
+# Install CUDA for 22.04
+# https://developer.nvidia.com/cuda-downloads?target_os=Linux&target_arch=x86_64&Distribution=Ubuntu&target_version=24.04&target_type=deb_network
+# Install CUDA for 24.04
+# https://developer.nvidia.com/cuda-downloads?target_os=Linux&target_arch=x86_64&Distribution=Ubuntu&target_version=24.04&target_type=deb_network
+# Do not apt install nvidia-open, must use cuda-drivers.
+
+if [ -z "$UBUNTU_22_04" ] && [ -z "$UBUNTU_24_04" ]
+then
+    echo "NVIDIA container toolkit can not be installed. Ubuntu version could not be detected when checking lsb-release and /etc/os-release."
+    exit 1
+fi
+
+if [ -n "$UBUNTU_22_04" ]
+then
+    distro="ubuntu2204"
+else
+    distro="ubuntu2404"
+fi
+
+apt update -q \
+    && apt install -y wget \
+    && wget -qO /cuda-keyring.deb https://developer.download.nvidia.com/compute/cuda/repos/$distro/$(uname -m)/cuda-keyring_1.1-1_all.deb \
+    && dpkg -i /cuda-keyring.deb;
+
+# https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html
+apt -y update
+apt -y install gpg
+curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | gpg --yes --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg \
+  && curl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | \
+    sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' | \
+    tee /etc/apt/sources.list.d/nvidia-container-toolkit.list
+apt -y update
+# is there a way to get a versioned package automatically?
+# cuda-drivers does not work with blackwell for some reason, container toolkit it broken IIRC.
+apt -y install nvidia-open
+apt -y install nvidia-container-toolkit
+
+nvidia-ctk runtime configure --runtime=docker
+systemctl restart docker

install/docker/install-nvidia-graphics.sh

@@ -0,0 +1,54 @@
+if [ "$(uname -m)" = "x86_64" ]
+then
+    UBUNTU_22_04=$(lsb_release -r | grep "22.04")
+    UBUNTU_24_04=$(lsb_release -r | grep "24.04")
+
+    # needs either ubuntu 22.0.4 or 24.04
+    if [ -z "$UBUNTU_22_04" ] && [ -z "$UBUNTU_24_04" ]
+    then
+        echo "NVIDIA graphics package can not be installed. Ubuntu version could not be detected when checking lsb-release and /etc/os-release."
+        exit 1
+    fi
+
+    if [ -n "$UBUNTU_22_04" ]
+    then
+        distro="ubuntu2204"
+    else
+        distro="ubuntu2404"
+    fi
+
+    echo "Installing NVIDIA graphics packages."
+    apt update -q \
+        && apt install -y wget \
+        && wget -qO /cuda-keyring.deb https://developer.download.nvidia.com/compute/cuda/repos/$distro/$(uname -m)/cuda-keyring_1.1-1_all.deb \
+        && dpkg -i /cuda-keyring.deb \
+        && apt update -q \
+        && apt install -y cuda-nvcc-12-9 libcublas-12-9 libcudnn9-cuda-12 cuda-libraries-12-9;
+
+    if [ "$?" != "0" ]
+    then
+        echo "Error: NVIDIA graphics packages failed to install."
+        exit 1
+    fi
+
+
+    # Update: the libnvidia-opencl.so.1 file is not present in the container image, it is
+    # mounted via the nvidia container runtime. This is why the following check is commented out.
+    # this file is present but for some reason the icd file is not created by nvidia runtime.
+    # if [ ! -f "/usr/lib/x86_64-linux-gnu/libnvidia-opencl.so.1" ]
+    # then
+    #     echo "Error: NVIDIA OpenCL library not found."
+    #     exit 1
+    # fi
+
+    # the container runtime doesn't mount this file for some reason. seems to be a bug.
+    # https://github.com/NVIDIA/nvidia-container-toolkit/issues/682
+    # but the contents are simply the .so file, which is a symlink the nvidia runtime
+    # will mount in.
+    mkdir -p /etc/OpenCL/vendors/
+    echo "libnvidia-opencl.so.1" > /etc/OpenCL/vendors/nvidia.icd
+else
+    echo "NVIDIA graphics will not be installed on this architecture."
+fi
+
+exit 0

install/docker/install-scrypted-docker-compose.sh

@@ -1,5 +1,11 @@
 #!/usr/bin/env bash
 
+if [ "$SCRYPTED_LXC" ]
+then
+    export SERVICE_USER="root"
+    export SCRYPTED_NONINTERACTIVE="true"
+fi
+
 if [ -z "$SERVICE_USER" ]
 then
     echo "Scrypted SERVICE_USER environment variable was not specified. Service will not be installed."
@@ -7,6 +13,14 @@ then
 fi
 
 function readyn() {
+    echo
+    echo
+    if [ ! -z "$SCRYPTED_NONINTERACTIVE" ]
+    then
+        yn="y"
+        return
+    fi
+
     while true; do
         read -p "$1 (y/n) " yn
         case $yn in
@@ -26,9 +40,21 @@ then
     fi
 fi
 
+echo "Stopping local service if it is running..."
+systemctl stop scrypted.service 2> /dev/null
+systemctl disable scrypted.service 2> /dev/null
+
 USER_HOME=$(eval echo ~$SERVICE_USER)
 SCRYPTED_HOME=$USER_HOME/.scrypted
 mkdir -p $SCRYPTED_HOME
+# remove various things from a previous local install.
+rm -rf $SCRYPTED_HOME/node_modules
+rm -rf $SCRYPTED_HOME/install.json
+rm -rf $SCRYPTED_HOME/package.json
+rm -rf $SCRYPTED_HOME/package-lock.json
+
+# must get this value as grep returns non zero if empty
+HAS_NVIDIA=$(lspci | grep -i nvidia)
 
 set -e
 cd $SCRYPTED_HOME
@@ -42,26 +68,66 @@ then
     usermod -aG docker $SERVICE_USER
 fi
 
-WATCHTOWER_HTTP_API_TOKEN=$(echo $RANDOM | md5sum)
+WATCHTOWER_HTTP_API_TOKEN=$(echo $RANDOM | md5sum | head -c 32)
+echo "WATCHTOWER_HTTP_API_TOKEN=$WATCHTOWER_HTTP_API_TOKEN" > $SCRYPTED_HOME/.env
+# remove the following line from .env to disable autoupdates.
+# this is not recommended.
+echo "WATCHTOWER_HTTP_API_PERIODIC_POLLS=true" >> $SCRYPTED_HOME/.env
+
 DOCKER_COMPOSE_YML=$SCRYPTED_HOME/docker-compose.yml
+curl -s https://raw.githubusercontent.com/koush/scrypted/main/install/docker/docker-compose.yml > $DOCKER_COMPOSE_YML
 echo "Created $DOCKER_COMPOSE_YML"
-curl -s https://raw.githubusercontent.com/koush/scrypted/main/install/docker/docker-compose.yml | sed s/SET_THIS_TO_SOME_RANDOM_TEXT/"$(echo $RANDOM | md5sum | head -c 32)"/g > $DOCKER_COMPOSE_YML
-if [ -d /dev/dri ]
+
+if [ -z "$SCRYPTED_LXC" ]
 then
-    sed -i 's/'#' - \/dev\/dri/- \/dev\/dri/g' $DOCKER_COMPOSE_YML
+    if [ -e /dev/dri ]
+    then
+        sed -i 's/'#' "\/dev\/dri/"\/dev\/dri/g' $DOCKER_COMPOSE_YML
+    fi
+    if [ -e /dev/kfd ]
+    then
+        sed -i 's/'#' "\/dev\/kfd/"\/dev\/kfd/g' $DOCKER_COMPOSE_YML
+    fi
+else
+    # uncomment lxc specific stuff
+    sed -i 's/'#' lxc //g' $DOCKER_COMPOSE_YML
+    # never restart, systemd will handle it
+    sed -i 's/restart: unless-stopped/restart: no/g' $DOCKER_COMPOSE_YML
+
+    sudo systemctl stop apparmor || true
+    sudo apt -y purge apparmor || true
+fi
+
+if [ ! -z "$HAS_NVIDIA" ]
+then
+    readyn "NVIDIA GPU detected. Use NVIDIA image for GPU acceleration?"
+    if [ "$yn" == "y" ]
+    then
+        readyn "NVIDIA image requires the NVIDIA Drivers and Container Toolkit to be installed. This script can install them for you. Install NVIDIA Drivers and Container Toolkit for GPU acceleration?"
+        if [ "$yn" == "y" ]
+        then
+            curl -fsSL https://raw.githubusercontent.com/koush/scrypted/main/install/docker/install-nvidia-container-toolkit.sh -o install-nvidia-container-toolkit.sh
+            chmod +x install-nvidia-container-toolkit.sh
+            ./install-nvidia-container-toolkit.sh
+            rm install-nvidia-container-toolkit.sh
+        fi
+        sed -i 's/'#' nvidia //g' $DOCKER_COMPOSE_YML
+        sed -i 's/ghcr.io\/koush\/scrypted/ghcr.io\/koush\/scrypted:nvidia/g' $DOCKER_COMPOSE_YML
+    fi
+fi
+
+readyn "Install avahi-daemon? This is the recommended for reliable HomeKit discovery and pairing."
+if [ "$yn" == "y" ]
+then
+    sudo apt-get -y install avahi-daemon
+    sed -i 's/'#' - \/var\/run\/dbus/- \/var\/run\/dbus/g' $DOCKER_COMPOSE_YML
+    sed -i 's/'#' - \/var\/run\/avahi-daemon/- \/var\/run\/avahi-daemon/g' $DOCKER_COMPOSE_YML
+    sed -i 's/'#' security_opt:/security_opt:/g' $DOCKER_COMPOSE_YML
+    sed -i 's/'#'     - apparmor:unconfined/    - apparmor:unconfined/g' $DOCKER_COMPOSE_YML
 fi
 
 echo "Setting permissions on $SCRYPTED_HOME"
-chown -R $SERVICE_USER $SCRYPTED_HOME
-
-echo "Optional:"
-readyn "Edit docker-compose.yml to add external storage for Scrypted NVR?"
-
-if [ "$yn" == "y" ]
-then
-    apt install nano
-    nano $DOCKER_COMPOSE_YML
-fi
+chown -R $SERVICE_USER $SCRYPTED_HOME || true
 
 set +e
 
@@ -74,8 +140,41 @@ set -e
 
 echo "docker compose pull"
 sudo -u $SERVICE_USER docker compose pull
-echo "docker compose up -d"
-sudo -u $SERVICE_USER docker compose up -d
+
+if [ -z "$SCRYPTED_LXC" ]
+then
+    echo "docker compose up -d"
+    sudo -u $SERVICE_USER docker compose up -d
+else
+    export DOCKER_COMPOSE_SH=$SCRYPTED_HOME/docker-compose.sh
+
+    curl https://raw.githubusercontent.com/koush/scrypted/main/install/proxmox/docker-compose.sh > $DOCKER_COMPOSE_SH
+
+    chmod +x $DOCKER_COMPOSE_SH
+
+    cat > /etc/systemd/system/scrypted.service <<EOT
+[Unit]
+Description=Scrypted service
+After=network.target
+
+[Service]
+User=root
+Group=root
+Type=simple
+ExecStart=$DOCKER_COMPOSE_SH
+Restart=always
+RestartSec=3
+StandardOutput=null
+StandardError=null
+
+[Install]
+WantedBy=multi-user.target
+EOT
+
+    systemctl daemon-reload
+    systemctl enable scrypted.service
+    systemctl restart scrypted.service
+fi
 
 echo
 echo
@@ -85,3 +184,6 @@ echo "Scrypted is now running at: https://localhost:10443/"
 echo "Note that it is https and that you'll be asked to approve/ignore the website certificate."
 echo
 echo
+echo "Optional:"
+echo "Scrypted NVR Recording storage directory can be configured with an additional script located at:"
+echo "https://docs.scrypted.app/scrypted-nvr/recording-storage.html#docker-volume"

install/docker/router/01-scrypted.conf

@@ -0,0 +1,55 @@
+table ip nat {
+    chain POSTROUTING {
+        type nat hook postrouting priority srcnat; policy accept;
+        jump postrouting_scrypted
+    }
+
+    chain postrouting_scrypted {
+    }
+
+    chain PREROUTING {
+        type nat hook prerouting priority dstnat; policy accept;
+        jump prerouting_scrypted; 
+    }
+
+    chain prerouting_scrypted {
+    }
+}
+
+table ip filter {
+    chain FORWARD {
+        type filter hook forward priority filter; policy drop;
+        jump forward_scrypted
+    }
+
+    chain forward_scrypted {
+    }
+}
+
+table ip6 nat {
+    chain POSTROUTING {
+        type nat hook postrouting priority srcnat; policy accept;
+        jump postrouting_scrypted
+    }
+
+    chain postrouting_scrypted {
+    }
+
+    chain PREROUTING {
+        type nat hook prerouting priority dstnat; policy accept;
+        jump prerouting_scrypted;
+    }
+
+    chain prerouting_scrypted {
+    }
+}
+
+table ip6 filter {
+    chain FORWARD {
+        type filter hook forward priority filter; policy drop;
+        jump forward_scrypted
+    }
+
+    chain forward_scrypted {
+    }
+}

install/docker/router/scrypted-dhcp-watcher.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Scrypted DHCP Watcher
+After=network.target
+
+[Service]
+ExecStart=/etc/dhcp/scrypted-dhcp-watcher
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target

install/docker/router/scrypted-ip-forwarding.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=ipv6 forwarding
+After=network.target
+Conflicts=shutdown.target
+DefaultDependencies=no
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+StandardInput=null
+ProtectSystem=full
+ProtectHome=true
+ExecStart=bash -c "sysctl -w net.ipv4.ip_forward=1 && sysctl -w net.ipv6.conf.all.forwarding=1 && sysctl -w net.ipv6.conf.default.forwarding=1"
+ExecReload=bash -c "sysctl -w net.ipv4.ip_forward=1 && sysctl -w net.ipv6.conf.all.forwarding=1 && sysctl -w net.ipv6.conf.default.forwarding=1"
+
+[Install]
+WantedBy=multi-user.target

install/docker/router/scrypted-nftables.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=nftables
+Documentation=man:nft(8) http://wiki.nftables.org
+After=network.target
+Conflicts=shutdown.target
+DefaultDependencies=no
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+StandardInput=null
+ProtectSystem=full
+ProtectHome=true
+ExecStart=/usr/sbin/nft -f /etc/nftables.conf
+ExecReload=/usr/sbin/nft -f /etc/nftables.conf
+
+[Install]
+WantedBy=multi-user.target

install/docker/router/scrypted.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=Scrypted
+After=network.target
+
+[Service]
+WorkingDirectory=/server
+ExecStart=/bin/sh -c "ulimit -c 0; exec npm exec scrypted-serve"
+Restart=always
+RestartSec=5
+
+Environment="SCRYPTED_INSTALL_ENVIRONMENT=docker"
+Environment="SCRYPTED_CAN_RESTART=true"
+Environment="SCRYPTED_VOLUME=/server/volume"
+Environment="SCRYPTED_INSTALL_PATH=/server"
+Environment="SCRYPTED_PYTHON_PATH=/usr/bin/python3"
+Environment="SCRYPTED_PYTHON312_PATH=/usr/bin/python3.12"
+Environment="SCRYPTED_DOCKER_FLAVOR=lite"
+Environment="DEBIAN_FRONTEND=noninteractive"
+Environment="NODE_OPTIONS=--dns-result-order=ipv4first"
+Environment="SCRYPTED_BASE_VERSION=20250101"
+Environment="SHELL=/bin/bash"
+
+[Install]
+WantedBy=multi-user.target

install/docker/setup-scrypted-nvr-volume.sh

@@ -0,0 +1,159 @@
+
+if [ -z "$SERVICE_USER" ]
+then
+    echo "Scrypted SERVICE_USER environment variable was not specified. NVR Storage can not be configured."
+    exit 0
+fi
+
+if [ "$USER" != "root" ]
+then
+    echo "$USER"
+    echo "This script must be run as sudo or root."
+    exit 1
+fi
+
+USER_HOME=$(eval echo ~$SERVICE_USER)
+SCRYPTED_HOME=$USER_HOME/.scrypted
+DOCKER_COMPOSE_YML=$SCRYPTED_HOME/docker-compose.yml
+
+if [ ! -f "$DOCKER_COMPOSE_YML" ]
+then
+    echo "$DOCKER_COMPOSE_YML not found. Install Scrypted first."
+    exit 1
+fi
+
+NVR_MOUNT_LINE=$(cat "$DOCKER_COMPOSE_YML" | grep :/nvr)
+if [ -z "$NVR_MOUNT_LINE" ]
+then
+    echo "Unexpected contents in $DOCKER_COMPOSE_YML. Rerun the Scrypted docker compose installer."
+    exit 1
+fi
+
+function backup() {
+    BACKUP_FILE="$1".scrypted-bak
+    if [ ! -f "$BACKUP_FILE" ]
+    then
+        cp "$1" "$BACKUP_FILE"
+    fi
+}
+
+backup "$DOCKER_COMPOSE_YML"
+
+function readyn() {
+    while true; do
+        read -p "$1 (y/n) " yn
+        case $yn in
+            [Yy]* ) break;;
+            [Nn]* ) break;;
+            * ) echo "Please answer yes or no. (y/n)";;
+        esac
+    done
+}
+
+if [ -z "$1" ]
+then
+    lsblk
+    echo ""
+    echo "Please run the script with an existing mount path or the 'disk' device to format (e.g. sdx)."
+    exit 1
+fi
+
+function stopscrypted() {
+    cd $SCRYPTED_HOME
+    echo ""
+    echo "Stopping the Scrypted container. If there are any errors during disk setup, Scrypted will need to be manually restarted with:"
+    echo "cd $SCRYPTED_HOME && docker compose up -d"
+    echo ""
+    sudo -u $SERVICE_USER docker compose down 2> /dev/null
+}
+
+function removescryptedfstab() {
+    backup "/etc/fstab"
+    grep -v "scrypted-nvr" /etc/fstab > /tmp/fstab && cp /tmp/fstab /etc/fstab
+    # ensure newline
+    sed -i -e '$a\' /etc/fstab
+    systemctl daemon-reload
+}
+
+BLOCK_DEVICE="/dev/$1"
+if [ -b "$BLOCK_DEVICE" ]
+then
+    readyn "Format $BLOCK_DEVICE?"
+    if [ "$yn" == "n" ]
+    then
+        exit 1
+    fi
+
+    stopscrypted
+
+    umount "$BLOCK_DEVICE"1 2> /dev/null
+    umount "$BLOCK_DEVICE"2 2> /dev/null
+    umount /mnt/scrypted-nvr 2> /dev/null
+
+    set -e
+    parted "$BLOCK_DEVICE" --script mklabel gpt
+    parted -a optimal "$BLOCK_DEVICE" mkpart scrypted-nvr "0%" "100%"
+    set +e
+
+    sync
+    PARTITION_DEVICE="$BLOCK_DEVICE"1
+    if [ ! -e "$PARTITION_DEVICE" ]
+    then
+        PARTITION_DEVICE="$BLOCK_DEVICE"p1
+        if [ ! -e "$PARTITION_DEVICE" ]
+        then
+            echo "Unable to determine block device partition from block device: $BLOCK_DEVICE"
+            exit 1
+        fi
+    fi
+    mkfs -F -t ext4 "$PARTITION_DEVICE"
+    sync
+
+    # parse/evaluate blkid line as env vars
+    for attr in $(blkid | grep "$BLOCK_DEVICE")
+    do
+        e=$(echo $attr | grep =)
+        if [ ! -z "$e" ]
+        then
+            export "$e"
+        fi
+    done
+    if [ -z "$UUID" ]
+    then
+        echo "Error parsing disk UUID."
+        exit 1
+    fi
+
+    echo "UUID: $UUID"
+    set -e
+    removescryptedfstab
+    mkdir -p /mnt/scrypted-nvr
+    echo "UUID=$UUID     /mnt/scrypted-nvr    ext4   defaults,nofail,noatime,x-systemd.automount 0 0" >> /etc/fstab
+    mount -a
+    systemctl daemon-reload
+    set +e
+
+    DIR="/mnt/scrypted-nvr"
+else
+    if [ ! -d "$1" ]
+    then
+        echo "$1 is not a valid directory."
+        exit 1
+    fi
+
+    stopscrypted
+
+    removescryptedfstab
+
+    DIR="$1"
+fi
+
+ESCAPED_DIR=$(echo "$DIR" | sed s/\\//\\\\\\//g)
+
+set -e
+sed -i s/'^.*:\/nvr'/"            - $ESCAPED_DIR:\/nvr"/ "$DOCKER_COMPOSE_YML"
+sed -i s/'^.*SCRYPTED_NVR_VOLUME.*$'/"            - SCRYPTED_NVR_VOLUME=\/nvr"/ "$DOCKER_COMPOSE_YML"
+set +e
+
+cd $SCRYPTED_HOME
+sudo -u $SERVICE_USER docker compose up -d

install/docker/template/Dockerfile.full.footer

@@ -1,11 +1,20 @@
 ################################################################
 # Begin section generated from template/Dockerfile.full.footer
 ################################################################
-FROM header as base
+FROM header AS base
 
-# intel opencl gpu for openvino
+# vulkan
+RUN apt -y install libvulkan1
+
+# intel opencl for openvino
 RUN curl https://raw.githubusercontent.com/koush/scrypted/main/install/docker/install-intel-graphics.sh | bash
 
+# NPU driver will SIGILL on openvino prior to 2024.5.0
+RUN curl https://raw.githubusercontent.com/koush/scrypted/main/install/docker/install-intel-npu.sh | bash
+
+# amd opencl
+RUN curl https://raw.githubusercontent.com/koush/scrypted/main/install/docker/install-amd-graphics.sh | bash
+
 # python 3.9 from ppa.
 # 3.9 is the version with prebuilt support for tensorflow lite
 RUN add-apt-repository -y ppa:deadsnakes/ppa && \
@@ -17,8 +26,8 @@ RUN add-apt-repository -y ppa:deadsnakes/ppa && \
 # allow pip to install to system
 RUN rm -f /usr/lib/python**/EXTERNALLY-MANAGED
 
-RUN python3.9 -m pip install --upgrade pip
-RUN python3.9 -m pip install debugpy typing_extensions psutil
+# RUN python3.9 -m pip install --upgrade pip
+RUN python3.9 -m pip install debugpy
 
 # Coral Edge TPU
 # https://coral.ai/docs/accelerator/get-started/#runtime-on-linux
@@ -26,13 +35,20 @@ RUN echo "deb https://packages.cloud.google.com/apt coral-edgetpu-stable main" |
 RUN curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
 RUN apt-get -y update && apt-get -y install libedgetpu1-std
 
+# set default shell to bash
+RUN chsh -s /bin/bash
+ENV SHELL="/bin/bash"
+
 ENV SCRYPTED_INSTALL_ENVIRONMENT="docker"
 ENV SCRYPTED_CAN_RESTART="true"
 ENV SCRYPTED_VOLUME="/server/volume"
 ENV SCRYPTED_INSTALL_PATH="/server"
 
-RUN test -f "/usr/bin/ffmpeg"
+RUN test -f "/usr/bin/ffmpeg" && test -f "/usr/bin/python3" && test -f "/usr/bin/python3.9" && test -f "/usr/bin/python3.12"
 ENV SCRYPTED_FFMPEG_PATH="/usr/bin/ffmpeg"
+ENV SCRYPTED_PYTHON_PATH="/usr/bin/python3"
+ENV SCRYPTED_PYTHON39_PATH="/usr/bin/python3.9"
+ENV SCRYPTED_PYTHON312_PATH="/usr/bin/python3.12"
 
 ENV SCRYPTED_DOCKER_FLAVOR="full"
 

install/docker/template/Dockerfile.full.header

@@ -3,7 +3,7 @@
 # This common file will be used by both Docker and the linux
 # install script.
 ################################################################
-ARG BASE="jammy"
+ARG BASE="noble"
 FROM ubuntu:${BASE} as header
 
 ENV DEBIAN_FRONTEND=noninteractive
@@ -11,17 +11,12 @@ ENV DEBIAN_FRONTEND=noninteractive
 # base tools and development stuff
 RUN apt-get update && apt-get -y install \
     curl software-properties-common apt-utils \
-    build-essential \
-    cmake \
     ffmpeg \
-    gcc \
-    libcairo2-dev \
-    libgirepository1.0-dev \
     pkg-config && \
     apt-get -y update && \
     apt-get -y upgrade
 
-ARG NODE_VERSION=18
+ARG NODE_VERSION=22
 RUN apt-get install -y ca-certificates curl gnupg
 RUN mkdir -p /etc/apt/keyrings
 RUN curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor --yes -o /etc/apt/keyrings/nodesource.gpg
@@ -37,16 +32,12 @@ RUN apt-get -y install \
     python3-setuptools \
     python3-wheel
 
-# these are necessary for pillow-simd, additional on disk size is small
-# but could consider removing this.
-RUN echo "Installing pillow-simd dependencies."
-RUN apt-get -y install \
-    libjpeg-dev zlib1g-dev
-
 # gstreamer native https://gstreamer.freedesktop.org/documentation/installing/on-linux.html?gi-language=c#install-gstreamer-on-ubuntu-or-debian
 RUN echo "Installing gstreamer."
+# python-codecs pygobject dependencies
+RUN apt-get -y install libcairo2-dev libgirepository1.0-dev
 RUN apt-get -y install \
-    gstreamer1.0-tools gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-plugins-bad gstreamer1.0-libav gstreamer1.0-alsa \
+    gstreamer1.0-tools gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-plugins-bad gstreamer1.0-libav \
     gstreamer1.0-vaapi
 
 # python3 gstreamer bindings
@@ -57,8 +48,9 @@ RUN apt-get -y install \
 # allow pip to install to system
 RUN rm -f /usr/lib/python**/EXTERNALLY-MANAGED
 
-RUN python3 -m pip install --upgrade pip
-RUN python3 -m pip install debugpy typing_extensions psutil
+# ERROR: Cannot uninstall pip 24.0, RECORD file not found. Hint: The package was installed by debian.
+# RUN python3 -m pip install --upgrade pip
+RUN python3 -m pip install debugpy
 
 ################################################################
 # End section generated from template/Dockerfile.full.header

install/local/install-scrypted-dependencies-linux.sh

@@ -89,8 +89,15 @@ USER_HOME=$(eval echo ~$SERVICE_USER)
 echo "Setting permissions on $USER_HOME/.scrypted"
 chown -R $SERVICE_USER $USER_HOME/.scrypted
 
+echo "Stopping docker service if it exists..."
+cd $USER_HOME/.scrypted
+echo "docker compose down"
+sudo -u $SERVICE_USER docker compose down 2> /dev/null
+echo "docker compose rm -rf"
+sudo -u $SERVICE_USER docker rm -f /scrypted /scrypted-watchtower 2> /dev/null
+
 echo "Installing Scrypted..."
-RUN sudo -u $SERVICE_USER npx -y scrypted@latest install-server
+RUN sudo -u $SERVICE_USER npx -y scrypted@latest install-server $SCRYPTED_INSTALL_VERSION
 
 cat > /etc/systemd/system/scrypted.service <<EOT
 
@@ -103,10 +110,12 @@ User=$SERVICE_USER
 Group=$SERVICE_USER
 Type=simple
 ExecStart=/usr/bin/npx -y scrypted serve
-Restart=on-failure
+Restart=always
 RestartSec=3
 Environment="NODE_OPTIONS=$NODE_OPTIONS"
 Environment="SCRYPTED_INSTALL_ENVIRONMENT=$SCRYPTED_INSTALL_ENVIRONMENT"
+StandardOutput=null
+StandardError=null
 
 [Install]
 WantedBy=multi-user.target

install/local/install-scrypted-dependencies-mac.sh

@@ -39,14 +39,13 @@ launchctl unload ~/Library/LaunchAgents/app.scrypted.server.plist || echo ""
 echo "Installing Scrypted dependencies..."
 RUN_IGNORE xcode-select --install
 RUN brew update
-RUN_IGNORE brew install node@18
-# snapshot plugin and others
-RUN brew install libvips
-# dlib
-RUN brew install cmake
 
-# seems to be necessary for python-codecs' pycairo dependency or something?
-RUN_IGNORE gobject-introspection libffi pkg-config
+# in sequoia, brew node is unusable because it is not signed and can't access local network unless run as root.
+# https://developer.apple.com/forums/thread/766270
+RUN_IGNORE curl -L https://nodejs.org/dist/v22.14.0/node-v22.14.0.pkg -o /tmp/node.pkg
+RUN_IGNORE sudo installer -pkg /tmp/node.pkg -target /
+NODE_PATH=/usr/local # used to pass var test
+NODE_BIN_PATH=/usr/local/bin
 
 # gstreamer plugins
 RUN_IGNORE brew install gstreamer
@@ -71,27 +70,28 @@ then
 fi
 
 RUN python$PYTHON_VERSION -m pip install --upgrade pip
+# besides debugpy, none of these dependencies are needed anymore?
+# portable python includes typing and does not need typing_extensions.
+# opencv-python-headless has wheels for macos.
 if [ "$PYTHON_VERSION" != "3.10" ]
 then
     RUN python$PYTHON_VERSION -m pip install typing
 fi
-RUN python$PYTHON_VERSION -m pip install debugpy typing_extensions opencv-python psutil
+RUN python$PYTHON_VERSION -m pip install debugpy typing_extensions opencv-python
 
 echo "Installing Scrypted Launch Agent..."
 
 RUN mkdir -p ~/Library/LaunchAgents
 
-NODE_PATH=$(brew --prefix node@18)
 if [ ! -d "$NODE_PATH" ]
 then
-    echo "Unable to determine node@18 path."
+    echo "Unable to determine node path."
     exit 1
 fi
 
-NODE_BIN_PATH=$NODE_PATH/bin
 if [ ! -d "$NODE_BIN_PATH" ]
 then
-    echo "Unable to determine node@18 bin path."
+    echo "Unable to determine node bin path."
     echo "$NODE_BIN_PATH does not exist."
     exit 1
 fi
@@ -121,7 +121,7 @@ then
 fi
 
 echo "Installing Scrypted..."
-RUN $NPX_PATH -y scrypted@latest install-server
+RUN $NPX_PATH -y scrypted@latest install-server $SCRYPTED_INSTALL_VERSION
 
 cat > ~/Library/LaunchAgents/app.scrypted.server.plist <<EOT
 <?xml version="1.0" encoding="UTF-8"?>
@@ -154,7 +154,7 @@ cat > ~/Library/LaunchAgents/app.scrypted.server.plist <<EOT
             <key>NODE_OPTIONS</key>
                 <string>$NODE_OPTIONS</string>
             <key>PATH</key>
-                <string>$NODE_BIN_PATH:$PYTHON_BIN_PATH:$BREW_PREFIX/bin:$BREW_PREFIX/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+                <string>$PYTHON_BIN_PATH:$NODE_BIN_PATH:$BREW_PREFIX/bin:$BREW_PREFIX/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
             <key>HOME</key>
                 <string>/Users/$USER</string>
             <key>SCRYPTED_PYTHON_PATH</key>

install/local/install-scrypted-dependencies-win.ps1

@@ -1,3 +1,14 @@
+# Check if the script is running as administrator
+$IsAdmin = [System.Security.Principal.WindowsPrincipal] [System.Security.Principal.WindowsIdentity]::GetCurrent()
+$AdminRole = [System.Security.Principal.WindowsBuiltInRole]::Administrator
+
+if (-not $IsAdmin.IsInRole($AdminRole)) {
+    # If not, relaunch the script with elevated privileges
+    $ScriptPath = $PSCommandPath
+    Start-Process powershell -ArgumentList "-File `"$ScriptPath`"" -Verb RunAs
+    exit
+}
+
 # Set-PSDebug -Trace 1
 
 # stop existing service if any
@@ -8,8 +19,12 @@ sc.exe stop scrypted.exe
 iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
 
 # Install node.js
-choco upgrade -y nodejs-lts --version=18.14.0
+choco upgrade -y nodejs-lts --version=22.15.0
 
+# Install VC Redist, which is necessary for portable python
+choco install -y vcredist140
+
+# TODO: remove python install, and use portable python
 # Install Python
 choco upgrade -y python39
 # Run py.exe with a specific version
@@ -18,11 +33,24 @@ $SCRYPTED_WINDOWS_PYTHON_VERSION="-3.9"
 # Refresh environment variables for py and npx to work
 $env:Path = [System.Environment]::GetEnvironmentVariable("Path","Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path","User") 
 
+# Workaround Windows Node no longer creating %APPDATA%\npm which causes npx to fail
+# Fixed in newer versions of NPM but not the one bundled with Node 2x
+# https://github.com/nodejs/node/issues/53538
+npm i -g npm
 
 py $SCRYPTED_WINDOWS_PYTHON_VERSION -m pip install --upgrade pip
+# besides debugpy, none of these dependencies are needed anymore?
+# portable python includes typing and does not need typing_extensions.
+# opencv-python-headless has wheels for windows.
 py $SCRYPTED_WINDOWS_PYTHON_VERSION -m pip install debugpy typing_extensions typing opencv-python
 
-npx -y scrypted@latest install-server
+$SCRYPTED_INSTALL_VERSION=[System.Environment]::GetEnvironmentVariable("SCRYPTED_INSTALL_VERSION","User")
+
+if ($SCRYPTED_INSTALL_VERSION -eq $null) {
+  npx -y scrypted@latest install-server
+} else {
+  npx -y scrypted@latest install-server $SCRYPTED_INSTALL_VERSION 
+}
 
 $USER_HOME_ESCAPED = $env:USERPROFILE.replace('\', '\\')
 $SCRYPTED_HOME = $env:USERPROFILE + '\.scrypted'
@@ -30,7 +58,10 @@ $SCRYPTED_HOME_ESCAPED_PATH = $SCRYPTED_HOME.replace('\', '\\')
 npm install --prefix $SCRYPTED_HOME @koush/node-windows --save
 
 $NPX_PATH = (Get-Command npx).Path
-$NPX_PATH_ESCAPED = $NPX_PATH.replace('\', '\\')
+# The path needs double quotes to handle spaces in the directory path
+$NPX_PATH_ESCAPED = '"' + $NPX_PATH.replace('\', '\\') + '"'
+# On newer versions of NPM, the NPX might be a .ps1 file which doesn't work with child_process.spawn, change to .cmd
+$NPX_PATH_ESCAPED = $NPX_PATH_ESCAPED.replace('.ps1', '.cmd')
 
 $SERVICE_JS = @"
 const fs = require('fs');
@@ -40,8 +71,12 @@ try {
 catch (e) {
 }
 const child_process = require('child_process');
-child_process.spawn('$($NPX_PATH_ESCAPED)', ['-y', 'scrypted', 'serve'], {
+child_process.spawn('$NPX_PATH_ESCAPED', ['-y', 'scrypted', 'serve'], {
     stdio: 'inherit',
+    // allow spawning .cmd https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+    shell: true,
+}).on('error', (err) => {
+    console.error('Error spawning child process', err);
 });
 "@
 
@@ -87,6 +122,9 @@ svc.on("install", () => {
 svc.on("start", () => {
   console.log("Service started");
 });
+svc.on("error", (err) => {
+  console.log("Service error", err);
+});
 svc.install();
 "@
 

install/local/install-scrypted-proxmox.sh

@@ -1,84 +0,0 @@
-function readyn() {
-    while true; do
-        read -p "$1 (y/n) " yn
-        case $yn in
-            [Yy]* ) break;;
-            [Nn]* ) break;;
-            * ) echo "Please answer yes or no. (y/n)";;
-        esac
-    done
-}
-
-cd /tmp
-SCRYPTED_VERSION=v0.80.0
-SCRYPTED_TAR_ZST=scrypted-$SCRYPTED_VERSION.tar.zst
-if [ -z "$VMID" ]
-then
-    VMID=10443
-fi
-
-echo "Downloading scrypted container backup."
-if [ ! -f "$SCRYPTED_TAR_ZST" ]
-then
-    curl -O -L https://github.com/koush/scrypted/releases/download/$SCRYPTED_VERSION/scrypted.tar.zst
-    mv scrypted.tar.zst $SCRYPTED_TAR_ZST
-fi
-
-echo "Checking for existing container."
-pct config $VMID
-if [ "$?" == "0" ]
-then
-    echo ""
-    echo "Existing container $VMID found. Run this script with --force to overwrite the existing container."
-    echo "This will wipe all existing data. Clone the existing container to retain the data, then reassign the owner of the scrypted volume after installation is complete."
-    echo ""
-    echo "bash $0 --force"
-    echo ""
-fi
-
-pct restore $VMID $SCRYPTED_TAR_ZST $@
-
-if [ "$?" != "0" ]
-then
-    echo ""
-    echo "pct restore failed"
-    echo ""
-    echo "This may be caused by the server's 'local' storage not supporting containers."
-    echo "Try running this script again with a different storage device (local-lvm, local-zfs). For example:"
-    echo ""
-    echo "bash $0 --storage local-lvm"
-    echo ""
-    exit 1
-fi
-
-pct set $VMID -net0 name=eth0,bridge=vmbr0,ip=dhcp,ip6=auto
-if [ "$?" != "0" ]
-then
-    echo ""
-    echo "pct set network failed"
-    echo ""
-    echo "Ignoring... Please verify your container's network settings."
-fi
-
-CONF=/etc/pve/lxc/$VMID.conf
-if [ -f "$CONF" ]
-then
-    echo "onboot: 1" >> $CONF
-else
-    echo "$CONF not found? Start on boot must be enabled manually."    
-fi
-
-echo "Adding udev rule: /etc/udev/rules.d/65-scrypted.rules"
-readyn "Add udev rule for hardware acceleration? This may conflict with existing rules."
-if [ "$yn" == "y" ]
-then
-    sh -c "echo 'SUBSYSTEM==\"apex\", MODE=\"0666\"' > /etc/udev/rules.d/65-scrypted.rules"
-    sh -c "echo 'KERNEL==\"renderD128\", MODE=\"0666\"' >> /etc/udev/rules.d/65-scrypted.rules"
-    sh -c "echo 'KERNEL==\"card0\", MODE=\"0666\"' >> /etc/udev/rules.d/65-scrypted.rules"
-    sh -c "echo 'SUBSYSTEM==\"usb\", ATTRS{idVendor}==\"1a6e\", ATTRS{idProduct}==\"089a\", MODE=\"0666\"' >> /etc/udev/rules.d/65-scrypted.rules"
-    sh -c "echo 'SUBSYSTEM==\"usb\", ATTRS{idVendor}==\"18d1\", ATTRS{idProduct}==\"9302\", MODE=\"0666\"' >> /etc/udev/rules.d/65-scrypted.rules"
-    udevadm control --reload-rules && udevadm trigger
-fi
-
-echo "Scrypted setup is complete and the container resources can be started."
-echo "Scrypted NVR users should provide at least 4 cores and 16GB RAM prior to starting."