Webserver: reverse proxy or content duplication
We're trying to keep just one SecuritySpy system in house*, but it will have two possibly contradictory purposes: 1) recording a high-security stream of data looking at a vault, and 2) broadcasting a view of this data to one or dozens of people on the public internet.
We would strongly prefer to keep the public internet off of the SS machine doing the archiving, and to use a reverse proxy (or content distributor) do the duplication and public interface for video streams. The reasons for this are at least two: 1) we don't like having the "public internet" touching our internal systems in any circumstance, and 2) in the event of a flash crowd we would like to have the work of duplicating a data stream done on sacrificial hardware and not on the system performing archiving. It seems that this would be a previously solved problem where a reverse proxy (or MJPEG re-broadcaster) could perform both as an application-layer firewall and also as a content duplicator.
I know that Squid, Apache, and others can serve this purpose for simply acting as the firewall. But I'm less certain if they will work as a content distributor/duplicator to distribute a single stream from SecuritySpy and multiply it to the number of hosts asking for it on the proxy. I don't know how motion JPEG streams are handled.
Does anyone have any experience on insight on this?
JT
* - among other things, we operate DNSSEC key servers for various roots, and we do key ceremonies on a regular basis. Boring until it's not.
We would strongly prefer to keep the public internet off of the SS machine doing the archiving, and to use a reverse proxy (or content distributor) do the duplication and public interface for video streams. The reasons for this are at least two: 1) we don't like having the "public internet" touching our internal systems in any circumstance, and 2) in the event of a flash crowd we would like to have the work of duplicating a data stream done on sacrificial hardware and not on the system performing archiving. It seems that this would be a previously solved problem where a reverse proxy (or MJPEG re-broadcaster) could perform both as an application-layer firewall and also as a content duplicator.
I know that Squid, Apache, and others can serve this purpose for simply acting as the firewall. But I'm less certain if they will work as a content distributor/duplicator to distribute a single stream from SecuritySpy and multiply it to the number of hosts asking for it on the proxy. I don't know how motion JPEG streams are handled.
Does anyone have any experience on insight on this?
JT
* - among other things, we operate DNSSEC key servers for various roots, and we do key ceremonies on a regular basis. Boring until it's not.
Comments
-
Hi JT,
Apache does reverse proxy, but in that case every connection to Apache would result in an additional connection to your SecuritySpy server, which is not what you want.
I think the solution would be to use two Macs, each running SecuritySpy, each receiving streams from the same cameras. Mac 1 would do the recording, and would not be accessible from the internet at all (firewall on), Mac 2 would be accessible to the internet and would allow clients to view the live video streams.
Most cameras can supply two streams in this way to two clients (Mac 1 and Mac 2) - you might see a small drop in frame rate though. Alternatively you can have Mac 2 connect to Mac 1 in order to receive the streams, but this would involve poking a hole in Mac 1's firewall, and would put additional load on Mac 1's CPU. Best to offload this work to the cameras if they are capable of it.
The above solution would require two SecuritySpy licenses.
What do you think? -
-
Hi JT, thanks for reporting back! This looks like a good solution that I wasn't previously aware of. It consumes a single stream from the server (i.e. SecuritySpy) and can deliver this to multiple clients, which is perfect.
