MoQ Ingest

id

A unique identifier for the component instance

displayName

The name shown in the Studio UI of this component

namespace

MoQT namespace tuple, slash-separated (e.g. 'stage/primary'). Used in client mode to subscribe to a relay; ignored in listener mode (set 'listener.namespacePrefix' instead). (default: "norsk")

url

Optional: moqts:// or https:// URL of a relay to pull from, or iroh://<hex-node-id> to dial a peer by its iroh NodeId. Leave empty for listener-only mode.

<COMPONENT_ID>_URL

listener

Optional: open a QUIC/WebTransport listener to accept direct publisher connections

disableTlsVerify

Dev only: disable TLS verification on outbound connections (default: false)

initialState

The ingest state of this component on start-up (default: "enabled")

<COMPONENT_ID>_INITIALSTATE

c2paVerification

Validate every incoming init and media segment against the C2PA Live Video continuity chain. Reporting-only: media continues to flow regardless of outcome. Default is disabled. (default: {"type":"disabled"})

notes

Additional notes about this component

namespacePrefix

Namespace prefix tuple, slash-separated (e.g. 'norsk' or 'stage/primary'). Matched segment-by-segment against each incoming publisher's tuple — so 'stage/primary' routes [stage, primary, …​] but NOT [stage, primaryextra]. Multiple MoQ ingests on the same listener pool must use distinct prefixes. (default: "norsk/")

quicServerPort

QUIC listener port for native MoQT publishers

webTransportPort

WebTransport listener port for browser publishers (must differ from QUIC port)

quicServerCert

TLS certificate file path (required when a port is set)

quicServerKey

TLS private key file path (required when a port is set)

iroh

Also accept publishers over the instance's shared iroh endpoint: remote encoders dial iroh://<NodeId> — no port, cert or inbound firewall hole. Peers must be on the endpoint's allow-list (NORSK_IROH_ALLOWED_PEERS or norsk.system.iroh). The NodeId to hand to publishers appears on the component once running. (default: false)

allowedNamespaces

Full publisher namespaces to allow, each slash-separated (e.g. ['norsk/stage/primary']). Leave empty to accept any publisher that matches the prefix. (default: [])

type

"disabled"

type

"segmentManifestBox"

trustAnchorsPath

Optional path to a PEM-encoded bundle of trusted root certificates. Leave empty to use the c2pa-rs default trust list. Set this when verifying content signed against a self-signed / private trust root.

type

"verifiableSegmentInfo"

trustAnchorsPath

Optional path to a PEM-encoded bundle of trusted root certificates. Leave empty to use the c2pa-rs default trust list. Set this when verifying content signed against a self-signed / private trust root.

quicServerPort

QUIC listener port for native MoQT subscribers (optional — only needed for non-browser clients)

webTransportPort

WebTransport listener port for browser MoQ players. Defaults to 4443. (default: 4443)

publicHost

The hostname browsers reach MoQ on, when it is not the public hostname (PUBLIC_URL_PREFIX): e.g. a host whose web UI is reached over an SSH tunnel while its media ports are public. Applies to the listener above and, when no Relay public URL is set, to the relay.

quicServerCert

TLS certificate file path. If omitted, a self-signed cert is auto-generated (14-day validity, rotated every 10 days).

quicServerKey

TLS private key file path. If omitted, auto-generated alongside the cert.

serveFingerprint

Publishes the cert SHA-256 so the moq-js player can trust it via WebTransport's serverCertificateHashes. Defaults on. Turn it off when the certificate is CA-issued and the browser trusts it already. (default: true)

relayUrl

Publish through a shared MoQ relay instead of binding a listener here. Setting this switches every MoQ component to relay mode and the ports/cert above are no longer used, so several Norsk instances on one host can share a single MoQ port. This is how NORSK reaches the relay, which behind a proxy is an internal address.

relayPublicUrl

What the BROWSER connects to, if that differs from the Relay URL. Leave blank to use the public hostname (PUBLIC_URL_PREFIX) with the Relay URL's port.

relayNamespacePrefix

Prepended to every namespace this instance publishes to the relay, so instances sharing one relay stay distinct. Usually the instance name.

relayDisableTlsVerify

Skip TLS verification when connecting to the relay. Needed only for a relay with a self-signed certificate. (default: false)

secretKeyFile

Identity key file path on the Norsk instance. Created (mode 0600) if absent, so the NodeId is stable across restarts. Leave empty for an ephemeral identity (new NodeId every engine start).

relayMode

'default' uses n0's public relays + discovery for NAT traversal; 'disabled' allows direct paths only (LAN / explicit addr hints). Ignored when custom relay URLs are set. (default: "default")

relayUrls

Self-hosted iroh relay URLs (https://…). Setting any switches to custom relay mode and avoids n0 infrastructure entirely; peers then dial with the relay URL as a hint (iroh://<NodeId>?relay=<url>). Not valid with relay mode 'disabled'. (default: [])

allowedPeers

Remote NodeIds (64-char hex) allowed to connect inbound. The TLS handshake verifies the dialling peer's key, so this is an SSH authorized_keys model. (default: [])

allowedPeersFile

Allow-list file path on the Norsk instance (one hex NodeId per line, # comments).

allowAnyPeer

Accept connections from ANY peer. Explicit opt-in for open ingest or dev — never the default. (default: false)