MoQ Egest

id

A unique identifier for the component instance

displayName

The name shown in the Studio UI of this component

namespace

MoQT namespace tuple under which tracks will be published, slash-separated (e.g. 'stage/primary' → segments ['stage', 'primary']) (default: "norsk")

relays

MoQT relays to publish to (e.g. CDN primary and backup) (default: [])

listener

Optional: open a QUIC/WebTransport listener to accept direct subscriber connections

jitterBuffer

Configure the buffer to smooth outgoing data. Leave empty to use global latency profile default. (default: {})

outputTimecode

Embed a PRFT timecode box in CMAF segments for end-to-end latency measurement (default: "none")

initialState

The egest state of this component on start-up (default: "enabled")

c2paSigning

Sign init and media segments with a C2PA Live Video manifest before delivering them. Default is disabled. (default: {"type":"disabled"})

notes

Additional notes about this component

relayUrl

moqts:// or https:// URL of the relay, or iroh://<hex-node-id> to push to a peer by its iroh NodeId

namespace

Optional per-relay namespace override, slash-separated (e.g. 'stage/primary')

disableTlsVerify

Dev only: disable TLS verification on inbound subscribers (default: false)

quicServerPort

QUIC listener port for native MoQT subscribers

webTransportPort

WebTransport listener port for browser subscribers (must differ from QUIC port)

quicServerCert

TLS certificate file path (required when a port is set)

quicServerKey

TLS private key file path (required when a port is set)

iroh

Also accept subscribers over the instance's shared iroh endpoint: remote peers dial iroh://<NodeId> — no port, cert or inbound firewall hole. Peers must be on the endpoint's allow-list (NORSK_IROH_ALLOWED_PEERS or norsk.system.iroh). The NodeId to hand to subscribers appears on the component once running. (default: false)

bufferDelayMs

How many milliseconds in the jitter buffer. Leave empty to use the global latency profile default.

type

"disabled"

type

"segmentManifestBox"

alg

Signing algorithm. Must match the supplied certificate. (default: "es256")

privateKeyPath

Filesystem path (readable by the Norsk Media process) to the PEM-encoded private key. Not the key contents.

signCertPath

Filesystem path (readable by the Norsk Media process) to the PEM-encoded signing certificate. Not the certificate contents.

taUrl

Optional Time Authority URL for timestamping signatures. If omitted, the C2PA_TA_URL environment variable is consulted; if also unset, the manifest is signed without a timestamp token.

streamId

Identifier embedded in every signed segment's c2pa.livevideo.segment assertion. Should be unique per logical stream so downstream validators can correlate the sequence chain. (default: "moq-egest")

chainOfTrust

Derived-signer mode: every output segment carries a parentOf C2PA ingredient pointing back at the verified upstream segment. Requires the input to have c2paVerification enabled — when no verified parent is available the segment is signed unchained and a c2pa_chain_dropped notification fires. (default: false)

type

"verifiableSegmentInfo"

alg

Signing algorithm. Must match the supplied certificate. (default: "es256")

privateKeyPath

Filesystem path (readable by the Norsk Media process) to the PEM-encoded private key. Not the key contents.

signCertPath

Filesystem path (readable by the Norsk Media process) to the PEM-encoded signing certificate. Not the certificate contents.

taUrl

Optional Time Authority URL for timestamping signatures. If omitted, the C2PA_TA_URL environment variable is consulted; if also unset, the manifest is signed without a timestamp token.

streamId

Identifier embedded in every signed segment's c2pa.livevideo.segment assertion. Should be unique per logical stream so downstream validators can correlate the sequence chain. (default: "moq-egest")

validityPeriodSecs

Validity window (seconds) advertised in the §19.4 c2pa.session-keys assertion. Leave empty to use the SDK default (86400, 24h).

quicServerPort

QUIC listener port for native MoQT subscribers (optional — only needed for non-browser clients)

webTransportPort

WebTransport listener port for browser MoQ players. Defaults to 4443. (default: 4443)

quicServerCert

TLS certificate file path. If omitted, a self-signed cert is auto-generated (14-day validity, rotated every 10 days).

quicServerKey

TLS private key file path. If omitted, auto-generated alongside the cert.

serveFingerprint

Publishes the cert SHA-256 so the moq-js player can trust it via WebTransport's serverCertificateHashes. Defaults on. (default: true)

secretKeyFile

Identity key file path on the Norsk instance. Created (mode 0600) if absent, so the NodeId is stable across restarts. Leave empty for an ephemeral identity (new NodeId every engine start).

relayMode

'default' uses n0's public relays + discovery for NAT traversal; 'disabled' allows direct paths only (LAN / explicit addr hints). Ignored when custom relay URLs are set. (default: "default")

relayUrls

Self-hosted iroh relay URLs (https://…). Setting any switches to custom relay mode and avoids n0 infrastructure entirely; peers then dial with the relay URL as a hint (iroh://<NodeId>?relay=<url>). Not valid with relay mode 'disabled'. (default: [])

allowedPeers

Remote NodeIds (64-char hex) allowed to connect inbound. The TLS handshake verifies the dialling peer's key, so this is an SSH authorized_keys model. (default: [])

allowedPeersFile

Allow-list file path on the Norsk instance (one hex NodeId per line, # comments).

allowAnyPeer

Accept connections from ANY peer. Explicit opt-in for open ingest or dev — never the default. (default: false)