New auth scheme

.env.development

@@ -1,3 +1,2 @@
 PUBLIC_RELAY_SCHEME="http"
 PUBLIC_RELAY_HOST="localhost:4443"
-PUBLIC_DEMO_TOKEN=""

.env.production

@@ -1,5 +1,2 @@
 PUBLIC_RELAY_SCHEME="https"
 PUBLIC_RELAY_HOST="relay.quic.video"
-
-# cargo run --bin moq-token -- --key root.jwk sign --path "demo" --subscribe "" > demo.jwt
-PUBLIC_DEMO_TOKEN="eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJwYXRoIjoiZGVtbyIsInB1YiI6bnVsbCwicHViISI6bnVsbCwic3ViIjoiIiwiZXhwIjpudWxsLCJpYXQiOm51bGx9.xeSMuPLRqmjkRLtcraXnvwqmYDK_BuU2ooZOWisL_aE"

env.d.ts

@@ -3,7 +3,6 @@
 interface ImportMetaEnv {
 	readonly PUBLIC_RELAY_SCHEME: "http" | "https";
 	readonly PUBLIC_RELAY_HOST: string;
-	readonly PUBLIC_DEMO_TOKEN: string;
 }
 
 interface ImportMeta {

infra/input.tf

@@ -20,12 +20,12 @@ variable "domain" {
 
 variable "docker_relay" {
   description = "Docker image for moq-relay"
-  default     = "docker.io/kixelated/moq-relay:0.7.5"
+  default     = "docker.io/kixelated/moq-relay:0.7.6"
 }
 
 variable "docker_hang" {
   description = "Docker image for hang"
-  default     = "docker.io/kixelated/hang:0.1.7"
+  default     = "docker.io/kixelated/hang:0.1.8"
 }
 
 # cargo run --bin moq-token -- --key root.jwk generate
@@ -36,7 +36,7 @@ variable "root_key" {
 
 # A token used to publish demo/bbb.hang
 # This is very manual/crude, but I don't want someone to hijack the broadcast.
-# cargo run --bin moq-token -- --key root.jwk sign --path "demo" --publish "" > demo.jwt
+# cargo run --bin moq-token -- --key root.jwk sign --path "demo/bbb.hang" --publish "" > demo.jwt
 variable "demo_token" {
   description = "demo token"
   sensitive   = true

infra/pub.yml.tpl

@@ -20,7 +20,7 @@ write_files:
         -e REGION=${region} \
         --entrypoint hang-bbb \
         ${docker_image} \
-        publish "https://relay.quic.video/${demo_token}.jwt"
+        publish "https://relay.quic.video/demo/bbb.hang?jwt=${demo_token}"
 
       ExecStop=docker stop hang-bbb
 

infra/relay.yml.tpl

@@ -75,9 +75,14 @@ write_files:
       [auth]
       key = "/etc/moq/root.jwk"
 
-      [auth.path]
-      anon = ""
-      hang = ""
+      [auth.path.demo]
+      public = { read = true }
+
+      [auth.path.anon]
+      key = ""
+
+      [auth.path.hang]
+      key = ""
 
     permissions: "0644"
     owner: root

src/components/watch.tsx

@@ -6,7 +6,7 @@ export default function (props: { name: string; token?: string }) {
 	// The signed token is only needed for the demo/ prefix just to prevent abuse.
 	// All other broadcasts go to anon/ which is super easy to spoof.
 	const url = new URL(
-		`${import.meta.env.PUBLIC_RELAY_SCHEME}://${import.meta.env.PUBLIC_RELAY_HOST}/${props.token ? `${props.token}.jwt` : `${props.name}.hang`}`,
+		`${import.meta.env.PUBLIC_RELAY_SCHEME}://${import.meta.env.PUBLIC_RELAY_HOST}/${props.name}${props.token ? `?jwt=${props.token}` : ""}`,
 	);
 
 	return (

src/pages/watch/[name].astro

@@ -16,5 +16,5 @@ import Layout from "@/layouts/global.astro";
 		Watching a <strong>PUBLIC</strong> broadcast. Pls report any abuse on <a href="https://discord.gg/FCYF3p99mr" rel="noreferrer" target="_blank">Discord</a>.
 	</p>
 
-	<Watch client:only="solid-js" name={`anon/${name}`} />
+	<Watch client:only="solid-js" name={`anon/${name}.hang`} />
 </Layout>

src/pages/watch/index.astro

@@ -9,5 +9,5 @@ import Layout from "@/layouts/global.astro";
 <Layout title={`Watch - Demo`} description="Watch a (fake) live broadcast.">
 	<Issues />
 
-	<Watch client:only="solid-js" name="demo/bbb" token={import.meta.env.PUBLIC_DEMO_TOKEN} />
+	<Watch client:only="solid-js" name="demo/bbb.hang" />
 </Layout>