MoQ Ingest

id

A unique identifier for the component instance

displayName

The name shown in the Studio UI of this component

namespace

MoQT namespace tuple, slash-separated (e.g. 'stage/primary'). Used in client mode to subscribe to a relay; ignored in listener mode (set 'listener.namespacePrefix' instead). (default: "norsk")

url

Optional: moqts:// or https:// URL of a relay to pull from, or iroh://<hex-node-id> to dial a peer by its iroh NodeId. Leave empty for listener-only mode.

listener

Optional: open a QUIC/WebTransport listener to accept direct publisher connections

disableTlsVerify

Dev only: disable TLS verification on outbound connections (default: false)

initialState

The ingest state of this component on start-up (default: "enabled")

c2paVerification

Validate every incoming init and media segment against the C2PA Live Video continuity chain. Reporting-only: media continues to flow regardless of outcome. Default is disabled. (default: {"type":"disabled"})

notes

Additional notes about this component

namespacePrefix

Namespace prefix tuple, slash-separated (e.g. 'norsk' or 'stage/primary'). Matched segment-by-segment against each incoming publisher's tuple — so 'stage/primary' routes [stage, primary, …​] but NOT [stage, primaryextra]. Multiple MoQ ingests on the same listener pool must use distinct prefixes. (default: "norsk/")

quicServerPort

QUIC listener port for native MoQT publishers

webTransportPort

WebTransport listener port for browser publishers (must differ from QUIC port)

quicServerCert

TLS certificate file path (required when a port is set)

quicServerKey

TLS private key file path (required when a port is set)

iroh

Also accept publishers over the instance's shared iroh endpoint: remote encoders dial iroh://<NodeId> — no port, cert or inbound firewall hole. Peers must be on the endpoint's allow-list (NORSK_IROH_ALLOWED_PEERS or norsk.system.iroh). The NodeId to hand to publishers appears on the component once running. (default: false)

allowedNamespaces

Full publisher namespaces to allow, each slash-separated (e.g. ['norsk/stage/primary']). Leave empty to accept any publisher that matches the prefix. (default: [])

type

"disabled"

type

"segmentManifestBox"

trustAnchorsPath

Optional path to a PEM-encoded bundle of trusted root certificates. Leave empty to use the c2pa-rs default trust list. Set this when verifying content signed against a self-signed / private trust root.

type

"verifiableSegmentInfo"

trustAnchorsPath

Optional path to a PEM-encoded bundle of trusted root certificates. Leave empty to use the c2pa-rs default trust list. Set this when verifying content signed against a self-signed / private trust root.

quicServerPort

QUIC listener port for native MoQT subscribers (optional — only needed for non-browser clients)

webTransportPort

WebTransport listener port for browser MoQ players. Defaults to 4443. (default: 4443)

quicServerCert

TLS certificate file path. If omitted, a self-signed cert is auto-generated (14-day validity, rotated every 10 days).

quicServerKey

TLS private key file path. If omitted, auto-generated alongside the cert.

serveFingerprint

Publishes the cert SHA-256 so the moq-js player can trust it via WebTransport's serverCertificateHashes. Defaults on. (default: true)

secretKeyFile

Identity key file path on the Norsk instance. Created (mode 0600) if absent, so the NodeId is stable across restarts. Leave empty for an ephemeral identity (new NodeId every engine start).

relayMode

'default' uses n0's public relays + discovery for NAT traversal; 'disabled' allows direct paths only (LAN / explicit addr hints). Ignored when custom relay URLs are set. (default: "default")

relayUrls

Self-hosted iroh relay URLs (https://…). Setting any switches to custom relay mode and avoids n0 infrastructure entirely; peers then dial with the relay URL as a hint (iroh://<NodeId>?relay=<url>). Not valid with relay mode 'disabled'. (default: [])

allowedPeers

Remote NodeIds (64-char hex) allowed to connect inbound. The TLS handshake verifies the dialling peer's key, so this is an SSH authorized_keys model. (default: [])

allowedPeersFile

Allow-list file path on the Norsk instance (one hex NodeId per line, # comments).

allowAnyPeer

Accept connections from ANY peer. Explicit opt-in for open ingest or dev — never the default. (default: false)