Update version to 1.9.0

Fix tests
Remove unused core.Any func
2025-10-04 07:56:33 +08:00 · 2024-04-30 14:38:59 +03:00 · 2024-04-30 14:25:48 +03:00 · 2024-04-30 13:34:24 +03:00 · 2024-04-30 13:32:57 +03:00 · 2024-04-30 11:09:41 +03:00
110 changed files with 3458 additions and 877 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,99 +15,113 @@ jobs:
    env: { CGO_ENABLED: 0 }
    steps:
      - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4

      - name: Setup Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
        with: { go-version: '1.21' }

      - name: Build go2rtc_win64
        env: { GOOS: windows, GOARCH: amd64 }
        run: go build -ldflags "-s -w" -trimpath
      - name: Upload go2rtc_win64
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with: { name: go2rtc_win64, path: go2rtc.exe }

      - name: Build go2rtc_win32
        env: { GOOS: windows, GOARCH: 386 }
        run: go build -ldflags "-s -w" -trimpath
      - name: Upload go2rtc_win32
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with: { name: go2rtc_win32, path: go2rtc.exe }

      - name: Build go2rtc_win_arm64
        env: { GOOS: windows, GOARCH: arm64 }
        run: go build -ldflags "-s -w" -trimpath
      - name: Upload go2rtc_win_arm64
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with: { name: go2rtc_win_arm64, path: go2rtc.exe }

      - name: Build go2rtc_linux_amd64
        env: { GOOS: linux, GOARCH: amd64 }
        run: go build -ldflags "-s -w" -trimpath
      - name: Upload go2rtc_linux_amd64
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with: { name: go2rtc_linux_amd64, path: go2rtc }

      - name: Build go2rtc_linux_i386
        env: { GOOS: linux, GOARCH: 386 }
        run: go build -ldflags "-s -w" -trimpath
      - name: Upload go2rtc_linux_i386
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with: { name: go2rtc_linux_i386, path: go2rtc }

      - name: Build go2rtc_linux_arm64
        env: { GOOS: linux, GOARCH: arm64 }
        run: go build -ldflags "-s -w" -trimpath
      - name: Upload go2rtc_linux_arm64
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with: { name: go2rtc_linux_arm64, path: go2rtc }

      - name: Build go2rtc_linux_arm
        env: { GOOS: linux, GOARCH: arm, GOARM: 7 }
        run: go build -ldflags "-s -w" -trimpath
      - name: Upload go2rtc_linux_arm
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with: { name: go2rtc_linux_arm, path: go2rtc }

      - name: Build go2rtc_linux_armv6
        env: { GOOS: linux, GOARCH: arm, GOARM: 6 }
        run: go build -ldflags "-s -w" -trimpath
      - name: Upload go2rtc_linux_armv6
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with: { name: go2rtc_linux_armv6, path: go2rtc }

      - name: Build go2rtc_linux_mipsel
        env: { GOOS: linux, GOARCH: mipsle }
        run: go build -ldflags "-s -w" -trimpath
      - name: Upload go2rtc_linux_mipsel
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with: { name: go2rtc_linux_mipsel, path: go2rtc }

      - name: Build go2rtc_mac_amd64
        env: { GOOS: darwin, GOARCH: amd64 }
        run: go build -ldflags "-s -w" -trimpath
      - name: Upload go2rtc_mac_amd64
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with: { name: go2rtc_mac_amd64, path: go2rtc }

      - name: Build go2rtc_mac_arm64
        env: { GOOS: darwin, GOARCH: arm64 }
        run: go build -ldflags "-s -w" -trimpath
      - name: Upload go2rtc_mac_arm64
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with: { name: go2rtc_mac_arm64, path: go2rtc }

+      - name: Build go2rtc_freebsd_amd64
+        env: { GOOS: freebsd, GOARCH: amd64 }
+        run: go build -ldflags "-s -w" -trimpath
+      - name: Upload go2rtc_freebsd_amd64
+        uses: actions/upload-artifact@v3
+        with: { name: go2rtc_freebsd_amd64, path: go2rtc }
+
+      - name: Build go2rtc_freebsd_arm64
+        env: { GOOS: freebsd, GOARCH: arm64 }
+        run: go build -ldflags "-s -w" -trimpath
+      - name: Upload go2rtc_freebsd_arm64
+        uses: actions/upload-artifact@v3
+        with: { name: go2rtc_freebsd_arm64, path: go2rtc }
+
  docker-master:
    name: Build docker master
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4

      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
        with:
          images: ${{ github.repository }}
          tags: |
@@ -116,20 +130,20 @@ jobs:
            type=match,pattern=v(.*),group=1

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3

      - name: Login to DockerHub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: |
@@ -148,11 +162,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4

      - name: Docker meta
        id: meta-hw
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
        with:
          images: ${{ github.repository }}
          flavor: |
@@ -164,20 +178,20 @@ jobs:
            type=match,pattern=v(.*),group=1

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3

      - name: Login to DockerHub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
        with:
          context: .
          file: hardware.Dockerfile
--- a/.github/workflows/gh-pages.yml
+++ b/.github/workflows/gh-pages.yml
@@ -25,13 +25,13 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
      - name: Setup Pages
-        uses: actions/configure-pages@v3
+        uses: actions/configure-pages@v4
      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v1
+        uses: actions/upload-pages-artifact@v3
        with:
          path: './website'
      - name: Deploy to GitHub Pages
        id: deployment
-        uses: actions/deploy-pages@v2
+        uses: actions/deploy-pages@v4
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,10 +21,10 @@ jobs:
      GOARCH: ${{ matrix.arch }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4

      - name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v5
        with:
          go-version: '1.21'

@@ -70,13 +70,13 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
      - name: Build and push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/${{ matrix.platform }}
@@ -89,7 +89,7 @@ jobs:

      - name: Build and push Hardware
        if: matrix.platform == 'amd64'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
        with:
          context: .
          file: hardware.Dockerfile
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,5 @@ go2rtc.yaml
 go2rtc.json

 0_test.go
+
+.DS_Store
--- a/README.md
+++ b/README.md
@@ -1,9 +1,12 @@
-# go2rtc
+<h1 align="center">

-[![](https://img.shields.io/github/stars/AlexxIT/go2rtc?style=flat-square&logo=github)](https://github.com/AlexxIT/go2rtc/stargazers) 
-[![](https://img.shields.io/docker/pulls/alexxit/go2rtc?style=flat-square&logo=docker&logoColor=white&label=pulls)](https://hub.docker.com/r/alexxit/go2rtc) 
-[![](https://img.shields.io/github/downloads/AlexxIT/go2rtc/total?color=blue&style=flat-square&logo=github)](https://github.com/AlexxIT/go2rtc/releases)
-[![](https://goreportcard.com/badge/github.com/AlexxIT/go2rtc)](https://goreportcard.com/report/github.com/AlexxIT/go2rtc)
+  ![go2rtc](assets/logo.png)
+  <br>
+  [![stars](https://img.shields.io/github/stars/AlexxIT/go2rtc?style=flat-square&logo=github)](https://github.com/AlexxIT/go2rtc/stargazers) 
+  [![docker pulls](https://img.shields.io/docker/pulls/alexxit/go2rtc?style=flat-square&logo=docker&logoColor=white&label=pulls)](https://hub.docker.com/r/alexxit/go2rtc) 
+  [![releases](https://img.shields.io/github/downloads/AlexxIT/go2rtc/total?color=blue&style=flat-square&logo=github)](https://github.com/AlexxIT/go2rtc/releases)
+  [![goreport](https://goreportcard.com/badge/github.com/AlexxIT/go2rtc)](https://goreportcard.com/report/github.com/AlexxIT/go2rtc)
+</h1>

 Ultimate camera streaming application with support RTSP, WebRTC, HomeKit, FFmpeg, RTMP, etc.

@@ -23,7 +26,7 @@ Ultimate camera streaming application with support RTSP, WebRTC, HomeKit, FFmpeg
   - mixing tracks from different sources to single stream
   - auto match client supported codecs
   - [2-way audio](#two-way-audio) for some cameras
- streaming from private networks via [Ngrok](#module-ngrok)
+- streaming from private networks via [ngrok](#module-ngrok)
 - can be [integrated to](#module-api) any smart home platform or be used as [standalone app](#go2rtc-binary)

 **Inspired by:**
@@ -34,6 +37,7 @@ Ultimate camera streaming application with support RTSP, WebRTC, HomeKit, FFmpeg
 - [GStreamer](https://gstreamer.freedesktop.org/) framework pipeline idea
 - [MediaSoup](https://mediasoup.org/) framework routing idea
 - HomeKit Accessory Protocol from [@brutella](https://github.com/brutella/hap)
+- creator of the project's logo [@v_novoseltsev](https://www.instagram.com/v_novoseltsev) 

 ---

@@ -54,11 +58,13 @@ Ultimate camera streaming application with support RTSP, WebRTC, HomeKit, FFmpeg
    * [Source: FFmpeg Device](#source-ffmpeg-device)
    * [Source: Exec](#source-exec)
    * [Source: Echo](#source-echo)
+    * [Source: Expr](#source-expr)
    * [Source: HomeKit](#source-homekit)
    * [Source: Bubble](#source-bubble)
    * [Source: DVRIP](#source-dvrip)
    * [Source: Tapo](#source-tapo)
    * [Source: Kasa](#source-kasa)
+    * [Source: GoPro](#source-gopro)
    * [Source: Ivideon](#source-ivideon)
    * [Source: Hass](#source-hass)
    * [Source: ISAPI](#source-isapi)
@@ -75,7 +81,7 @@ Ultimate camera streaming application with support RTSP, WebRTC, HomeKit, FFmpeg
  * [Module: WebRTC](#module-webrtc)
  * [Module: HomeKit](#module-homekit)
  * [Module: WebTorrent](#module-webtorrent)
-  * [Module: Ngrok](#module-ngrok)
+  * [Module: ngrok](#module-ngrok)
  * [Module: Hass](#module-hass)
  * [Module: MP4](#module-mp4)
  * [Module: HLS](#module-hls)
@@ -125,7 +131,7 @@ Don't forget to fix the rights `chmod +x go2rtc_xxx_xxx` on Linux and Mac.

 ### go2rtc: Docker

-Container [alexxit/go2rtc](https://hub.docker.com/r/alexxit/go2rtc) with support `amd64`, `386`, `arm64`, `arm`. This container is the same as [Home Assistant Add-on](#go2rtc-home-assistant-add-on), but can be used separately from Home Assistant. Container has preinstalled [FFmpeg](#source-ffmpeg), [Ngrok](#module-ngrok) and [Python](#source-echo).
+Container [alexxit/go2rtc](https://hub.docker.com/r/alexxit/go2rtc) with support `amd64`, `386`, `arm64`, `arm`. This container is the same as [Home Assistant Add-on](#go2rtc-home-assistant-add-on), but can be used separately from Home Assistant. Container has preinstalled [FFmpeg](#source-ffmpeg), [ngrok](#module-ngrok) and [Python](#source-echo).

 ### go2rtc: Home Assistant Add-on

@@ -144,13 +150,13 @@ Container [alexxit/go2rtc](https://hub.docker.com/r/alexxit/go2rtc) with support

 Latest, but maybe unstable version:

- Binary: GitHub > [Actions](https://github.com/AlexxIT/go2rtc/actions) > [Build and Push](https://github.com/AlexxIT/go2rtc/actions/workflows/build.yml) > latest run > Artifacts section (you should be logged in to GitHub)
+- Binary: [latest nightly release](https://nightly.link/AlexxIT/go2rtc/workflows/build/master)
 - Docker: `alexxit/go2rtc:master` or `alexxit/go2rtc:master-hardware` versions
 - Hass Add-on: `go2rtc master` or `go2rtc master hardware` versions

 ## Configuration

- by default go2rtc will search `go2rtc.yaml` in the current work dirrectory
+- by default go2rtc will search `go2rtc.yaml` in the current work directory
 - `api` server will start on default **1984 port** (TCP)
 - `rtsp` server will start on default **8554 port** (TCP)
 - `webrtc` will use port **8555** (TCP/UDP) for connections
@@ -168,7 +174,7 @@ Available modules:
 - [hls](#module-hls) - HLS TS or fMP4 stream Server
 - [mjpeg](#module-mjpeg) - MJPEG Server
 - [ffmpeg](#source-ffmpeg) - FFmpeg integration
- [ngrok](#module-ngrok) - Ngrok integration (external access for private network)
+- [ngrok](#module-ngrok) - ngrok integration (external access for private network)
 - [hass](#module-hass) - Home Assistant integration
 - [log](#module-log) - logs config

@@ -186,11 +192,13 @@ Available source types:
 - [ffmpeg:device](#source-ffmpeg-device) - local USB Camera or Webcam
 - [exec](#source-exec) - get media from external app output
 - [echo](#source-echo) - get stream link from bash or python
+- [expr](#source-expr) - get stream link via built-in expression language
 - [homekit](#source-homekit) - streaming from HomeKit Camera
 - [bubble](#source-bubble) - streaming from ESeeCloud/dvr163 NVR
 - [dvrip](#source-dvrip) - streaming from DVR-IP NVR
 - [tapo](#source-tapo) - TP-Link Tapo cameras with [two way audio](#two-way-audio) support
 - [kasa](#source-tapo) - TP-Link Kasa cameras
+- [gopro](#source-gopro) - GoPro cameras
 - [ivideon](#source-ivideon) - public cameras from [Ivideon](https://tv.ivideon.com/) service
 - [hass](#source-hass) - Home Assistant integration
 - [isapi](#source-isapi) - two way audio for Hikvision (ISAPI) cameras
@@ -209,6 +217,7 @@ Supported for sources:
 - [TP-Link Tapo](#source-tapo) cameras
 - [Hikvision ISAPI](#source-isapi) cameras
 - [Roborock vacuums](#source-roborock) models with cameras
+- [Exec](#source-exec) audio on server
 - [Any Browser](#incoming-browser) as IP-camera

 Two way audio can be used in browser with [WebRTC](#module-webrtc) technology. The browser will give access to the microphone only for HTTPS sites ([read more](https://stackoverflow.com/questions/52759992/how-to-access-camera-and-microphone-in-chrome-without-https)).
@@ -226,7 +235,7 @@ streams:
  amcrest_doorbell:
    - rtsp://username:password@192.168.1.123:554/cam/realmonitor?channel=1&subtype=0#backchannel=0
  unifi_camera: rtspx://192.168.1.123:7441/fD6ouM72bWoFijxK
-  glichy_camera: ffmpeg:rstp://username:password@192.168.1.123/live/ch00_1 
+  glichy_camera: ffmpeg:rtsp://username:password@192.168.1.123/live/ch00_1 
 ```

 **Recommendations**
@@ -261,7 +270,7 @@ streams:

 #### Source: RTMP

-You can get stream from RTMP server, for example [Frigate](https://docs.frigate.video/configuration/rtmp).
+You can get stream from RTMP server, for example [Nginx with nginx-rtmp-module](https://github.com/arut/nginx-rtmp-module).

 ```yaml
 streams:
@@ -301,6 +310,8 @@ streams:

 #### Source: ONVIF

+*[New in v1.5.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.5.0)*
+
 The source is not very useful if you already know RTSP and snapshot links for your camera. But it can be useful if you don't.

 **WebUI > Add** webpage support ONVIF autodiscovery. Your server must be on the same subnet as the camera. If you use docker, you must use "network host".
@@ -393,24 +404,34 @@ streams:

 #### Source: Exec

-Exec source can run any external application and expect data from it. Two transports are supported - **pipe** and **RTSP**.
+Exec source can run any external application and expect data from it. Two transports are supported - **pipe** (*from [v1.5.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.5.0)*) and **RTSP**.

 If you want to use **RTSP** transport - the command must contain the `{output}` argument in any place. On launch, it will be replaced by the local address of the RTSP server.

-**pipe** reads data from app stdout in different formats: **MJPEG**, **H.264/H.265 bitstream**, **MPEG-TS**.
+**pipe** reads data from app stdout in different formats: **MJPEG**, **H.264/H.265 bitstream**, **MPEG-TS**. Also pipe can write data to app stdin in two formats: **PCMA** and **PCM/48000**.

 The source can be used with:

 - [FFmpeg](https://ffmpeg.org/) - go2rtc ffmpeg source just a shortcut to exec source
+- [FFplay](https://ffmpeg.org/ffplay.html) - play audio on your server
 - [GStreamer](https://gstreamer.freedesktop.org/)
 - [Raspberry Pi Cameras](https://www.raspberrypi.com/documentation/computers/camera_software.html)
 - any your own software

+Pipe commands support parameters (format: `exec:{command}#{param1}#{param2}`):
+
+- `killsignal` - signal which will be send to stop the process (numeric form)
+- `killtimeout` - time in seconds for forced termination with sigkill
+- `backchannel` - enable backchannel for two-way audio
+
 ```yaml
 streams:
  stream: exec:ffmpeg -re -i /media/BigBuckBunny.mp4 -c copy -rtsp_transport tcp -f rtsp {output}
  picam_h264: exec:libcamera-vid -t 0 --inline -o -
  picam_mjpeg: exec:libcamera-vid -t 0 --codec mjpeg -o -
+  canon: exec:gphoto2 --capture-movie --stdout#killsignal=2#killtimeout=5
+  play_pcma: exec:ffplay -fflags nobuffer -f alaw -ar 8000 -i -#backchannel=1
+  play_pcm48k: exec:ffplay -fflags nobuffer -f s16be -ar 48000 -i -#backchannel=1
 ```

 #### Source: Echo
@@ -426,6 +447,12 @@ streams:
  apple_hls: echo:python3 hls.py https://developer.apple.com/streaming/examples/basic-stream-osx-ios5.html
 ```

+#### Source: Expr
+
+*[New in v1.8.2](https://github.com/AlexxIT/go2rtc/releases/tag/v1.8.2)*
+
+Like `echo` source, but uses the built-in [expr](https://github.com/antonmedv/expr) expression language ([read more](https://github.com/AlexxIT/go2rtc/blob/master/internal/expr/README.md)).
+
 #### Source: HomeKit

 **Important:**
@@ -461,6 +488,8 @@ RTSP link with "normal" audio for any player: `rtsp://192.168.1.123:8554/aqara_g

 #### Source: Bubble

+*[New in v1.6.1](https://github.com/AlexxIT/go2rtc/releases/tag/v1.6.1)*
+
 Other names: [ESeeCloud](http://www.eseecloud.com/), [dvr163](http://help.dvr163.com/).

 - you can skip `username`, `password`, `port`, `ch` and `stream` if they are default
@@ -473,6 +502,8 @@ streams:

 #### Source: DVRIP

+*[New in v1.2.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.2.0)*
+
 Other names: DVR-IP, NetSurveillance, Sofia protocol (NETsurveillance ActiveX plugin XMeye SDK).

 - you can skip `username`, `password`, `port`, `channel` and `subtype` if they are default
@@ -491,22 +522,34 @@ streams:

 #### Source: Tapo

+*[New in v1.2.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.2.0)*
+
 [TP-Link Tapo](https://www.tapo.com/) proprietary camera protocol with **two way audio** support.

 - stream quality is the same as [RTSP protocol](https://www.tapo.com/en/faq/34/)
 - use the **cloud password**, this is not the RTSP password! you do not need to add a login!
 - you can also use UPPERCASE MD5 hash from your cloud password with `admin` username
+- some new camera firmwares requires SHA256 instead of MD5

 ```yaml
 streams:
  # cloud password without username
  camera1: tapo://cloud-password@192.168.1.123
  # admin username and UPPERCASE MD5 cloud-password hash
-  camera2: tapo://admin:MD5-PASSWORD-HASH@192.168.1.123
+  camera2: tapo://admin:UPPERCASE-MD5@192.168.1.123
+  # admin username and UPPERCASE SHA256 cloud-password hash
+  camera3: tapo://admin:UPPERCASE-SHA256@192.168.1.123
+```
+
+```bash
+echo -n "cloud password" | md5 | awk '{print toupper($0)}'
+echo -n "cloud password" | shasum -a 256 | awk '{print toupper($0)}'
 ```

 #### Source: Kasa

+*[New in v1.7.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.7.0)*
+
 [TP-Link Kasa](https://www.kasasmart.com/) non-standard protocol [more info](https://medium.com/@hu3vjeen/reverse-engineering-tp-link-kc100-bac4641bf1cd).

 ```yaml
@@ -514,6 +557,12 @@ streams:
  kasa: kasa://user:pass@192.168.1.123:19443/https/stream/mixed
 ```

+#### Source: GoPro
+
+*[New in v1.8.3](https://github.com/AlexxIT/go2rtc/releases/tag/v1.8.3)*
+
+Support streaming from [GoPro](https://gopro.com/) cameras, connected via USB or Wi-Fi to Linux, Mac, Windows. [Read more](https://github.com/AlexxIT/go2rtc/tree/master/internal/gopro).
+
 #### Source: Ivideon

 Support public cameras from service [Ivideon](https://tv.ivideon.com/).
@@ -541,11 +590,11 @@ streams:
  aqara_g3: hass:Camera-Hub-G3-AB12
 ```

-**WebRTC Cameras**
+**WebRTC Cameras** (*from [v1.6.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.6.0)*)

 Any cameras in WebRTC format are supported. But at the moment Home Assistant only supports some [Nest](https://www.home-assistant.io/integrations/nest/) cameras in this fomat.

-The Nest API only allows you to get a link to a stream for 5 minutes. So every 5 minutes the stream will be reconnected.
+**Important.** The Nest API only allows you to get a link to a stream for 5 minutes. Do not use this with Frigate! If the stream expires, Frigate will consume all available ram on your machine within seconds. It's recommended to use [Nest source](#source-nest) - it supports extending the stream.

 ```yaml
 streams:
@@ -561,6 +610,8 @@ By default, the Home Assistant API does not allow you to get dynamic RTSP link t

 #### Source: ISAPI

+*[New in v1.3.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.3.0)*
+
 This source type support only backchannel audio for Hikvision ISAPI protocol. So it should be used as second source in addition to the RTSP protocol.

 ```yaml
@@ -572,7 +623,9 @@ streams:

 #### Source: Nest

-Currently only WebRTC cameras are supported. Stream reconnects every 5 minutes.
+*[New in v1.6.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.6.0)*
+
+Currently only WebRTC cameras are supported.

 For simplicity, it is recommended to connect the Nest/WebRTC camera to the [Home Assistant](#source-hass). But if you can somehow get the below parameters - Nest/WebRTC source will work without Hass.

@@ -583,6 +636,8 @@ streams:

 #### Source: Roborock

+*[New in v1.3.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.3.0)*
+
 This source type support Roborock vacuums with cameras. Known working models:

 - Roborock S6 MaxV - only video (the vacuum has no microphone)
@@ -594,25 +649,27 @@ If you have graphic pin for your vacuum - add it as numeric pin (lines: 123, 456

 #### Source: WebRTC

+*[New in v1.3.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.3.0)*
+
 This source type support four connection formats.

 **whep**

-[WebRTC/WHEP](https://www.ietf.org/id/draft-murillo-whep-02.html) - is an unapproved standard for WebRTC video/audio viewers. But it may already be supported in some third-party software. It is supported in go2rtc.
+[WebRTC/WHEP](https://datatracker.ietf.org/doc/draft-murillo-whep/) - is replaced by [WebRTC/WISH](https://datatracker.ietf.org/doc/charter-ietf-wish/02/) standard for WebRTC video/audio viewers. But it may already be supported in some third-party software. It is supported in go2rtc.

 **go2rtc**

 This format is only supported in go2rtc. Unlike WHEP it supports asynchronous WebRTC connection and two way audio.

-**openipc**
+**openipc** (*from [v1.7.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.7.0)*)

 Support connection to [OpenIPC](https://openipc.org/) cameras.

-**wyze**
+**wyze** (*from [v1.6.1](https://github.com/AlexxIT/go2rtc/releases/tag/v1.6.1)*)

 Supports connection to [Wyze](https://www.wyze.com/) cameras, using WebRTC protocol. You can use [docker-wyze-bridge](https://github.com/mrlt8/docker-wyze-bridge) project to get connection credentials.

-**kinesis**
+**kinesis** (*from [v1.6.1](https://github.com/AlexxIT/go2rtc/releases/tag/v1.6.1)*)

 Supports [Amazon Kinesis Video Streams](https://aws.amazon.com/kinesis/video-streams/), using WebRTC protocol. You need to specify signalling WebSocket URL with all credentials in query params, `client_id` and `ice_servers` list in [JSON format](https://developer.mozilla.org/en-US/docs/Web/API/RTCIceServer).

@@ -629,6 +686,8 @@ streams:

 #### Source: WebTorrent

+*[New in v1.3.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.3.0)*
+
 This source can get a stream from another go2rtc via [WebTorrent](#module-webtorrent) protocol.

 ```yaml
@@ -667,6 +726,8 @@ By default, go2rtc establishes a connection to the source when any client reques

 #### Incoming: Browser

+*[New in v1.3.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.3.0)*
+
 You can turn the browser of any PC or mobile into an IP-camera with support video and two way audio. Or even broadcast your PC screen:

 1. Create empty stream in the `go2rtc.yaml`
@@ -677,12 +738,16 @@ You can turn the browser of any PC or mobile into an IP-camera with support vide

 #### Incoming: WebRTC/WHIP

+*[New in v1.3.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.3.0)*
+
 You can use **OBS Studio** or any other broadcast software with [WHIP](https://www.ietf.org/archive/id/draft-ietf-wish-whip-01.html) protocol support. This standard has not yet been approved. But you can download OBS Studio [dev version](https://github.com/obsproject/obs-studio/actions/runs/3969201209):

 - Settings > Stream > Service: WHIP > http://192.168.1.123:1984/api/webrtc?dst=camera1

 #### Stream to camera

+*[New in v1.3.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.3.0)*
+
 go2rtc support play audio files (ex. music or [TTS](https://www.home-assistant.io/integrations/#text-to-speech)) and live streams (ex. radio) on cameras with [two way audio](#two-way-audio) support (RTSP/ONVIF cameras, TP-Link Tapo, Hikvision ISAPI, Roborock vacuums, any Browser).

 API example:
@@ -703,6 +768,8 @@ POST http://localhost:1984/api/streams?dst=camera1&src=ffmpeg:http://example.com

 ### Publish stream

+*[New in v1.8.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.8.0)*
+
 You can publish any stream to streaming services (YouTube, Telegram, etc.) via RTMP/RTMPS. Important:

 - Supported codecs: H264 for video and AAC for audio
@@ -728,7 +795,7 @@ publish:

 streams:
  # for TP-Link cameras it's important to use transcoding because of wrong pixel format
-  tplink_tapo: ffmpeg:rtsp://user:pass@192.168.1.123/stream1#video=h264#hardware=vaapi#audio=aac
+  tplink_tapo: ffmpeg:rtsp://user:pass@192.168.1.123/stream1#video=h264#hardware#audio=aac
 ```

 - **Telegram Desktop App** > Any public or private channel or group (where you admin) > Live stream > Start with... > Start streaming.
@@ -738,6 +805,8 @@ streams:

 The HTTP API is the main part for interacting with the application. Default address: `http://localhost:1984/`.

+**Important!** go2rtc passes requests from localhost and from unix socket without HTTP authorisation, even if you have it configured! It is your responsibility to set up secure external access to API. If not properly configured, an attacker can gain access to your cameras and even your server.
+
 [API description](https://github.com/AlexxIT/go2rtc/tree/master/api).

 **Module config**
@@ -765,6 +834,7 @@ api:
    -----BEGIN PRIVATE KEY-----
    ...
    -----END PRIVATE KEY-----
+  unix_listen: "/tmp/go2rtc.sock"  # default "", unix socket listener for API
 ```

 **PS:**
@@ -797,6 +867,8 @@ Read more about [codecs filters](#codecs-filters).

 ### Module: RTMP

+*[New in v1.8.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.8.0)*
+
 You can get any stream as RTMP-stream: `rtmp://192.168.1.123/{stream_name}`. Only H264/AAC codecs supported right now.

 [Incoming stream](#incoming-sources) in RTMP-format tested only with [OBS Studio](https://obsproject.com/) and Dahua camera. Different FFmpeg versions has differnt problems with this format. 
@@ -849,7 +921,7 @@ webrtc:

 **Private IP**

- setup integration with [Ngrok service](#module-ngrok)
+- setup integration with [ngrok service](#module-ngrok)

 ```yaml
 ngrok:
@@ -875,6 +947,8 @@ webrtc:

 ### Module: HomeKit

+*[New in v1.7.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.7.0)*
+
 HomeKit module can work in two modes:

 - export any H264 camera to Apple HomeKit
@@ -927,6 +1001,8 @@ homekit:

 ### Module: WebTorrent

+*[New in v1.3.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.3.0)*
+
 This module support:

 - Share any local stream via [WebTorrent](https://webtorrent.io/) technology
@@ -951,29 +1027,29 @@ Link example: https://alexxit.github.io/go2rtc/#share=02SNtgjKXY&pwd=wznEQqznxW&

 TODO: article how it works...

-### Module: Ngrok
+### Module: ngrok

-With Ngrok integration you can get external access to your streams in situation when you have Internet with private IP-address.
+With ngrok integration you can get external access to your streams in situations when you have Internet with private IP-address.

- Ngrok preistalled for **Docker** and **Hass Add-on** users
+- ngrok is pre-installed for **Docker** and **Hass Add-on** users
 - you may need external access for two different things:
  - WebRTC stream, so you need tunnel WebRTC TCP port (ex. 8555)
  - go2rtc web interface, so you need tunnel API HTTP port (ex. 1984)
- Ngrok support authorization for your web interface
- Ngrok automatically adds HTTPS to your web interface
+- ngrok support authorization for your web interface
+- ngrok automatically adds HTTPS to your web interface

-Ngrok free subscription limitations:
+The ngrok free subscription has the following limitations:

- you will always get random external address (not a problem for webrtc stream)
- you can forward multiple ports but use only one Ngrok app
+- You can reserve a free domain for serving the web interface, but the TCP address you get will always be random and change with each restart of the ngrok agent (not a problem for webrtc stream)
+- You can forward multiple ports from a single agent, but you can only run one ngrok agent on the free plan

 go2rtc will automatically get your external TCP address (if you enable it in ngrok config) and use it with WebRTC connection (if you enable it in webrtc config).

-You need manually download [Ngrok agent app](https://ngrok.com/download) for your OS and register in [Ngrok service](https://ngrok.com/).
+You need to manually download the [ngrok agent app](https://ngrok.com/download) for your OS and register with the [ngrok service](https://ngrok.com/signup).

 **Tunnel for only WebRTC Stream**

-You need to add your [Ngrok token](https://dashboard.ngrok.com/get-started/your-authtoken) and WebRTC TCP port to YAML:
+You need to add your [ngrok authtoken](https://dashboard.ngrok.com/get-started/your-authtoken) and WebRTC TCP port to YAML:

 ```yaml
 ngrok:
@@ -989,7 +1065,7 @@ ngrok:
  command: ngrok start --all --config ngrok.yaml
 ```

-Ngrok config example:
+ngrok config example:

 ```yaml
 version: "2"
@@ -1005,6 +1081,8 @@ tunnels:
    proto: tcp
 ```

+See the [ngrok agent documentation](https://ngrok.com/docs/agent/config/) for more details on the ngrok configuration file.
+
 ### Module: Hass

 The best and easiest way to use go2rtc inside the Home Assistant is to install the custom integration [WebRTC Camera](#go2rtc-home-assistant-integration) and custom lovelace card.
@@ -1068,6 +1146,8 @@ Read more about [codecs filters](#codecs-filters).

 ### Module: HLS

+*[New in v1.1.0](https://github.com/AlexxIT/go2rtc/releases/tag/v1.1.0)*
+
 [HLS](https://en.wikipedia.org/wiki/HTTP_Live_Streaming) is the worst technology for real-time streaming. It can only be useful on devices that do not support more modern technology, like [WebRTC](#module-webrtc), [MSE/MP4](#module-mp4).

 The go2rtc implementation differs from the standards and may not work with all players.
@@ -1144,7 +1224,7 @@ webrtc:
 - external access to WebRTC TCP port is not a problem, because it used only for transmit encrypted media data
  - anyway you need to open this port to your local network and to the Internet in order for WebRTC to work

-If you need Web interface protection without Home Assistant Add-on - you need to use reverse proxy, like [Nginx](https://nginx.org/), [Caddy](https://caddyserver.com/), [Ngrok](https://ngrok.com/), etc.
+If you need Web interface protection without Home Assistant Add-on - you need to use reverse proxy, like [Nginx](https://nginx.org/), [Caddy](https://caddyserver.com/), [ngrok](https://ngrok.com/), etc.

 PS. Additionally WebRTC will try to use the 8555 UDP port for transmit encrypted media. It works without problems on the local network. And sometimes also works for external access, even if you haven't opened this port on your router ([read more](https://en.wikipedia.org/wiki/UDP_hole_punching)). But for stable external WebRTC access, you need to open the 8555 port on your router for both TCP and UDP.

@@ -1175,17 +1255,14 @@ Some examples:

 `AVC/H.264` video can be played almost anywhere. But `HEVC/H.265` has a lot of limitations in supporting with different devices and browsers. It's all about patents and money, you can't do anything about it.

-| Device              | WebRTC                        | MSE                           | HTTP                               | HLS                    |
-|---------------------|-------------------------------|-------------------------------|------------------------------------|------------------------|
-| *latency*           | best                          | medium                        | bad                                | bad                    |
-| Desktop Chrome 107+ | H264, OPUS, PCMU, PCMA        | H264, H265*, AAC, FLAC*, OPUS | H264, H265*, AAC, FLAC*, OPUS, MP3 | no                     |
-| Desktop Edge        | H264, OPUS, PCMU, PCMA        | H264, H265*, AAC, FLAC*, OPUS | H264, H265*, AAC, FLAC*, OPUS, MP3 | no                     |
-| Android Chrome 107+ | H264, OPUS, PCMU, PCMA        | H264, H265*, AAC, FLAC*, OPUS | H264, H265*, AAC, FLAC*, OPUS, MP3 | no                     |
-| Desktop Firefox     | H264, OPUS, PCMU, PCMA        | H264, AAC, FLAC*, OPUS        | H264, AAC, FLAC*, OPUS             | no                     |
-| Desktop Safari 14+  | H264, H265*, OPUS, PCMU, PCMA | H264, H265, AAC, FLAC*        | **no!**                            | H264, H265, AAC, FLAC* |
-| iPad Safari 14+     | H264, H265*, OPUS, PCMU, PCMA | H264, H265, AAC, FLAC*        | **no!**                            | H264, H265, AAC, FLAC* |
-| iPhone Safari 14+   | H264, H265*, OPUS, PCMU, PCMA | **no!**                       | **no!**                            | H264, H265, AAC, FLAC* |
-| macOS [Hass App][1] | no                            | no                            | no                                 | H264, H265, AAC, FLAC* |
+| Device                                                                   | WebRTC                                  | MSE                                     | HTTP*                                        | HLS                         |
+|--------------------------------------------------------------------------|-----------------------------------------|-----------------------------------------|----------------------------------------------|-----------------------------|
+| *latency*                                                                | best                                    | medium                                  | bad                                          | bad                         |
+| - Desktop Chrome 107+ <br/> - Desktop Edge <br/> - Android Chrome 107+   | H264 <br/> PCMU, PCMA <br/> OPUS        | H264, H265* <br/> AAC, FLAC* <br/> OPUS | H264, H265* <br/> AAC, FLAC* <br/> OPUS, MP3 | no                          |
+| Desktop Firefox                                                          | H264 <br/> PCMU, PCMA <br/> OPUS        | H264 <br/> AAC, FLAC* <br/> OPUS        | H264 <br/> AAC, FLAC* <br/> OPUS             | no                          |
+| - Desktop Safari 14+ <br/> - iPad Safari 14+ <br/> - iPhone Safari 17.1+ | H264, H265* <br/> PCMU, PCMA <br/> OPUS | H264, H265 <br/> AAC, FLAC*             | **no!**                                      | H264, H265 <br/> AAC, FLAC* |
+| iPhone Safari 14+                                                        | H264, H265* <br/> PCMU, PCMA <br/> OPUS | **no!**                                 | **no!**                                      | H264, H265 <br/> AAC, FLAC* |
+| macOS [Hass App][1]                                                      | no                                      | no                                      | no                                           | H264, H265 <br/> AAC, FLAC* |

 [1]: https://apps.apple.com/app/home-assistant/id1099568401

@@ -1212,8 +1289,8 @@ Some examples:

 - H264 = H.264 = AVC (Advanced Video Coding)
 - H265 = H.265 = HEVC (High Efficiency Video Coding)
- PCMU = G.711 PCM (A-law) = PCM A-law (`alaw`)
- PCMA = G.711 PCM (µ-law) = PCM mu-law (`mulaw`)
+- PCMA = G.711 PCM (A-law) = PCM A-law (`alaw`)
+- PCMU = G.711 PCM (µ-law) = PCM mu-law (`mulaw`)
 - PCM = L16 = PCM signed 16-bit big-endian (`s16be`)
 - AAC = MPEG4-GENERIC
 - MP3 = MPEG-1 Audio Layer III or MPEG-2 Audio Layer III
@@ -1280,14 +1357,22 @@ streams:

 - [Frigate 12+](https://frigate.video/) - open source NVR built around real-time AI object detection
 - [Frigate Lovelace Card](https://github.com/dermotduffy/frigate-hass-card) - custom card for Home Assistant
- [ring-mqtt](https://github.com/tsightler/ring-mqtt) - Ring devices to MQTT Bridge
+- [OpenIPC](https://github.com/OpenIPC/firmware/tree/master/general/package/go2rtc) - Alternative IP Camera firmware from an open community
+- [wz_mini_hacks](https://github.com/gtxaspec/wz_mini_hacks) - Custom firmware for Wyze cameras
 - [EufyP2PStream](https://github.com/oischinger/eufyp2pstream) - A small project that provides a Video/Audio Stream from Eufy cameras that don't directly support RTSP
 - [ioBroker.euSec](https://github.com/bropat/ioBroker.eusec) - [ioBroker](https://www.iobroker.net/) adapter for control Eufy security devices
- [wz_mini_hacks](https://github.com/gtxaspec/wz_mini_hacks) - Custom firmware for Wyze cameras
 - [MMM-go2rtc](https://github.com/Anonym-tsk/MMM-go2rtc) - MagicMirror² Module
+- [ring-mqtt](https://github.com/tsightler/ring-mqtt) - Ring devices to MQTT Bridge
+
+**Distributions**
+
 - [Alpine Linux](https://pkgs.alpinelinux.org/packages?name=go2rtc)
+- [Arch User Repository](https://linux-packages.com/aur/package/go2rtc)
+- [Gentoo](https://github.com/inode64/inode64-overlay/tree/main/media-video/go2rtc)
 - [NixOS](https://search.nixos.org/packages?query=go2rtc)
 - [Proxmox Helper Scripts](https://tteck.github.io/Proxmox/)
+- [QNAP](https://www.myqnap.org/product/go2rtc/)
+- [Synology NAS](https://synocommunity.com/package/go2rtc)
 - [Unraid](https://unraid.net/community/apps?q=go2rtc)

 ## Cameras experience
--- a/api/openapi.yaml
+++ b/api/openapi.yaml
@@ -115,7 +115,14 @@ paths:
            default:
              description: Default response

-
+  /api/restart:
+    post:
+      summary: Restart Daemon
+      description: Restarts the daemon.
+      tags: [ Application ]
+      responses:
+            default:
+              description: Default response

  /api/config:
    get:
--- a/assets/go2rtc.png
+++ b/assets/go2rtc.png
--- a/assets/logo.png
+++ b/assets/logo.png
--- a/go.mod
+++ b/go.mod
@@ -3,42 +3,46 @@ module github.com/AlexxIT/go2rtc
 go 1.21

 require (
-	github.com/gorilla/websocket v1.5.0
-	github.com/miekg/dns v1.1.56
-	github.com/pion/ice/v2 v2.3.11
-	github.com/pion/interceptor v0.1.22
-	github.com/pion/rtcp v1.2.10
-	github.com/pion/rtp v1.8.2
-	github.com/pion/sdp/v3 v3.0.6
-	github.com/pion/srtp/v2 v2.0.17
+	github.com/asticode/go-astits v1.13.0
+	github.com/expr-lang/expr v1.16.5
+	github.com/gorilla/websocket v1.5.1
+	github.com/miekg/dns v1.1.59
+	github.com/pion/ice/v2 v2.3.19
+	github.com/pion/interceptor v0.1.29
+	github.com/pion/rtcp v1.2.14
+	github.com/pion/rtp v1.8.6
+	github.com/pion/sdp/v3 v3.0.9
+	github.com/pion/srtp/v2 v2.0.18
 	github.com/pion/stun v0.6.1
-	github.com/pion/webrtc/v3 v3.2.21
-	github.com/rs/zerolog v1.31.0
-	github.com/sigurn/crc16 v0.0.0-20211026045750-20ab5afb07e3
+	github.com/pion/webrtc/v3 v3.2.39
+	github.com/rs/zerolog v1.32.0
+	github.com/sigurn/crc16 v0.0.0-20240131213347-83fcde1e29d1
 	github.com/sigurn/crc8 v0.0.0-20220107193325-2243fe600f9f
-	github.com/stretchr/testify v1.8.4
+	github.com/stretchr/testify v1.9.0
 	github.com/tadglines/go-pkgs v0.0.0-20210623144937-b983b20f54f9
-	golang.org/x/crypto v0.14.0
+	golang.org/x/crypto v0.22.0
 	gopkg.in/yaml.v3 v3.0.1
 )

 require (
+	github.com/asticode/go-astikit v0.30.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/google/uuid v1.3.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/kr/pretty v0.2.1 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.19 // indirect
-	github.com/pion/datachannel v1.5.5 // indirect
-	github.com/pion/dtls/v2 v2.2.7 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/pion/datachannel v1.5.6 // indirect
+	github.com/pion/dtls/v2 v2.2.10 // indirect
 	github.com/pion/logging v0.2.2 // indirect
-	github.com/pion/mdns v0.0.9 // indirect
+	github.com/pion/mdns v0.0.12 // indirect
 	github.com/pion/randutil v0.1.0 // indirect
-	github.com/pion/sctp v1.8.9 // indirect
-	github.com/pion/transport/v2 v2.2.4 // indirect
-	github.com/pion/turn/v2 v2.1.4 // indirect
+	github.com/pion/sctp v1.8.16 // indirect
+	github.com/pion/transport/v2 v2.2.5 // indirect
+	github.com/pion/turn/v2 v2.1.6 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	golang.org/x/mod v0.13.0 // indirect
-	golang.org/x/net v0.17.0 // indirect
-	golang.org/x/sys v0.13.0 // indirect
-	golang.org/x/tools v0.14.0 // indirect
+	golang.org/x/mod v0.17.0 // indirect
+	golang.org/x/net v0.24.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
+	golang.org/x/sys v0.19.0 // indirect
+	golang.org/x/tools v0.20.0 // indirect
 )
--- a/go.sum
+++ b/go.sum
@@ -1,198 +1,140 @@
+github.com/asticode/go-astikit v0.30.0 h1:DkBkRQRIxYcknlaU7W7ksNfn4gMFsB0tqMJflxkRsZA=
+github.com/asticode/go-astikit v0.30.0/go.mod h1:h4ly7idim1tNhaVkdVBeXQZEE3L0xblP7fCWbgwipF0=
+github.com/asticode/go-astits v1.13.0 h1:XOgkaadfZODnyZRR5Y0/DWkA9vrkLLPLeeOvDwfKZ1c=
+github.com/asticode/go-astits v1.13.0/go.mod h1:QSHmknZ51pf6KJdHKZHJTLlMegIrhega3LPWz3ND/iI=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
+github.com/expr-lang/expr v1.16.5 h1:m2hvtguFeVaVNTHj8L7BoAyt7O0PAIBaSVbjdHgRXMs=
+github.com/expr-lang/expr v1.16.5/go.mod h1:uCkhfG+x7fcZ5A5sXHKuQ07jGZRl6J0FCAaf2k4PtVQ=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
 github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
-github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/websocket v1.5.1 h1:gmztn0JnHVt9JZquRuzLw3g4wouNVzKL15iLr/zn/QY=
+github.com/gorilla/websocket v1.5.1/go.mod h1:x3kM2JMyaluk02fnUJpQuwD2dCS5NDG2ZHL0uE0tcaY=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
 github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/miekg/dns v1.1.55 h1:GoQ4hpsj0nFLYe+bWiCToyrBEJXkQfOOIvFGFy0lEgo=
-github.com/miekg/dns v1.1.55/go.mod h1:uInx36IzPl7FYnDcMeVWxj9byh7DutNykX4G9Sj60FY=
-github.com/miekg/dns v1.1.56 h1:5imZaSeoRNvpM9SzWNhEcP9QliKiz20/dA2QabIGVnE=
-github.com/miekg/dns v1.1.56/go.mod h1:cRm6Oo2C8TY9ZS/TqsSrseAcncm74lfK5G+ikN2SWWY=
-github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
-github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
-github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
-github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
-github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
-github.com/pion/datachannel v1.5.5 h1:10ef4kwdjije+M9d7Xm9im2Y3O6A6ccQb0zcqZcJew8=
-github.com/pion/datachannel v1.5.5/go.mod h1:iMz+lECmfdCMqFRhXhcA/219B0SQlbpoR2V118yimL0=
-github.com/pion/dtls/v2 v2.2.7 h1:cSUBsETxepsCSFSxC3mc/aDo14qQLMSL+O6IjG28yV8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/miekg/dns v1.1.59 h1:C9EXc/UToRwKLhK5wKU/I4QVsBUc8kE6MkHBkeypWZs=
+github.com/miekg/dns v1.1.59/go.mod h1:nZpewl5p6IvctfgrckopVx2OlSEHPRO/U4SYkRklrEk=
+github.com/pion/datachannel v1.5.6 h1:1IxKJntfSlYkpUj8LlYRSWpYiTTC02nUrOE8T3DqGeg=
+github.com/pion/datachannel v1.5.6/go.mod h1:1eKT6Q85pRnr2mHiWHxJwO50SfZRtWHTsNIVb/NfGW4=
 github.com/pion/dtls/v2 v2.2.7/go.mod h1:8WiMkebSHFD0T+dIU+UeBaoV7kDhOW5oDCzZ7WZ/F9s=
-github.com/pion/ice/v2 v2.3.11 h1:rZjVmUwyT55cmN8ySMpL7rsS8KYsJERsrxJLLxpKhdw=
-github.com/pion/ice/v2 v2.3.11/go.mod h1:hPcLC3kxMa+JGRzMHqQzjoSj3xtE9F+eoncmXLlCL4E=
-github.com/pion/interceptor v0.1.18/go.mod h1:tpvvF4cPM6NGxFA1DUMbhabzQBxdWMATDGEUYOR9x6I=
-github.com/pion/interceptor v0.1.19 h1:tq0TGBzuZQqipyBhaC1mVUCfCh8XjDKUuibq9rIl5t4=
-github.com/pion/interceptor v0.1.19/go.mod h1:VANhFxdJezB8mwToMMmrmyHyP9gym6xLqIUch31xryg=
-github.com/pion/interceptor v0.1.22 h1:khhimAF0/VmGaIfeE+bA3X1jm0lD8C8HOGcU7vpWcPA=
-github.com/pion/interceptor v0.1.22/go.mod h1:wkbPYAak5zKsfpVDYMtEfWEy8D4zL+rpxCxPImLOg3Y=
+github.com/pion/dtls/v2 v2.2.10 h1:u2Axk+FyIR1VFTPurktB+1zoEPGIW3bmyj3LEFrXjAA=
+github.com/pion/dtls/v2 v2.2.10/go.mod h1:d9SYc9fch0CqK90mRk1dC7AkzzpwJj6u2GU3u+9pqFE=
+github.com/pion/ice/v2 v2.3.19 h1:1GoMRTMnB6bCP4aGy2MjxK3w4laDkk+m7svJb/eqybc=
+github.com/pion/ice/v2 v2.3.19/go.mod h1:KXJJcZK7E8WzrBEYnV4UtqEZsGeWfHxsNqhVcVvgjxw=
+github.com/pion/interceptor v0.1.29 h1:39fsnlP1U8gw2JzOFWdfCU82vHvhW9o0rZnZF56wF+M=
+github.com/pion/interceptor v0.1.29/go.mod h1:ri+LGNjRUc5xUNtDEPzfdkmSqISixVTBF/z/Zms/6T4=
 github.com/pion/logging v0.2.2 h1:M9+AIj/+pxNsDfAT64+MAVgJO0rsyLnoJKCqf//DoeY=
 github.com/pion/logging v0.2.2/go.mod h1:k0/tDVsRCX2Mb2ZEmTqNa7CWsQPc+YYCB7Q+5pahoms=
-github.com/pion/mdns v0.0.8/go.mod h1:hYE72WX8WDveIhg7fmXgMKivD3Puklk0Ymzog0lSyaI=
-github.com/pion/mdns v0.0.9 h1:7Ue5KZsqq8EuqStnpPWV33vYYEH0+skdDN5L7EiEsI4=
-github.com/pion/mdns v0.0.9/go.mod h1:2JA5exfxwzXiCihmxpTKgFUpiQws2MnipoPK09vecIc=
+github.com/pion/mdns v0.0.12 h1:CiMYlY+O0azojWDmxdNr7ADGrnZ+V6Ilfner+6mSVK8=
+github.com/pion/mdns v0.0.12/go.mod h1:VExJjv8to/6Wqm1FXK+Ii/Z9tsVk/F5sD/N70cnYFbk=
 github.com/pion/randutil v0.1.0 h1:CFG1UdESneORglEsnimhUjf33Rwjubwj6xfiOXBa3mA=
 github.com/pion/randutil v0.1.0/go.mod h1:XcJrSMMbbMRhASFVOlj/5hQial/Y8oH/HVo7TBZq+j8=
-github.com/pion/rtcp v1.2.10 h1:nkr3uj+8Sp97zyItdN60tE/S6vk4al5CPRR6Gejsdjc=
-github.com/pion/rtcp v1.2.10/go.mod h1:ztfEwXZNLGyF1oQDttz/ZKIBaeeg/oWbRYqzBM9TL1I=
-github.com/pion/rtp v1.8.1 h1:26OxTc6lKg/qLSGir5agLyj0QKaOv8OP5wps2SFnVNQ=
-github.com/pion/rtp v1.8.1/go.mod h1:pBGHaFt/yW7bf1jjWAoUjpSNoDnw98KTMg+jWWvziqU=
-github.com/pion/rtp v1.8.2 h1:oKMM0K1/QYQ5b5qH+ikqDSZRipP5mIxPJcgcvw5sH0w=
-github.com/pion/rtp v1.8.2/go.mod h1:pBGHaFt/yW7bf1jjWAoUjpSNoDnw98KTMg+jWWvziqU=
-github.com/pion/sctp v1.8.5/go.mod h1:SUFFfDpViyKejTAdwD1d/HQsCu+V/40cCs2nZIvC3s0=
-github.com/pion/sctp v1.8.8/go.mod h1:igF9nZBrjh5AtmKc7U30jXltsFHicFCXSmWA2GWRaWs=
-github.com/pion/sctp v1.8.9 h1:TP5ZVxV5J7rz7uZmbyvnUvsn7EJ2x/5q9uhsTtXbI3g=
-github.com/pion/sctp v1.8.9/go.mod h1:cMLT45jqw3+jiJCrtHVwfQLnfR0MGZ4rgOJwUOIqLkI=
-github.com/pion/sdp/v3 v3.0.6 h1:WuDLhtuFUUVpTfus9ILC4HRyHsW6TdugjEX/QY9OiUw=
-github.com/pion/sdp/v3 v3.0.6/go.mod h1:iiFWFpQO8Fy3S5ldclBkpXqmWy02ns78NOKoLLL0YQw=
-github.com/pion/srtp/v2 v2.0.17 h1:ECuOk+7uIpY6HUlTb0nXhfvu4REG2hjtC4ronYFCZE4=
-github.com/pion/srtp/v2 v2.0.17/go.mod h1:y5WSHcJY4YfNB/5r7ca5YjHeIr1H3LM1rKArGGs8jMc=
+github.com/pion/rtcp v1.2.12/go.mod h1:sn6qjxvnwyAkkPzPULIbVqSKI5Dv54Rv7VG0kNxh9L4=
+github.com/pion/rtcp v1.2.14 h1:KCkGV3vJ+4DAJmvP0vaQShsb0xkRfWkO540Gy102KyE=
+github.com/pion/rtcp v1.2.14/go.mod h1:sn6qjxvnwyAkkPzPULIbVqSKI5Dv54Rv7VG0kNxh9L4=
+github.com/pion/rtp v1.8.3/go.mod h1:pBGHaFt/yW7bf1jjWAoUjpSNoDnw98KTMg+jWWvziqU=
+github.com/pion/rtp v1.8.6 h1:MTmn/b0aWWsAzux2AmP8WGllusBVw4NPYPVFFd7jUPw=
+github.com/pion/rtp v1.8.6/go.mod h1:pBGHaFt/yW7bf1jjWAoUjpSNoDnw98KTMg+jWWvziqU=
+github.com/pion/sctp v1.8.13/go.mod h1:YKSgO/bO/6aOMP9LCie1DuD7m+GamiK2yIiPM6vH+GA=
+github.com/pion/sctp v1.8.16 h1:PKrMs+o9EMLRvFfXq59WFsC+V8mN1wnKzqrv+3D/gYY=
+github.com/pion/sctp v1.8.16/go.mod h1:P6PbDVA++OJMrVNg2AL3XtYHV4uD6dvfyOovCgMs0PE=
+github.com/pion/sdp/v3 v3.0.9 h1:pX++dCHoHUwq43kuwf3PyJfHlwIj4hXA7Vrifiq0IJY=
+github.com/pion/sdp/v3 v3.0.9/go.mod h1:B5xmvENq5IXJimIO4zfp6LAe1fD9N+kFv+V/1lOdz8M=
+github.com/pion/srtp/v2 v2.0.18 h1:vKpAXfawO9RtTRKZJbG4y0v1b11NZxQnxRl85kGuUlo=
+github.com/pion/srtp/v2 v2.0.18/go.mod h1:0KJQjA99A6/a0DOVTu1PhDSw0CXF2jTkqOoMg3ODqdA=
 github.com/pion/stun v0.6.1 h1:8lp6YejULeHBF8NmV8e2787BogQhduZugh5PdhDyyN4=
 github.com/pion/stun v0.6.1/go.mod h1:/hO7APkX4hZKu/D0f2lHzNyvdkTGtIy3NDmLR7kSz/8=
-github.com/pion/transport v0.14.1 h1:XSM6olwW+o8J4SCmOBb/BpwZypkHeyM0PGFCxNQBr40=
-github.com/pion/transport v0.14.1/go.mod h1:4tGmbk00NeYA3rUa9+n+dzCCoKkcy3YlYb99Jn2fNnI=
 github.com/pion/transport/v2 v2.2.1/go.mod h1:cXXWavvCnFF6McHTft3DWS9iic2Mftcz1Aq29pGcU5g=
 github.com/pion/transport/v2 v2.2.2/go.mod h1:OJg3ojoBJopjEeECq2yJdXH9YVrUJ1uQ++NjXLOUorc=
 github.com/pion/transport/v2 v2.2.3/go.mod h1:q2U/tf9FEfnSBGSW6w5Qp5PFWRLRj3NjLhCCgpRK4p0=
-github.com/pion/transport/v2 v2.2.4 h1:41JJK6DZQYSeVLxILA2+F4ZkKb4Xd/tFJZRFZQ9QAlo=
 github.com/pion/transport/v2 v2.2.4/go.mod h1:q2U/tf9FEfnSBGSW6w5Qp5PFWRLRj3NjLhCCgpRK4p0=
-github.com/pion/transport/v3 v3.0.1 h1:gDTlPJwROfSfz6QfSi0ZmeCSkFcnWWiiR9ES0ouANiM=
+github.com/pion/transport/v2 v2.2.5 h1:iyi25i/21gQck4hfRhomF6SktmUQjRsRW4WJdhfc3Kc=
+github.com/pion/transport/v2 v2.2.5/go.mod h1:q2U/tf9FEfnSBGSW6w5Qp5PFWRLRj3NjLhCCgpRK4p0=
 github.com/pion/transport/v3 v3.0.1/go.mod h1:UY7kiITrlMv7/IKgd5eTUcaahZx5oUN3l9SzK5f5xE0=
-github.com/pion/turn/v2 v2.1.3 h1:pYxTVWG2gpC97opdRc5IGsQ1lJ9O/IlNhkzj7MMrGAA=
+github.com/pion/transport/v3 v3.0.2 h1:r+40RJR25S9w3jbA6/5uEPTzcdn7ncyU44RWCbHkLg4=
+github.com/pion/transport/v3 v3.0.2/go.mod h1:nIToODoOlb5If2jF9y2Igfx3PFYWfuXi37m0IlWa/D0=
 github.com/pion/turn/v2 v2.1.3/go.mod h1:huEpByKKHix2/b9kmTAM3YoX6MKP+/D//0ClgUYR2fY=
-github.com/pion/turn/v2 v2.1.4 h1:2xn8rduI5W6sCZQkEnIUDAkrBQNl2eYIBCHMZ3QMmP8=
-github.com/pion/turn/v2 v2.1.4/go.mod h1:huEpByKKHix2/b9kmTAM3YoX6MKP+/D//0ClgUYR2fY=
-github.com/pion/webrtc/v3 v3.2.19 h1:XNu5e62mkzafw1qYuKtQ+Dviw4JpbzC/SLx3zZt49JY=
-github.com/pion/webrtc/v3 v3.2.19/go.mod h1:vVURQTBOG5BpWKOJz3nlr23NfTDeyKVmubRNqzQp+Tg=
-github.com/pion/webrtc/v3 v3.2.21 h1:c8fy5JcqJkAQBwwy3Sk9huQLTBUSqaggyRlv9Lnh2zY=
-github.com/pion/webrtc/v3 v3.2.21/go.mod h1:vVURQTBOG5BpWKOJz3nlr23NfTDeyKVmubRNqzQp+Tg=
+github.com/pion/turn/v2 v2.1.6 h1:Xr2niVsiPTB0FPtt+yAWKFUkU1eotQbGgpTIld4x1Gc=
+github.com/pion/turn/v2 v2.1.6/go.mod h1:huEpByKKHix2/b9kmTAM3YoX6MKP+/D//0ClgUYR2fY=
+github.com/pion/webrtc/v3 v3.2.39 h1:Lf2SIMGdE3M9VNm48KpoX5pR8SJ6TsMnktzOkc/oB0o=
+github.com/pion/webrtc/v3 v3.2.39/go.mod h1:AQ8p56OLbm3MjhYovYdgPuyX6oc+JcKx/HFoCGFcYzA=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/profile v1.4.0/go.mod h1:NWz/XGvpEW1FyYQ7fCx4dqYBLlfTcE+A9FLAkNKqjFE=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
-github.com/rs/zerolog v1.30.0 h1:SymVODrcRsaRaSInD9yQtKbtWqwsfoPcRff/oRXLj4c=
-github.com/rs/zerolog v1.30.0/go.mod h1:/tk+P47gFdPXq4QYjvCmT5/Gsug2nagsFWBWhAiSi1w=
-github.com/rs/zerolog v1.31.0 h1:FcTR3NnLWW+NnTwwhFWiJSZr4ECLpqCm6QsEnyvbV4A=
-github.com/rs/zerolog v1.31.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
-github.com/sclevine/agouti v3.0.0+incompatible/go.mod h1:b4WX9W9L1sfQKXeJf1mUTLZKJ48R1S7H23Ji7oFO5Bw=
-github.com/sigurn/crc16 v0.0.0-20211026045750-20ab5afb07e3 h1:aQKxg3+2p+IFXXg97McgDGT5zcMrQoi0EICZs8Pgchs=
-github.com/sigurn/crc16 v0.0.0-20211026045750-20ab5afb07e3/go.mod h1:9/etS5gpQq9BJsJMWg1wpLbfuSnkm8dPF6FdW2JXVhA=
+github.com/rs/zerolog v1.32.0 h1:keLypqrlIjaFsbmJOBdB/qvyF8KEtCWHwobLp5l/mQ0=
+github.com/rs/zerolog v1.32.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
+github.com/sigurn/crc16 v0.0.0-20240131213347-83fcde1e29d1 h1:NVK+OqnavpyFmUiKfUMHrpvbCi2VFoWTrcpI7aDaJ2I=
+github.com/sigurn/crc16 v0.0.0-20240131213347-83fcde1e29d1/go.mod h1:9/etS5gpQq9BJsJMWg1wpLbfuSnkm8dPF6FdW2JXVhA=
 github.com/sigurn/crc8 v0.0.0-20220107193325-2243fe600f9f h1:1R9KdKjCNSd7F8iGTxIpoID9prlYH8nuNYKt0XvweHA=
 github.com/sigurn/crc8 v0.0.0-20220107193325-2243fe600f9f/go.mod h1:vQhwQ4meQEDfahT5kd61wLAF5AAeh5ZPLVI4JJ/tYo8=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/tadglines/go-pkgs v0.0.0-20210623144937-b983b20f54f9 h1:aeN+ghOV0b2VCmKKO3gqnDQ8mLbpABZgRR2FVYx4ouI=
 github.com/tadglines/go-pkgs v0.0.0-20210623144937-b983b20f54f9/go.mod h1:roo6cZ/uqpwKMuvPG0YmzI5+AmUiMWfjCBZpGXqbTxE=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
-golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
 golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
 golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
-golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
+golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
+golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY=
-golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
 golang.org/x/net v0.13.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
 golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
-golang.org/x/net v0.15.0 h1:ugBLEUaxABaB5AJqW9enI0ACdci2RUd4eP51NTBvuJ8=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
+golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
-golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -200,61 +142,41 @@ golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
+golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo=
 golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
 golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
-golang.org/x/tools v0.14.0 h1:jvNa2pY0M4r62jkRQ6RwEZZyPcymeL9XZMLBbV7U2nc=
-golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
+golang.org/x/tools v0.20.0 h1:hz/CVckiOxybQvFw6h7b/q80NTr9IUQb4s1IIzW7KNY=
+golang.org/x/tools v0.20.0/go.mod h1:WvitBU7JJf6A4jOdg4S1tviW9bhUxkgeCui/0JHctQg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
-gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
--- a/hardware.Dockerfile
+++ b/hardware.Dockerfile
@@ -1,8 +1,9 @@
 # syntax=docker/dockerfile:labs

 # 0. Prepare images
-# only debian 12 (bookworm) has latest ffmpeg
-ARG DEBIAN_VERSION="bookworm-slim"
+# only debian 13 (trixie) has latest ffmpeg
+# https://packages.debian.org/trixie/ffmpeg
+ARG DEBIAN_VERSION="trixie-slim"
 ARG GO_VERSION="1.21-bookworm"
 ARG NGROK_VERSION="3"

@@ -44,13 +45,16 @@ RUN rm -f /etc/apt/apt.conf.d/docker-clean \
 # Install ffmpeg, bash (for run.sh), tini (for signal handling),
 # and other common tools for the echo source.
 # non-free for Intel QSV support (not used by go2rtc, just for tests)
+# mesa-va-drivers for AMD APU
 # libasound2-plugins for ALSA support
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    echo 'deb http://deb.debian.org/debian bookworm non-free' > /etc/apt/sources.list.d/debian-non-free.list && \
+    echo 'deb http://deb.debian.org/debian trixie non-free' > /etc/apt/sources.list.d/debian-non-free.list && \
    apt-get -y update && apt-get -y install tini ffmpeg \
        python3 curl jq \
        intel-media-va-driver-non-free \
-        libasound2-plugins
+        mesa-va-drivers \
+        libasound2-plugins && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*

 COPY --link --from=rootfs / /

--- a/internal/api/api.go
+++ b/internal/api/api.go
@@ -10,34 +10,36 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"syscall"
+	"time"

 	"github.com/AlexxIT/go2rtc/internal/app"
-	"github.com/AlexxIT/go2rtc/pkg/shell"
 	"github.com/rs/zerolog"
 )

 func Init() {
 	var cfg struct {
 		Mod struct {
-			Listen    string `yaml:"listen"`
-			Username  string `yaml:"username"`
-			Password  string `yaml:"password"`
-			BasePath  string `yaml:"base_path"`
-			StaticDir string `yaml:"static_dir"`
-			Origin    string `yaml:"origin"`
-			TLSListen string `yaml:"tls_listen"`
-			TLSCert   string `yaml:"tls_cert"`
-			TLSKey    string `yaml:"tls_key"`
+			Listen     string `yaml:"listen"`
+			Username   string `yaml:"username"`
+			Password   string `yaml:"password"`
+			BasePath   string `yaml:"base_path"`
+			StaticDir  string `yaml:"static_dir"`
+			Origin     string `yaml:"origin"`
+			TLSListen  string `yaml:"tls_listen"`
+			TLSCert    string `yaml:"tls_cert"`
+			TLSKey     string `yaml:"tls_key"`
+			UnixListen string `yaml:"unix_listen"`
 		} `yaml:"api"`
 	}

 	// default config
-	cfg.Mod.Listen = "0.0.0.0:1984"
+	cfg.Mod.Listen = ":1984"

 	// load config from YAML
 	app.LoadConfig(&cfg)

-	if cfg.Mod.Listen == "" {
+	if cfg.Mod.Listen == "" && cfg.Mod.UnixListen == "" && cfg.Mod.TLSListen == "" {
 		return
 	}

@@ -50,16 +52,7 @@ func Init() {
 	HandleFunc("api/config", configHandler)
 	HandleFunc("api/exit", exitHandler)
 	HandleFunc("api/restart", restartHandler)
-
-	// ensure we can listen without errors
-	var err error
-	ln, err = net.Listen("tcp", cfg.Mod.Listen)
-	if err != nil {
-		log.Fatal().Err(err).Msg("[api] listen")
-		return
-	}
-
-	log.Info().Str("addr", cfg.Mod.Listen).Msg("[api] listen")
+	HandleFunc("api/log", logHandler)

 	Handler = http.DefaultServeMux // 4th

@@ -75,59 +68,78 @@ func Init() {
 		Handler = middlewareLog(Handler) // 1st
 	}

-	go func() {
-		s := http.Server{}
-		s.Handler = Handler
-		if err = s.Serve(ln); err != nil {
-			log.Fatal().Err(err).Msg("[api] serve")
-		}
-	}()
+	if cfg.Mod.Listen != "" {
+		go listen("tcp", cfg.Mod.Listen)
+	}
+
+	if cfg.Mod.UnixListen != "" {
+		_ = syscall.Unlink(cfg.Mod.UnixListen)
+		go listen("unix", cfg.Mod.UnixListen)
+	}

 	// Initialize the HTTPS server
 	if cfg.Mod.TLSListen != "" && cfg.Mod.TLSCert != "" && cfg.Mod.TLSKey != "" {
-		var cert tls.Certificate
-		if strings.IndexByte(cfg.Mod.TLSCert, '\n') < 0 && strings.IndexByte(cfg.Mod.TLSKey, '\n') < 0 {
-			// check if file path
-			cert, err = tls.LoadX509KeyPair(cfg.Mod.TLSCert, cfg.Mod.TLSKey)
-		} else {
-			// if text file content
-			cert, err = tls.X509KeyPair([]byte(cfg.Mod.TLSCert), []byte(cfg.Mod.TLSKey))
-		}
-		if err != nil {
-			log.Error().Err(err).Caller().Send()
-			return
-		}
-
-		tlsListener, err := net.Listen("tcp", cfg.Mod.TLSListen)
-		if err != nil {
-			log.Fatal().Err(err).Caller().Send()
-			return
-		}
-
-		log.Info().Str("addr", cfg.Mod.TLSListen).Msg("[api] tls listen")
-
-		tlsServer := &http.Server{
-			Handler: Handler,
-			TLSConfig: &tls.Config{
-				Certificates: []tls.Certificate{cert},
-			},
-		}
-
-		go func() {
-			if err := tlsServer.ServeTLS(tlsListener, "", ""); err != nil {
-				log.Fatal().Err(err).Msg("[api] tls serve")
-			}
-		}()
+		go tlsListen("tcp", cfg.Mod.TLSListen, cfg.Mod.TLSCert, cfg.Mod.TLSKey)
 	}
 }

-func Port() int {
-	if ln == nil {
-		return 0
+func listen(network, address string) {
+	ln, err := net.Listen(network, address)
+	if err != nil {
+		log.Error().Err(err).Msg("[api] listen")
+		return
+	}
+
+	log.Info().Str("addr", address).Msg("[api] listen")
+
+	if network == "tcp" {
+		Port = ln.Addr().(*net.TCPAddr).Port
+	}
+
+	server := http.Server{
+		Handler:           Handler,
+		ReadHeaderTimeout: 5 * time.Second, // Example: Set to 5 seconds
+	}
+	if err = server.Serve(ln); err != nil {
+		log.Fatal().Err(err).Msg("[api] serve")
 	}
-	return ln.Addr().(*net.TCPAddr).Port
 }

+func tlsListen(network, address, certFile, keyFile string) {
+	var cert tls.Certificate
+	var err error
+	if strings.IndexByte(certFile, '\n') < 0 && strings.IndexByte(keyFile, '\n') < 0 {
+		// check if file path
+		cert, err = tls.LoadX509KeyPair(certFile, keyFile)
+	} else {
+		// if text file content
+		cert, err = tls.X509KeyPair([]byte(certFile), []byte(keyFile))
+	}
+	if err != nil {
+		log.Error().Err(err).Caller().Send()
+		return
+	}
+
+	ln, err := net.Listen(network, address)
+	if err != nil {
+		log.Error().Err(err).Msg("[api] tls listen")
+		return
+	}
+
+	log.Info().Str("addr", address).Msg("[api] tls listen")
+
+	server := &http.Server{
+		Handler:           Handler,
+		TLSConfig:         &tls.Config{Certificates: []tls.Certificate{cert}},
+		ReadHeaderTimeout: 5 * time.Second,
+	}
+	if err = server.ServeTLS(ln, "", ""); err != nil {
+		log.Fatal().Err(err).Msg("[api] tls serve")
+	}
+}
+
+var Port int
+
 const (
 	MimeJSON = "application/json"
 	MimeText = "text/plain"
@@ -187,7 +199,7 @@ func middlewareLog(next http.Handler) http.Handler {

 func middlewareAuth(username, password string, next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if !strings.HasPrefix(r.RemoteAddr, "127.") && !strings.HasPrefix(r.RemoteAddr, "[::1]") {
+		if !strings.HasPrefix(r.RemoteAddr, "127.") && !strings.HasPrefix(r.RemoteAddr, "[::1]") && r.RemoteAddr != "@" {
 			user, pass, ok := r.BasicAuth()
 			if !ok || user != username || pass != password {
 				w.Header().Set("Www-Authenticate", `Basic realm="go2rtc"`)
@@ -204,12 +216,11 @@ func middlewareCORS(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Access-Control-Allow-Origin", "*")
 		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
-		w.Header().Set("Access-Control-Allow-Headers", "Authorization")
+		w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type")
 		next.ServeHTTP(w, r)
 	})
 }

-var ln net.Listener
 var mu sync.Mutex

 func apiHandler(w http.ResponseWriter, r *http.Request) {
@@ -227,7 +238,14 @@ func exitHandler(w http.ResponseWriter, r *http.Request) {
 	}

 	s := r.URL.Query().Get("code")
-	code, _ := strconv.Atoi(s)
+	code, err := strconv.Atoi(s)
+
+	// https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_08_02
+	if err != nil || code < 0 || code > 125 {
+		http.Error(w, "Code must be in the range [0, 125]", http.StatusBadRequest)
+		return
+	}
+
 	os.Exit(code)
 }

@@ -237,7 +255,29 @@ func restartHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	go shell.Restart()
+	path, err := os.Executable()
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	log.Debug().Msgf("[api] restart %s", path)
+
+	go syscall.Exec(path, os.Args, os.Environ())
+}
+
+func logHandler(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case "GET":
+		// Send current state of the log file immediately
+		w.Header().Set("Content-Type", "application/jsonlines")
+		_, _ = app.MemoryLog.WriteTo(w)
+	case "DELETE":
+		app.MemoryLog.Reset()
+		Response(w, "OK", "text/plain")
+	default:
+		http.Error(w, "Method not allowed", http.StatusBadRequest)
+	}
 }

 type Source struct {
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -4,20 +4,18 @@ import (
 	"errors"
 	"flag"
 	"fmt"
-	"io"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"runtime"
 	"strings"
-	"time"

 	"github.com/AlexxIT/go2rtc/pkg/shell"
 	"github.com/AlexxIT/go2rtc/pkg/yaml"
-	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 )

-var Version = "1.8.1"
+var Version = "1.9.0"
 var UserAgent = "go2rtc/" + Version

 var ConfigPath string
@@ -27,14 +25,34 @@ var Info = map[string]any{

 func Init() {
 	var confs Config
+	var daemon bool
 	var version bool

 	flag.Var(&confs, "config", "go2rtc config (path to file or raw text), support multiple")
+	if runtime.GOOS != "windows" {
+		flag.BoolVar(&daemon, "daemon", false, "Run program in background")
+	}
 	flag.BoolVar(&version, "version", false, "Print the version of the application and exit")
 	flag.Parse()

 	if version {
-		fmt.Println("Current version: ", Version)
+		fmt.Println("Current version:", Version)
+		os.Exit(0)
+	}
+
+	if daemon {
+		args := os.Args[1:]
+		for i, arg := range args {
+			if arg == "-daemon" {
+				args[i] = ""
+			}
+		}
+		// Re-run the program in background and exit
+		cmd := exec.Command(os.Args[0], args...)
+		if err := cmd.Start(); err != nil {
+			log.Fatal().Err(err).Send()
+		}
+		fmt.Println("Running in daemon mode with PID:", cmd.Process.Pid)
 		os.Exit(0)
 	}

@@ -86,26 +104,6 @@ func Init() {
 	migrateStore()
 }

-func NewLogger(format string, level string) zerolog.Logger {
-	var writer io.Writer = os.Stdout
-
-	if format != "json" {
-		writer = zerolog.ConsoleWriter{
-			Out: writer, TimeFormat: "15:04:05.000",
-			NoColor: writer != os.Stdout || format == "text",
-		}
-	}
-
-	zerolog.TimeFieldFormat = time.RFC3339Nano
-
-	lvl, err := zerolog.ParseLevel(level)
-	if err != nil || lvl == zerolog.NoLevel {
-		lvl = zerolog.InfoLevel
-	}
-
-	return zerolog.New(writer).With().Timestamp().Logger().Level(lvl)
-}
-
 func LoadConfig(v any) {
 	for _, data := range configs {
 		if err := yaml.Unmarshal(data, v); err != nil {
@@ -114,18 +112,6 @@ func LoadConfig(v any) {
 	}
 }

-func GetLogger(module string) zerolog.Logger {
-	if s, ok := modules[module]; ok {
-		lvl, err := zerolog.ParseLevel(s)
-		if err == nil {
-			return log.Level(lvl)
-		}
-		log.Warn().Err(err).Caller().Send()
-	}
-
-	return log.Logger
-}
-
 func PatchConfig(key string, value any, path ...string) error {
 	if ConfigPath == "" {
 		return errors.New("config file disabled")
@@ -156,6 +142,3 @@ func (c *Config) Set(value string) error {
 }

 var configs [][]byte
-
-// modules log levels
-var modules map[string]string
--- a/internal/app/log.go
+++ b/internal/app/log.go
@@ -0,0 +1,117 @@
+package app
+
+import (
+	"io"
+	"os"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+)
+
+var MemoryLog *circularBuffer
+
+func NewLogger(format string, level string) zerolog.Logger {
+	var writer io.Writer = os.Stdout
+
+	if format != "json" {
+		writer = zerolog.ConsoleWriter{
+			Out: writer, TimeFormat: "15:04:05.000", NoColor: format == "text",
+		}
+	}
+
+	MemoryLog = newBuffer(16)
+
+	writer = zerolog.MultiLevelWriter(writer, MemoryLog)
+
+	zerolog.TimeFieldFormat = zerolog.TimeFormatUnixMs
+
+	lvl, err := zerolog.ParseLevel(level)
+	if err != nil || lvl == zerolog.NoLevel {
+		lvl = zerolog.InfoLevel
+	}
+
+	return zerolog.New(writer).With().Timestamp().Logger().Level(lvl)
+}
+
+func GetLogger(module string) zerolog.Logger {
+	if s, ok := modules[module]; ok {
+		lvl, err := zerolog.ParseLevel(s)
+		if err == nil {
+			return log.Level(lvl)
+		}
+		log.Warn().Err(err).Caller().Send()
+	}
+
+	return log.Logger
+}
+
+// modules log levels
+var modules map[string]string
+
+const chunkSize = 1 << 16
+
+type circularBuffer struct {
+	chunks [][]byte
+	r, w   int
+}
+
+func newBuffer(chunks int) *circularBuffer {
+	b := &circularBuffer{chunks: make([][]byte, 0, chunks)}
+	// create first chunk
+	b.chunks = append(b.chunks, make([]byte, 0, chunkSize))
+	return b
+}
+
+func (b *circularBuffer) Write(p []byte) (n int, err error) {
+	n = len(p)
+
+	// check if chunk has size
+	if len(b.chunks[b.w])+n > chunkSize {
+		// increase write chunk index
+		if b.w++; b.w == cap(b.chunks) {
+			b.w = 0
+		}
+		// check overflow
+		if b.r == b.w {
+			// increase read chunk index
+			if b.r++; b.r == cap(b.chunks) {
+				b.r = 0
+			}
+		}
+		// check if current chunk exists
+		if b.w == len(b.chunks) {
+			// allocate new chunk
+			b.chunks = append(b.chunks, make([]byte, 0, chunkSize))
+		} else {
+			// reset len of current chunk
+			b.chunks[b.w] = b.chunks[b.w][:0]
+		}
+	}
+
+	b.chunks[b.w] = append(b.chunks[b.w], p...)
+	return
+}
+
+func (b *circularBuffer) WriteTo(w io.Writer) (n int64, err error) {
+	for i := b.r; ; {
+		var nn int
+		if nn, err = w.Write(b.chunks[i]); err != nil {
+			return
+		}
+		n += int64(nn)
+
+		if i == b.w {
+			break
+		}
+		if i++; i == cap(b.chunks) {
+			i = 0
+		}
+	}
+	return
+}
+
+func (b *circularBuffer) Reset() {
+	b.chunks[0] = b.chunks[0][:0]
+	b.r = 0
+	b.w = 0
+}
--- a/internal/exec/exec.go
+++ b/internal/exec/exec.go
@@ -5,8 +5,10 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
+	"net/url"
 	"os"
 	"os/exec"
+	"strings"
 	"sync"
 	"time"

@@ -17,6 +19,7 @@ import (
 	"github.com/AlexxIT/go2rtc/pkg/magic"
 	pkg "github.com/AlexxIT/go2rtc/pkg/rtsp"
 	"github.com/AlexxIT/go2rtc/pkg/shell"
+	"github.com/AlexxIT/go2rtc/pkg/stdin"
 	"github.com/rs/zerolog"
 )

@@ -44,17 +47,19 @@ func Init() {
 	log = app.GetLogger("exec")
 }

-func execHandle(url string) (core.Producer, error) {
+func execHandle(rawURL string) (core.Producer, error) {
 	var path string

-	args := shell.QuoteSplit(url[5:]) // remove `exec:`
+	rawURL, rawQuery, _ := strings.Cut(rawURL, "#")
+
+	args := shell.QuoteSplit(rawURL[5:]) // remove `exec:`
 	for i, arg := range args {
 		if arg == "{output}" {
 			if rtsp.Port == "" {
 				return nil, errors.New("rtsp module disabled")
 			}

-			sum := md5.Sum([]byte(url))
+			sum := md5.Sum([]byte(rawURL))
 			path = "/" + hex.EncodeToString(sum[:])
 			args[i] = "rtsp://127.0.0.1:" + rtsp.Port + path
 			break
@@ -67,14 +72,19 @@ func execHandle(url string) (core.Producer, error) {
 	}

 	if path == "" {
-		return handlePipe(url, cmd)
+		query := streams.ParseQuery(rawQuery)
+		return handlePipe(rawURL, cmd, query)
 	}

-	return handleRTSP(url, path, cmd)
+	return handleRTSP(rawURL, path, cmd)
 }

-func handlePipe(url string, cmd *exec.Cmd) (core.Producer, error) {
-	r, err := PipeCloser(cmd)
+func handlePipe(_ string, cmd *exec.Cmd, query url.Values) (core.Producer, error) {
+	if query.Get("backchannel") == "1" {
+		return stdin.NewClient(cmd)
+	}
+
+	r, err := PipeCloser(cmd, query)
 	if err != nil {
 		return nil, err
 	}
@@ -83,7 +93,12 @@ func handlePipe(url string, cmd *exec.Cmd) (core.Producer, error) {
 		return nil, err
 	}

-	return magic.Open(r)
+	prod, err := magic.Open(r)
+	if err != nil {
+		_ = r.Close()
+	}
+
+	return prod, err
 }

 func handleRTSP(url, path string, cmd *exec.Cmd) (core.Producer, error) {
@@ -103,7 +118,7 @@ func handleRTSP(url, path string, cmd *exec.Cmd) (core.Producer, error) {
 		waitersMu.Unlock()
 	}()

-	log.Debug().Str("url", url).Msg("[exec] run")
+	log.Debug().Str("url", url).Str("cmd", fmt.Sprintf("%s", strings.Join(cmd.Args, " "))).Msg("[exec] run")

 	ts := time.Now()

@@ -139,6 +154,8 @@ func handleRTSP(url, path string, cmd *exec.Cmd) (core.Producer, error) {

 // internal

-var log zerolog.Logger
-var waiters = map[string]chan core.Producer{}
-var waitersMu sync.Mutex
+var (
+	log       zerolog.Logger
+	waiters   = map[string]chan core.Producer{}
+	waitersMu sync.Mutex
+)
--- a/internal/exec/pipe.go
+++ b/internal/exec/pipe.go
@@ -2,29 +2,55 @@ package exec

 import (
 	"bufio"
+	"errors"
 	"io"
+	"net/url"
 	"os/exec"
+	"syscall"
+	"time"

 	"github.com/AlexxIT/go2rtc/pkg/core"
 )

 // PipeCloser - return StdoutPipe that Kill cmd on Close call
-func PipeCloser(cmd *exec.Cmd) (io.ReadCloser, error) {
+func PipeCloser(cmd *exec.Cmd, query url.Values) (io.ReadCloser, error) {
 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
 		return nil, err
 	}

 	// add buffer for pipe reader to reduce syscall
-	return pipeCloser{bufio.NewReaderSize(stdout, core.BufferSize), stdout, cmd}, nil
+	return &pipeCloser{bufio.NewReaderSize(stdout, core.BufferSize), stdout, cmd, query}, nil
 }

 type pipeCloser struct {
 	io.Reader
 	io.Closer
-	cmd *exec.Cmd
+	cmd   *exec.Cmd
+	query url.Values
 }

-func (p pipeCloser) Close() error {
-	return core.Any(p.Closer.Close(), p.cmd.Process.Kill(), p.cmd.Wait())
+func (p *pipeCloser) Close() error {
+	return errors.Join(p.Closer.Close(), p.Kill(), p.Wait())
+}
+
+func (p *pipeCloser) Kill() error {
+	if s := p.query.Get("killsignal"); s != "" {
+		log.Trace().Msgf("[exec] kill with custom sig=%s", s)
+		sig := syscall.Signal(core.Atoi(s))
+		return p.cmd.Process.Signal(sig)
+	}
+	return p.cmd.Process.Kill()
+}
+
+func (p *pipeCloser) Wait() error {
+	if s := p.query.Get("killtimeout"); s != "" {
+		timeout := time.Duration(core.Atoi(s)) * time.Second
+		timer := time.AfterFunc(timeout, func() {
+			log.Trace().Msgf("[exec] kill after timeout=%s", s)
+			_ = p.cmd.Process.Kill()
+		})
+		defer timer.Stop() // stop timer if Wait ends before timeout
+	}
+	return p.cmd.Wait()
 }
--- a/internal/expr/README.md
+++ b/internal/expr/README.md
@@ -0,0 +1,91 @@
+# Expr
+
+[Expr](https://github.com/antonmedv/expr) - expression language and expression evaluation for Go.
+
+- [language definition](https://expr.medv.io/docs/Language-Definition) - takes best from JS, Python, Jinja2 syntax
+- your expression should return a link of any supported source
+- expression supports multiple operation, but:
+  - all operations must be separated by a semicolon
+  - all operations, except the last one, must declare a new variable (`let s = "abc";`)
+  - the last operation should return a string
+- go2rtc supports additional functions:
+  - `fetch` - JS-like HTTP requests
+  - `match` - JS-like RegExp queries
+
+## Examples
+
+**Two way audio for Dahua VTO**
+
+```yaml
+streams:
+  dahua_vto: |
+    expr: let host = "admin:password@192.168.1.123";
+    fetch("http://"+host+"/cgi-bin/configManager.cgi?action=setConfig&Encode[0].MainFormat[0].Audio.Compression=G.711A&Encode[0].MainFormat[0].Audio.Frequency=8000").ok
+        ? "rtsp://"+host+"/cam/realmonitor?channel=1&subtype=0&unicast=true&proto=Onvif" : ""
+```
+
+**dom.ru**
+
+You can get credentials via:
+
+- https://github.com/alexmorbo/domru (file `/share/domru/accounts`)
+- https://github.com/ad/domru
+
+```yaml
+streams:
+  dom_ru: |
+    expr: let camera = "99999999"; let token = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; let operator = 99;
+    fetch("https://myhome.novotelecom.ru/rest/v1/forpost/cameras/"+camera+"/video", {
+      headers: {Authorization: "Bearer "+token, Operator: operator}
+    }).json().data.URL
+```
+
+**Parse HLS files from Apple**
+
+Same example in two languages - python and expr.
+
+```yaml
+streams:
+  example_python: |
+    echo:python -c 'from urllib.request import urlopen; import re
+
+    # url1 = "https://devstreaming-cdn.apple.com/videos/streaming/examples/bipbop_16x9/bipbop_16x9_variant.m3u8"
+    html1 = urlopen("https://developer.apple.com/streaming/examples/basic-stream-osx-ios5.html").read().decode("utf-8")
+    url1 = re.search(r"https.+?m3u8", html1)[0]
+
+    # url2 = "gear1/prog_index.m3u8"
+    html2 = urlopen(url1).read().decode("utf-8")
+    url2 = re.search(r"^[a-z0-1/_]+\.m3u8$", html2, flags=re.MULTILINE)[0]
+
+    # url3 = "https://devstreaming-cdn.apple.com/videos/streaming/examples/bipbop_16x9/gear1/prog_index.m3u8"
+    url3 = url1[:url1.rindex("/")+1] + url2
+
+    print("ffmpeg:" + url3 + "#video=copy")'
+
+  example_expr: |
+    expr:
+
+    let html1 = fetch("https://developer.apple.com/streaming/examples/basic-stream-osx-ios5.html").text;
+    let url1 = match(html1, "https.+?m3u8")[0];
+
+    let html2 = fetch(url1).text;
+    let url2 = match(html2, "^[a-z0-1/_]+\\.m3u8$", "m")[0];
+
+    let url3 = url1[:lastIndexOf(url1, "/")+1] + url2;
+
+    "ffmpeg:" + url3 + "#video=copy"
+```
+
+## Comparsion
+
+| expr                         | python                     | js                             |
+|------------------------------|----------------------------|--------------------------------|
+| let x = 1;                   | x = 1                      | let x = 1                      |
+| {a: 1, b: 2}                 | {"a": 1, "b": 2}           | {a: 1, b: 2}                   |
+| let r = fetch(url, {method}) | r = request(method, url)   | r = await fetch(url, {method}) |
+| r.ok                         | r.ok                       | r.ok                           |
+| r.status                     | r.status_code              | r.status                       |
+| r.text                       | r.text                     | await r.text()                 |
+| r.json()                     | r.json()                   | await r.json()                 |
+| r.headers                    | r.headers                  | r.headers                      |
+| let m = match(text, "abc")   | m = re.search("abc", text) | let m = text.match(/abc/)      |
--- a/internal/expr/expr.go
+++ b/internal/expr/expr.go
@@ -0,0 +1,28 @@
+package expr
+
+import (
+	"errors"
+
+	"github.com/AlexxIT/go2rtc/internal/app"
+	"github.com/AlexxIT/go2rtc/internal/streams"
+	"github.com/AlexxIT/go2rtc/pkg/expr"
+)
+
+func Init() {
+	log := app.GetLogger("expr")
+
+	streams.RedirectFunc("expr", func(url string) (string, error) {
+		v, err := expr.Run(url[5:])
+		if err != nil {
+			return "", err
+		}
+
+		log.Debug().Msgf("[expr] url=%s", url)
+
+		if url = v.(string); url == "" {
+			return "", errors.New("expr: result is empty")
+		}
+
+		return url, nil
+	})
+}
--- a/internal/ffmpeg/device/device_freebsd.go
+++ b/internal/ffmpeg/device/device_freebsd.go
@@ -0,0 +1,97 @@
+package device
+
+import (
+	"net/url"
+	"os"
+	"os/exec"
+	"regexp"
+	"strings"
+
+	"github.com/AlexxIT/go2rtc/internal/api"
+	"github.com/AlexxIT/go2rtc/pkg/core"
+)
+
+func queryToInput(query url.Values) string {
+	if video := query.Get("video"); video != "" {
+		// https://ffmpeg.org/ffmpeg-devices.html#video4linux2_002c-v4l2
+		input := "-f v4l2"
+
+		for key, value := range query {
+			switch key {
+			case "resolution":
+				input += " -video_size " + value[0]
+			case "video_size", "pixel_format", "input_format", "framerate", "use_libv4l2":
+				input += " -" + key + " " + value[0]
+			}
+		}
+
+		return input + " -i " + indexToItem(videos, video)
+	}
+
+	if audio := query.Get("audio"); audio != "" {
+		input := "-f oss"
+
+		for key, value := range query {
+			switch key {
+			case "channels", "sample_rate":
+				input += " -" + key + " " + value[0]
+			}
+		}
+
+		return input + " -i " + indexToItem(audios, audio)
+	}
+
+	return ""
+}
+
+func initDevices() {
+	files, err := os.ReadDir("/dev")
+	if err != nil {
+		return
+	}
+
+	for _, file := range files {
+		if !strings.HasPrefix(file.Name(), core.KindVideo) {
+			continue
+		}
+
+		name := "/dev/" + file.Name()
+
+		cmd := exec.Command(
+			Bin, "-hide_banner", "-f", "v4l2", "-list_formats", "all", "-i", name,
+		)
+		b, _ := cmd.CombinedOutput()
+
+		// [video4linux2,v4l2 @ 0x860b92280] Raw       :     yuyv422 :           YUYV 4:2:2 : 640x480 160x120 176x144 320x176 320x240 352x288 432x240 544x288 640x360 752x416 800x448 800x600 864x480 960x544 960x720 1024x576 1184x656 1280x720 1280x960
+		// [video4linux2,v4l2 @ 0x860b92280] Compressed:       mjpeg :          Motion-JPEG : 640x480 160x120 176x144 320x176 320x240 352x288 432x240 544x288 640x360 752x416 800x448 800x600 864x480 960x544 960x720 1024x576 1184x656 1280x720 1280x960
+		re := regexp.MustCompile("(Raw *|Compressed): +(.+?) : +(.+?) : (.+)")
+		m := re.FindAllStringSubmatch(string(b), -1)
+		for _, i := range m {
+			size, _, _ := strings.Cut(i[4], " ")
+			stream := &api.Source{
+				Name: i[3],
+				Info: i[4],
+				URL:  "ffmpeg:device?video=" + name + "&input_format=" + i[2] + "&video_size=" + size,
+			}
+
+			if i[1] != "Compressed" {
+				stream.URL += "#video=h264#hardware"
+			}
+
+			videos = append(videos, name)
+			streams = append(streams, stream)
+		}
+	}
+
+	err = exec.Command(Bin, "-f", "oss", "-i", "/dev/dsp", "-t", "1", "-f", "null", "-").Run()
+	if err == nil {
+		stream := &api.Source{
+			Name: "OSS default",
+			Info: " ",
+			URL:  "ffmpeg:device?audio=default&channels=1&sample_rate=16000&#audio=opus",
+		}
+
+		audios = append(audios, "default")
+		streams = append(streams, stream)
+	}
+}
--- a/internal/ffmpeg/device/device_windows.go
+++ b/internal/ffmpeg/device/device_windows.go
@@ -45,30 +45,20 @@ func queryToInput(query url.Values) string {
 	}

 	if video != "" {
-		input += ` -i video="` + video + `"`
+		input += ` -i "video=` + video

 		if audio != "" {
-			input += `:audio="` + audio + `"`
+			input += `:audio=` + audio
 		}
+
+		input += `"`
 	} else {
-		input += ` -i audio="` + audio + `"`
+		input += ` -i "audio=` + audio + `"`
 	}

 	return input
 }

-func deviceInputSuffix(video, audio string) string {
-	switch {
-	case video != "" && audio != "":
-		return `video="` + video + `":audio=` + audio + `"`
-	case video != "":
-		return `video="` + video + `"`
-	case audio != "":
-		return `audio="` + audio + `"`
-	}
-	return ""
-}
-
 func initDevices() {
 	cmd := exec.Command(
 		Bin, "-hide_banner", "-list_devices", "true", "-f", "dshow", "-i", "",
--- a/internal/ffmpeg/ffmpeg.go
+++ b/internal/ffmpeg/ffmpeg.go
@@ -61,47 +61,58 @@ var defaults = map[string]string{
 	// https://ffmpeg.org/ffmpeg-codecs.html#libopus-1
 	// https://github.com/pion/webrtc/issues/1514
 	// https://ffmpeg.org/ffmpeg-resampler.html
-	// `-async 1` or `-min_comp 0` - force frame_size=960, important for WebRTC audio quality
-	"opus":       "-c:a libopus -application:a lowdelay -frame_duration 20 -min_comp 0",
+	// `-async 1` or `-min_comp 0` - force resampling for static timestamp inc, important for WebRTC audio quality
+	"opus":       "-c:a libopus -application:a lowdelay -min_comp 0",
+	"opus/16000": "-c:a libopus -application:a lowdelay -min_comp 0 -ar:a 16000 -ac:a 1",
 	"pcmu":       "-c:a pcm_mulaw -ar:a 8000 -ac:a 1",
+	"pcmu/8000":  "-c:a pcm_mulaw -ar:a 8000 -ac:a 1",
 	"pcmu/16000": "-c:a pcm_mulaw -ar:a 16000 -ac:a 1",
 	"pcmu/48000": "-c:a pcm_mulaw -ar:a 48000 -ac:a 1",
 	"pcma":       "-c:a pcm_alaw -ar:a 8000 -ac:a 1",
+	"pcma/8000":  "-c:a pcm_alaw -ar:a 8000 -ac:a 1",
 	"pcma/16000": "-c:a pcm_alaw -ar:a 16000 -ac:a 1",
 	"pcma/48000": "-c:a pcm_alaw -ar:a 48000 -ac:a 1",
 	"aac":        "-c:a aac", // keep sample rate and channels
 	"aac/16000":  "-c:a aac -ar:a 16000 -ac:a 1",
 	"mp3":        "-c:a libmp3lame -q:a 8",
 	"pcm":        "-c:a pcm_s16be -ar:a 8000 -ac:a 1",
+	"pcm/8000":   "-c:a pcm_s16be -ar:a 8000 -ac:a 1",
 	"pcm/16000":  "-c:a pcm_s16be -ar:a 16000 -ac:a 1",
 	"pcm/48000":  "-c:a pcm_s16be -ar:a 48000 -ac:a 1",
 	"pcml":       "-c:a pcm_s16le -ar:a 8000 -ac:a 1",
+	"pcml/8000":  "-c:a pcm_s16le -ar:a 8000 -ac:a 1",
 	"pcml/44100": "-c:a pcm_s16le -ar:a 44100 -ac:a 1",

 	// hardware Intel and AMD on Linux
 	// better not to set `-async_depth:v 1` like for QSV, because framedrops
 	// `-bf 0` - disable B-frames is very important
 	"h264/vaapi":  "-c:v h264_vaapi -g 50 -bf 0 -profile:v high -level:v 4.1 -sei:v 0",
-	"h265/vaapi":  "-c:v hevc_vaapi -g 50 -bf 0 -profile:v high -level:v 5.1 -sei:v 0",
+	"h265/vaapi":  "-c:v hevc_vaapi -g 50 -bf 0 -profile:v main -level:v 5.1 -sei:v 0",
 	"mjpeg/vaapi": "-c:v mjpeg_vaapi",

 	// hardware Raspberry
 	"h264/v4l2m2m": "-c:v h264_v4l2m2m -g 50 -bf 0",
 	"h265/v4l2m2m": "-c:v hevc_v4l2m2m -g 50 -bf 0",

+	// hardware Rockchip
+	// important to use custom ffmpeg https://github.com/AlexxIT/go2rtc/issues/768
+	// hevc - doesn't have a profile setting
+	"h264/rkmpp": "-c:v h264_rkmpp_encoder -g 50 -bf 0 -profile:v high -level:v 4.1",
+	"h265/rkmpp": "-c:v hevc_rkmpp_encoder -g 50 -bf 0 -level:v 5.1",
+
 	// hardware NVidia on Linux and Windows
 	// preset=p2 - faster, tune=ll - low latency
 	"h264/cuda": "-c:v h264_nvenc -g 50 -bf 0 -profile:v high -level:v auto -preset:v p2 -tune:v ll",
-	"h265/cuda": "-c:v hevc_nvenc -g 50 -bf 0 -profile:v high -level:v auto",
+	"h265/cuda": "-c:v hevc_nvenc -g 50 -bf 0 -profile:v main -level:v auto",

 	// hardware Intel on Windows
 	"h264/dxva2":  "-c:v h264_qsv -g 50 -bf 0 -profile:v high -level:v 4.1 -async_depth:v 1",
-	"h265/dxva2":  "-c:v hevc_qsv -g 50 -bf 0 -profile:v high -level:v 5.1 -async_depth:v 1",
-	"mjpeg/dxva2": "-c:v mjpeg_qsv -profile:v high -level:v 5.1",
+	"h265/dxva2":  "-c:v hevc_qsv -g 50 -bf 0 -profile:v main -level:v 5.1 -async_depth:v 1",
+	"mjpeg/dxva2": "-c:v mjpeg_qsv",

 	// hardware macOS
 	"h264/videotoolbox": "-c:v h264_videotoolbox -g 50 -bf 0 -profile:v high -level:v 4.1",
-	"h265/videotoolbox": "-c:v hevc_videotoolbox -g 50 -bf 0 -profile:v high -level:v 5.1",
+	"h265/videotoolbox": "-c:v hevc_videotoolbox -g 50 -bf 0 -profile:v main -level:v 5.1",
 }

 // configTemplate - return template from config (defaults) if exist or return raw template
--- a/internal/ffmpeg/ffmpeg_test.go
+++ b/internal/ffmpeg/ffmpeg_test.go
@@ -7,40 +7,62 @@ import (
 )

 func TestParseArgsFile(t *testing.T) {
-	// [FILE] all tracks will be copied without transcoding codecs
-	args := parseArgs("/media/bbb.mp4")
-	require.Equal(t, `ffmpeg -hide_banner -re -i /media/bbb.mp4 -c copy -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
-
-	// [FILE] video will be transcoded to H264, audio will be skipped
-	args = parseArgs("/media/bbb.mp4#video=h264")
-	require.Equal(t, `ffmpeg -hide_banner -re -i /media/bbb.mp4 -c:v libx264 -g 50 -profile:v high -level:v 4.1 -preset:v superfast -tune:v zerolatency -pix_fmt:v yuv420p -an -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
-
-	// [FILE] video will be copied, audio will be transcoded to pcmu
-	args = parseArgs("/media/bbb.mp4#video=copy#audio=pcmu")
-	require.Equal(t, `ffmpeg -hide_banner -re -i /media/bbb.mp4 -c:v copy -c:a pcm_mulaw -ar:a 8000 -ac:a 1 -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
-
-	// [FILE] video will be transcoded to H265 and rotate 270º, audio will be skipped
-	args = parseArgs("/media/bbb.mp4#video=h265#rotate=-90")
-	require.Equal(t, `ffmpeg -hide_banner -re -i /media/bbb.mp4 -c:v libx265 -g 50 -profile:v main -level:v 5.1 -preset:v superfast -tune:v zerolatency -an -vf "transpose=2" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
-
-	// [FILE] video will be output for MJPEG to pipe, audio will be skipped
-	args = parseArgs("/media/bbb.mp4#video=mjpeg")
-	require.Equal(t, `ffmpeg -hide_banner -re -i /media/bbb.mp4 -c:v mjpeg -an -f mjpeg -`, args.String())
-
-	// https://github.com/AlexxIT/go2rtc/issues/509
-	args = parseArgs("ffmpeg:test.mp4#raw=-ss 00:00:20")
-	require.Equal(t, `ffmpeg -hide_banner -re -i ffmpeg:test.mp4 -ss 00:00:20 -c copy -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
+	tests := []struct {
+		name   string
+		source string
+		expect string
+	}{
+		{
+			name:   "[FILE] all tracks will be copied without transcoding codecs",
+			source: "/media/bbb.mp4",
+			expect: `ffmpeg -hide_banner -re -i /media/bbb.mp4 -c copy -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`,
+		},
+		{
+			name:   "[FILE] video will be transcoded to H264, audio will be skipped",
+			source: "/media/bbb.mp4#video=h264",
+			expect: `ffmpeg -hide_banner -re -i /media/bbb.mp4 -c:v libx264 -g 50 -profile:v high -level:v 4.1 -preset:v superfast -tune:v zerolatency -pix_fmt:v yuv420p -an -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`,
+		},
+		{
+			name:   "[FILE] video will be copied, audio will be transcoded to pcmu",
+			source: "/media/bbb.mp4#video=copy#audio=pcmu",
+			expect: `ffmpeg -hide_banner -re -i /media/bbb.mp4 -c:v copy -c:a pcm_mulaw -ar:a 8000 -ac:a 1 -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`,
+		},
+		{
+			name:   "[FILE] video will be transcoded to H265 and rotate 270º, audio will be skipped",
+			source: "/media/bbb.mp4#video=h265#rotate=-90",
+			expect: `ffmpeg -hide_banner -re -i /media/bbb.mp4 -c:v libx265 -g 50 -profile:v main -level:v 5.1 -preset:v superfast -tune:v zerolatency -an -vf "transpose=2" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`,
+		},
+		{
+			name:   "[FILE] video will be output for MJPEG to pipe, audio will be skipped",
+			source: "/media/bbb.mp4#video=mjpeg",
+			expect: `ffmpeg -hide_banner -re -i /media/bbb.mp4 -c:v mjpeg -an -f mjpeg -`,
+		},
+		{
+			name:   "https://github.com/AlexxIT/go2rtc/issues/509",
+			source: "ffmpeg:test.mp4#raw=-ss 00:00:20",
+			expect: `ffmpeg -hide_banner -re -i ffmpeg:test.mp4 -ss 00:00:20 -c copy -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			args := parseArgs(test.source)
+			require.Equal(t, test.expect, args.String())
+		})
+	}
 }

 func TestParseArgsDevice(t *testing.T) {
 	// [DEVICE] video will be output for MJPEG to pipe, with size 1920x1080
 	args := parseArgs("device?video=0&video_size=1920x1080")
-	require.Equal(t, `ffmpeg -hide_banner -f dshow -video_size 1920x1080 -i video="0" -c copy -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
+	require.Equal(t, `ffmpeg -hide_banner -f dshow -video_size 1920x1080 -i "video=0" -c copy -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())

 	// [DEVICE] video will be transcoded to H265 with framerate 20, audio will be skipped
 	//args = parseArgs("device?video=0&video_size=1280x720&framerate=20#video=h265#audio=pcma")
-	args = parseArgs("device?video=0&framerate=20#video=h265#audio=pcma")
-	require.Equal(t, `ffmpeg -hide_banner -f dshow -framerate 20 -i video="0" -c:v libx265 -g 50 -profile:v main -level:v 5.1 -preset:v superfast -tune:v zerolatency -c:a pcm_alaw -ar:a 8000 -ac:a 1 -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
+	args = parseArgs("device?video=0&framerate=20#video=h265")
+	require.Equal(t, `ffmpeg -hide_banner -f dshow -framerate 20 -i "video=0" -c:v libx265 -g 50 -profile:v main -level:v 5.1 -preset:v superfast -tune:v zerolatency -an -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
+
+	args = parseArgs("device?video=FaceTime HD Camera&audio=Microphone (High Definition Audio Device)")
+	require.Equal(t, `ffmpeg -hide_banner -f dshow -i "video=FaceTime HD Camera:audio=Microphone (High Definition Audio Device)" -c copy -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
 }

 func TestParseArgsIpCam(t *testing.T) {
@@ -84,7 +106,7 @@ func TestParseArgsAudio(t *testing.T) {

 	// [AUDIO] audio will be transcoded to OPUS, video will be skipped
 	args = parseArgs("rtsp:///example.com#audio=opus")
-	require.Equal(t, `ffmpeg -hide_banner -allowed_media_types audio -fflags nobuffer -flags low_delay -timeout 5000000 -user_agent go2rtc/ffmpeg -rtsp_flags prefer_tcp -i rtsp:///example.com -c:a libopus -application:a lowdelay -frame_duration 20 -min_comp 0 -vn -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
+	require.Equal(t, `ffmpeg -hide_banner -allowed_media_types audio -fflags nobuffer -flags low_delay -timeout 5000000 -user_agent go2rtc/ffmpeg -rtsp_flags prefer_tcp -i rtsp:///example.com -c:a libopus -application:a lowdelay -min_comp 0 -vn -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())

 	// [AUDIO] audio will be transcoded to PCMU, video will be skipped
 	args = parseArgs("rtsp:///example.com#audio=pcmu")
@@ -112,28 +134,46 @@ func TestParseArgsAudio(t *testing.T) {
 }

 func TestParseArgsHwVaapi(t *testing.T) {
-	// [HTTP-MJPEG] video will be transcoded to H264
-	args := parseArgs("http:///example.com#video=h264#hardware=vaapi")
-	require.Equal(t, `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_flags allow_profile_mismatch -fflags nobuffer -flags low_delay -i http:///example.com -c:v h264_vaapi -g 50 -bf 0 -profile:v high -level:v 4.1 -sei:v 0 -an -vf "format=vaapi|nv12,hwupload,scale_vaapi=out_range=tv" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
-
-	// [RTSP] video with rotation, should be transcoded, so select H264
-	args = parseArgs("rtsp://example.com#video=h264#rotate=180#hardware=vaapi")
-	require.Equal(t, `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_flags allow_profile_mismatch -allowed_media_types video -fflags nobuffer -flags low_delay -timeout 5000000 -user_agent go2rtc/ffmpeg -rtsp_flags prefer_tcp -i rtsp://example.com -c:v h264_vaapi -g 50 -bf 0 -profile:v high -level:v 4.1 -sei:v 0 -an -vf "format=vaapi|nv12,hwupload,transpose_vaapi=4,scale_vaapi=out_range=tv" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
-
-	// [RTSP] video with resize to 1280x720, should be transcoded, so select H265
-	args = parseArgs("rtsp://example.com#video=h265#width=1280#height=720#hardware=vaapi")
-	require.Equal(t, `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_flags allow_profile_mismatch -allowed_media_types video -fflags nobuffer -flags low_delay -timeout 5000000 -user_agent go2rtc/ffmpeg -rtsp_flags prefer_tcp -i rtsp://example.com -c:v hevc_vaapi -g 50 -bf 0 -profile:v high -level:v 5.1 -sei:v 0 -an -vf "format=vaapi|nv12,hwupload,scale_vaapi=1280:720:out_range=tv" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
-
-	// [FILE] video will be output for MJPEG to pipe, audio will be skipped
-	args = parseArgs("/media/bbb.mp4#video=mjpeg#hardware=vaapi")
-	require.Equal(t, `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_flags allow_profile_mismatch -re -i /media/bbb.mp4 -c:v mjpeg_vaapi -an -vf "format=vaapi|nv12,hwupload,scale_vaapi=out_range=tv" -f mjpeg -`, args.String())
-
-	// [DEVICE] MJPEG video with size 1920x1080 will be transcoded to H265
-	args = parseArgs("device?video=0&video_size=1920x1080#video=h265#hardware=vaapi")
-	require.Equal(t, `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_flags allow_profile_mismatch -f dshow -video_size 1920x1080 -i video="0" -c:v hevc_vaapi -g 50 -bf 0 -profile:v high -level:v 5.1 -sei:v 0 -an -vf "format=vaapi|nv12,hwupload,scale_vaapi=out_range=tv" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
+	tests := []struct {
+		name   string
+		source string
+		expect string
+	}{
+		{
+			name:   "[HTTP-MJPEG] video will be transcoded to H264",
+			source: "http:///example.com#video=h264#hardware=vaapi",
+			expect: `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_flags allow_profile_mismatch -fflags nobuffer -flags low_delay -i http:///example.com -c:v h264_vaapi -g 50 -bf 0 -profile:v high -level:v 4.1 -sei:v 0 -an -vf "format=vaapi|nv12,hwupload,scale_vaapi=out_color_matrix=bt709:out_range=tv:format=nv12" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`,
+		},
+		{
+			name:   "[RTSP] video with rotation, should be transcoded, so select H264",
+			source: "rtsp://example.com#video=h264#rotate=180#hardware=vaapi",
+			expect: `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_flags allow_profile_mismatch -allowed_media_types video -fflags nobuffer -flags low_delay -timeout 5000000 -user_agent go2rtc/ffmpeg -rtsp_flags prefer_tcp -i rtsp://example.com -c:v h264_vaapi -g 50 -bf 0 -profile:v high -level:v 4.1 -sei:v 0 -an -vf "format=vaapi|nv12,hwupload,transpose_vaapi=4,scale_vaapi=out_color_matrix=bt709:out_range=tv:format=nv12" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`,
+		},
+		{
+			name:   "[RTSP] video with resize to 1280x720, should be transcoded, so select H265",
+			source: "rtsp://example.com#video=h265#width=1280#height=720#hardware=vaapi",
+			expect: `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_flags allow_profile_mismatch -allowed_media_types video -fflags nobuffer -flags low_delay -timeout 5000000 -user_agent go2rtc/ffmpeg -rtsp_flags prefer_tcp -i rtsp://example.com -c:v hevc_vaapi -g 50 -bf 0 -profile:v main -level:v 5.1 -sei:v 0 -an -vf "format=vaapi|nv12,hwupload,scale_vaapi=1280:720" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`,
+		},
+		{
+			name:   "[FILE] video will be output for MJPEG to pipe, audio will be skipped",
+			source: "/media/bbb.mp4#video=mjpeg#hardware=vaapi",
+			expect: `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_flags allow_profile_mismatch -re -i /media/bbb.mp4 -c:v mjpeg_vaapi -an -vf "format=vaapi|nv12,hwupload" -f mjpeg -`,
+		},
+		{
+			name:   "[DEVICE] MJPEG video with size 1920x1080 will be transcoded to H265",
+			source: "device?video=0&video_size=1920x1080#video=h265#hardware=vaapi",
+			expect: `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_flags allow_profile_mismatch -f dshow -video_size 1920x1080 -i "video=0" -c:v hevc_vaapi -g 50 -bf 0 -profile:v main -level:v 5.1 -sei:v 0 -an -vf "format=vaapi|nv12,hwupload" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			args := parseArgs(test.source)
+			require.Equal(t, test.expect, args.String())
+		})
+	}
 }

-func TestParseArgsHwV4l2m2m(t *testing.T) {
+func _TestParseArgsHwV4l2m2m(t *testing.T) {
 	// [HTTP-MJPEG] video will be transcoded to H264
 	args := parseArgs("http:///example.com#video=h264#hardware=v4l2m2m")
 	require.Equal(t, `ffmpeg -hide_banner -fflags nobuffer -flags low_delay -i http:///example.com -c:v h264_v4l2m2m -g 50 -bf 0 -an -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
@@ -151,7 +191,19 @@ func TestParseArgsHwV4l2m2m(t *testing.T) {
 	require.Equal(t, `ffmpeg -hide_banner -f dshow -video_size 1920x1080 -i video="0" -c:v hevc_v4l2m2m -g 50 -bf 0 -an -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
 }

-func TestParseArgsHwCuda(t *testing.T) {
+func TestParseArgsHwRKMPP(t *testing.T) {
+	// [HTTP-MJPEG] video will be transcoded to H264
+	args := parseArgs("http://example.com#video=h264#hardware=rkmpp")
+	require.Equal(t, `ffmpeg -hide_banner -fflags nobuffer -flags low_delay -i http://example.com -c:v h264_rkmpp_encoder -g 50 -bf 0 -profile:v high -level:v 4.1 -an -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
+
+	args = parseArgs("http://example.com#video=h264#rotate=180#hardware=rkmpp")
+	require.Equal(t, `ffmpeg -hide_banner -fflags nobuffer -flags low_delay -i http://example.com -c:v h264_rkmpp_encoder -g 50 -bf 0 -profile:v high -level:v 4.1 -an -vf "transpose=1,transpose=1" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
+
+	args = parseArgs("http://example.com#video=h264#height=320#hardware=rkmpp")
+	require.Equal(t, `ffmpeg -hide_banner -fflags nobuffer -flags low_delay -i http://example.com -c:v h264_rkmpp_encoder -g 50 -bf 0 -profile:v high -level:v 4.1 -height 320 -an -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
+}
+
+func _TestParseArgsHwCuda(t *testing.T) {
 	// [HTTP-MJPEG] video will be transcoded to H264
 	args := parseArgs("http:///example.com#video=h264#hardware=cuda")
 	require.Equal(t, `ffmpeg -hide_banner -hwaccel cuda -hwaccel_output_format cuda -fflags nobuffer -flags low_delay -i http:///example.com -c:v h264_nvenc -g 50 -bf 0 -profile:v high -level:v auto -preset:v p2 -tune:v ll -an -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
@@ -169,7 +221,7 @@ func TestParseArgsHwCuda(t *testing.T) {
 	require.Equal(t, `ffmpeg -hide_banner -hwaccel cuda -hwaccel_output_format cuda -f dshow -video_size 1920x1080 -i video="0" -c:v hevc_nvenc -g 50 -bf 0 -profile:v high -level:v auto -an -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
 }

-func TestParseArgsHwDxva2(t *testing.T) {
+func _TestParseArgsHwDxva2(t *testing.T) {
 	// [HTTP-MJPEG] video will be transcoded to H264
 	args := parseArgs("http:///example.com#video=h264#hardware=dxva2")
 	require.Equal(t, `ffmpeg -hide_banner -hwaccel dxva2 -hwaccel_output_format dxva2_vld -fflags nobuffer -flags low_delay -i http:///example.com -c:v h264_qsv -g 50 -bf 0 -profile:v high -level:v 4.1 -async_depth:v 1 -an -vf "hwmap=derive_device=qsv,format=qsv" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
@@ -191,7 +243,7 @@ func TestParseArgsHwDxva2(t *testing.T) {
 	require.Equal(t, `ffmpeg -hide_banner -hwaccel dxva2 -hwaccel_output_format dxva2_vld -f dshow -video_size 1920x1080 -i video="0" -c:v hevc_qsv -g 50 -bf 0 -profile:v high -level:v 5.1 -async_depth:v 1 -an -vf "hwmap=derive_device=qsv,format=qsv" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
 }

-func TestParseArgsHwVideotoolbox(t *testing.T) {
+func _TestParseArgsHwVideotoolbox(t *testing.T) {
 	// [HTTP-MJPEG] video will be transcoded to H264
 	args := parseArgs("http:///example.com#video=h264#hardware=videotoolbox")
 	require.Equal(t, `ffmpeg -hide_banner -hwaccel videotoolbox -hwaccel_output_format videotoolbox_vld -fflags nobuffer -flags low_delay -i http:///example.com -c:v h264_videotoolbox -g 50 -bf 0 -profile:v high -level:v 4.1 -an -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
@@ -211,5 +263,32 @@ func TestParseArgsHwVideotoolbox(t *testing.T) {

 func TestDeckLink(t *testing.T) {
 	args := parseArgs(`DeckLink SDI (2)#video=h264#hardware=vaapi#input=-format_code Hp29 -f decklink -i "{input}"`)
-	require.Equal(t, `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_flags allow_profile_mismatch -format_code Hp29 -f decklink -i "DeckLink SDI (2)" -c:v h264_vaapi -g 50 -bf 0 -profile:v high -level:v 4.1 -sei:v 0 -an -vf "format=vaapi|nv12,hwupload,scale_vaapi=out_range=tv" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
+	require.Equal(t, `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_flags allow_profile_mismatch -format_code Hp29 -f decklink -i "DeckLink SDI (2)" -c:v h264_vaapi -g 50 -bf 0 -profile:v high -level:v 4.1 -sei:v 0 -an -vf "format=vaapi|nv12,hwupload,scale_vaapi=out_color_matrix=bt709:out_range=tv:format=nv12" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`, args.String())
+}
+
+func TestDrawText(t *testing.T) {
+	tests := []struct {
+		name   string
+		source string
+		expect string
+	}{
+		{
+			source: "http:///example.com#video=h264#drawtext=fontsize=12",
+			expect: `ffmpeg -hide_banner -fflags nobuffer -flags low_delay -i http:///example.com -c:v libx264 -g 50 -profile:v high -level:v 4.1 -preset:v superfast -tune:v zerolatency -pix_fmt:v yuv420p -an -vf "drawtext=fontsize=12:text='%{localtime\:%Y-%m-%d %X}'" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`,
+		},
+		{
+			source: "http:///example.com#video=h264#width=640#drawtext=fontsize=12",
+			expect: `ffmpeg -hide_banner -fflags nobuffer -flags low_delay -i http:///example.com -c:v libx264 -g 50 -profile:v high -level:v 4.1 -preset:v superfast -tune:v zerolatency -pix_fmt:v yuv420p -an -vf "scale=640:-1,drawtext=fontsize=12:text='%{localtime\:%Y-%m-%d %X}'" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`,
+		},
+		{
+			source: "http:///example.com#video=h264#width=640#drawtext=fontsize=12#hardware=vaapi",
+			expect: `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format nv12 -hwaccel_flags allow_profile_mismatch -fflags nobuffer -flags low_delay -i http:///example.com -c:v h264_vaapi -g 50 -bf 0 -profile:v high -level:v 4.1 -sei:v 0 -an -vf "scale=640:-1,drawtext=fontsize=12:text='%{localtime\:%Y-%m-%d %X}',hwupload" -user_agent ffmpeg/go2rtc -rtsp_transport tcp -f rtsp {output}`,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			args := parseArgs(test.source)
+			require.Equal(t, test.expect, args.String())
+		})
+	}
 }
--- a/internal/ffmpeg/hardware/hardware.go
+++ b/internal/ffmpeg/hardware/hardware.go
@@ -18,6 +18,7 @@ const (
 	EngineCUDA         = "cuda"         // NVidia on Windows and Linux
 	EngineDXVA2        = "dxva2"        // Intel on Windows
 	EngineVideoToolbox = "videotoolbox" // macOS
+	EngineRKMPP        = "rkmpp"        // Rockchip
 )

 func Init(bin string) {
@@ -58,11 +59,13 @@ func MakeHardware(args *ffmpeg.Args, engine string, defaults map[string]string)
 		case EngineVAAPI:
 			args.Codecs[i] = defaults[name+"/"+engine]

-			fixYCbCrRange(args)
-
 			if !args.HasFilters("drawtext=") {
 				args.Input = "-hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_flags allow_profile_mismatch " + args.Input

+				if name == "h264" {
+					fixPixelFormat(args)
+				}
+
 				for i, filter := range args.Filters {
 					if strings.HasPrefix(filter, "scale=") {
 						args.Filters[i] = "scale_vaapi=" + filter[6:]
@@ -123,6 +126,24 @@ func MakeHardware(args *ffmpeg.Args, engine string, defaults map[string]string)

 		case EngineV4L2M2M:
 			args.Codecs[i] = defaults[name+"/"+engine]
+
+		case EngineRKMPP:
+			args.Codecs[i] = defaults[name+"/"+engine]
+
+			for j, filter := range args.Filters {
+				if strings.HasPrefix(filter, "scale=") {
+					args.Filters = append(args.Filters[:j], args.Filters[j+1:]...)
+
+					width, height, _ := strings.Cut(filter[6:], ":")
+					if width != "-1" {
+						args.Codecs[i] += " -width " + width
+					}
+					if height != "-1" {
+						args.Codecs[i] += " -height " + height
+					}
+					break
+				}
+			}
 		}
 	}
 }
@@ -157,20 +178,23 @@ func cut(s string, sep byte, pos int) string {
 	return s
 }

-// fixYCbCrRange convert jpeg/pc range to mpeg/tv range
-// vaapi(pc, bt709, progressive) == yuvj420p (jpeg/full/pc)
-// vaapi(tv, bt709, progressive) == yuv420p (mpeg/limited/tv)
-// https://ffmpeg.org/ffmpeg-all.html#scale-1
-func fixYCbCrRange(args *ffmpeg.Args) {
+// fixPixelFormat:
+//   - good h264 pixel: yuv420p(tv, bt709) == yuv420p (mpeg/limited/tv)
+//   - bad h264 pixel: yuvj420p(pc, bt709) == yuvj420p (jpeg/full/pc)
+//   - bad jpeg pixel: yuvj422p(pc, bt470bg)
+func fixPixelFormat(args *ffmpeg.Args) {
+	// in my tests this filters has same CPU/GPU load:
+	//   - "hwupload"
+	//   - "hwupload,scale_vaapi=out_color_matrix=bt709:out_range=tv"
+	//   - "hwupload,scale_vaapi=out_color_matrix=bt709:out_range=tv:format=nv12"
+	const fixPixFmt = "out_color_matrix=bt709:out_range=tv:format=nv12"
+
 	for i, filter := range args.Filters {
 		if strings.HasPrefix(filter, "scale=") {
-			if !strings.Contains(filter, "out_range=") {
-				args.Filters[i] = filter + ":out_range=tv"
-			}
+			args.Filters[i] = filter + ":" + fixPixFmt
 			return
 		}
 	}

-	// scale=out_color_matrix=bt709:out_range=tv
-	args.Filters = append(args.Filters, "scale=out_range=tv")
+	args.Filters = append(args.Filters, "scale="+fixPixFmt)
 }
--- a/internal/ffmpeg/hardware/hardware_freebsd.go
+++ b/internal/ffmpeg/hardware/hardware_freebsd.go
@@ -0,0 +1,60 @@
+package hardware
+
+import (
+	"runtime"
+
+	"github.com/AlexxIT/go2rtc/internal/api"
+)
+
+const (
+	ProbeV4L2M2MH264 = "-f lavfi -i testsrc2 -t 1 -c h264_v4l2m2m -f null -"
+	ProbeV4L2M2MH265 = "-f lavfi -i testsrc2 -t 1 -c hevc_v4l2m2m -f null -"
+	ProbeRKMPPH264   = "-f lavfi -i testsrc2 -t 1 -c h264_rkmpp_encoder -f null -"
+	ProbeRKMPPH265   = "-f lavfi -i testsrc2 -t 1 -c hevc_rkmpp_encoder -f null -"
+)
+
+func ProbeAll(bin string) []*api.Source {
+	return []*api.Source{
+		{
+			Name: runToString(bin, ProbeV4L2M2MH264),
+			URL:  "ffmpeg:...#video=h264#hardware=" + EngineV4L2M2M,
+		},
+		{
+			Name: runToString(bin, ProbeV4L2M2MH265),
+			URL:  "ffmpeg:...#video=h265#hardware=" + EngineV4L2M2M,
+		},
+		{
+			Name: runToString(bin, ProbeRKMPPH264),
+			URL:  "ffmpeg:...#video=h264#hardware=" + EngineRKMPP,
+		},
+		{
+			Name: runToString(bin, ProbeRKMPPH265),
+			URL:  "ffmpeg:...#video=h265#hardware=" + EngineRKMPP,
+		},
+	}
+}
+
+func ProbeHardware(bin, name string) string {
+	if runtime.GOARCH == "arm64" || runtime.GOARCH == "arm" {
+		switch name {
+		case "h264":
+			if run(bin, ProbeV4L2M2MH264) {
+				return EngineV4L2M2M
+			}
+			if run(bin, ProbeRKMPPH264) {
+				return EngineRKMPP
+			}
+		case "h265":
+			if run(bin, ProbeV4L2M2MH265) {
+				return EngineV4L2M2M
+			}
+			if run(bin, ProbeRKMPPH265) {
+				return EngineRKMPP
+			}
+		}
+
+		return EngineSoftware
+	}
+
+	return EngineSoftware
+}
--- a/internal/ffmpeg/hardware/hardware_linux.go
+++ b/internal/ffmpeg/hardware/hardware_linux.go
@@ -6,13 +6,17 @@ import (
 	"github.com/AlexxIT/go2rtc/internal/api"
 )

-const ProbeV4L2M2MH264 = "-f lavfi -i testsrc2 -t 1 -c h264_v4l2m2m -f null -"
-const ProbeV4L2M2MH265 = "-f lavfi -i testsrc2 -t 1 -c hevc_v4l2m2m -f null -"
-const ProbeVAAPIH264 = "-init_hw_device vaapi -f lavfi -i testsrc2 -t 1 -vf format=nv12,hwupload -c h264_vaapi -f null -"
-const ProbeVAAPIH265 = "-init_hw_device vaapi -f lavfi -i testsrc2 -t 1 -vf format=nv12,hwupload -c hevc_vaapi -f null -"
-const ProbeVAAPIJPEG = "-init_hw_device vaapi -f lavfi -i testsrc2 -t 1 -vf format=nv12,hwupload -c mjpeg_vaapi -f null -"
-const ProbeCUDAH264 = "-init_hw_device cuda -f lavfi -i testsrc2 -t 1 -c h264_nvenc -f null -"
-const ProbeCUDAH265 = "-init_hw_device cuda -f lavfi -i testsrc2 -t 1 -c hevc_nvenc -f null -"
+const (
+	ProbeV4L2M2MH264 = "-f lavfi -i testsrc2 -t 1 -c h264_v4l2m2m -f null -"
+	ProbeV4L2M2MH265 = "-f lavfi -i testsrc2 -t 1 -c hevc_v4l2m2m -f null -"
+	ProbeRKMPPH264   = "-f lavfi -i testsrc2 -t 1 -c h264_rkmpp_encoder -f null -"
+	ProbeRKMPPH265   = "-f lavfi -i testsrc2 -t 1 -c hevc_rkmpp_encoder -f null -"
+	ProbeVAAPIH264   = "-init_hw_device vaapi -f lavfi -i testsrc2 -t 1 -vf format=nv12,hwupload -c h264_vaapi -f null -"
+	ProbeVAAPIH265   = "-init_hw_device vaapi -f lavfi -i testsrc2 -t 1 -vf format=nv12,hwupload -c hevc_vaapi -f null -"
+	ProbeVAAPIJPEG   = "-init_hw_device vaapi -f lavfi -i testsrc2 -t 1 -vf format=nv12,hwupload -c mjpeg_vaapi -f null -"
+	ProbeCUDAH264    = "-init_hw_device cuda -f lavfi -i testsrc2 -t 1 -c h264_nvenc -f null -"
+	ProbeCUDAH265    = "-init_hw_device cuda -f lavfi -i testsrc2 -t 1 -c hevc_nvenc -f null -"
+)

 func ProbeAll(bin string) []*api.Source {
 	if runtime.GOARCH == "arm64" || runtime.GOARCH == "arm" {
@@ -25,6 +29,14 @@ func ProbeAll(bin string) []*api.Source {
 				Name: runToString(bin, ProbeV4L2M2MH265),
 				URL:  "ffmpeg:...#video=h265#hardware=" + EngineV4L2M2M,
 			},
+			{
+				Name: runToString(bin, ProbeRKMPPH264),
+				URL:  "ffmpeg:...#video=h264#hardware=" + EngineRKMPP,
+			},
+			{
+				Name: runToString(bin, ProbeRKMPPH265),
+				URL:  "ffmpeg:...#video=h265#hardware=" + EngineRKMPP,
+			},
 		}
 	}

@@ -59,10 +71,16 @@ func ProbeHardware(bin, name string) string {
 			if run(bin, ProbeV4L2M2MH264) {
 				return EngineV4L2M2M
 			}
+			if run(bin, ProbeRKMPPH264) {
+				return EngineRKMPP
+			}
 		case "h265":
 			if run(bin, ProbeV4L2M2MH265) {
 				return EngineV4L2M2M
 			}
+			if run(bin, ProbeRKMPPH265) {
+				return EngineRKMPP
+			}
 		}

 		return EngineSoftware
--- a/internal/ffmpeg/jpeg_test.go
+++ b/internal/ffmpeg/jpeg_test.go
@@ -19,5 +19,5 @@ func TestParseQuery(t *testing.T) {
 	query, err = url.ParseQuery("hw=vaapi")
 	require.Nil(t, err)
 	args = parseQuery(query)
-	require.Equal(t, `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -i - -c:v mjpeg_vaapi -vf "format=vaapi|nv12,hwupload" -f mjpeg -`, args.String())
+	require.Equal(t, `ffmpeg -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_flags allow_profile_mismatch -i - -c:v mjpeg_vaapi -vf "format=vaapi|nv12,hwupload" -f mjpeg -`, args.String())
 }
--- a/internal/gopro/README.md
+++ b/internal/gopro/README.md
@@ -0,0 +1,25 @@
+# GoPro
+
+Supported models: HERO9, HERO10, HERO11, HERO12.  
+Supported OS: Linux, Mac, Windows, [HassOS](https://www.home-assistant.io/installation/)
+
+The other camera models have different APIs. I will try to add them in the next versions.
+
+## Config
+
+- USB-connected cameras create a new network interface in the system
+- Linux users do not need to install anything
+- Windows users should install the [network driver](https://community.gopro.com/s/article/GoPro-Webcam)
+- if the camera is detected but the stream does not start - you need to disable firewall
+
+1. Discover camera address: WebUI > Add > GoPro
+2. Add camera to config
+
+```yaml
+streams:
+  hero12: gopro://172.20.100.51
+```
+
+## Useful links
+
+- https://gopro.github.io/OpenGoPro/
--- a/internal/gopro/gopro.go
+++ b/internal/gopro/gopro.go
@@ -0,0 +1,30 @@
+package gopro
+
+import (
+	"net/http"
+
+	"github.com/AlexxIT/go2rtc/internal/api"
+	"github.com/AlexxIT/go2rtc/internal/streams"
+	"github.com/AlexxIT/go2rtc/pkg/core"
+	"github.com/AlexxIT/go2rtc/pkg/gopro"
+)
+
+func Init() {
+	streams.HandleFunc("gopro", handleGoPro)
+
+	api.HandleFunc("api/gopro", apiGoPro)
+}
+
+func handleGoPro(rawURL string) (core.Producer, error) {
+	return gopro.Dial(rawURL)
+}
+
+func apiGoPro(w http.ResponseWriter, r *http.Request) {
+	var items []*api.Source
+
+	for _, host := range gopro.Discovery() {
+		items = append(items, &api.Source{Name: host, URL: "gopro://" + host})
+	}
+
+	api.ResponseSources(w, items)
+}
--- a/internal/homekit/homekit.go
+++ b/internal/homekit/homekit.go
@@ -1,6 +1,7 @@
 package homekit

 import (
+	"errors"
 	"io"
 	"net"
 	"net/http"
@@ -97,7 +98,7 @@ func Init() {

 		srv.mdns = &mdns.ServiceEntry{
 			Name: name,
-			Port: uint16(api.Port()),
+			Port: uint16(api.Port),
 			Info: map[string]string{
 				hap.TXTConfigNumber: "1",
 				hap.TXTFeatureFlags: "0",
@@ -121,7 +122,7 @@ func Init() {
 	api.HandleFunc(hap.PathPairSetup, hapPairSetup)
 	api.HandleFunc(hap.PathPairVerify, hapPairVerify)

-	log.Trace().Msgf("[homekit] mnds: %s", entries)
+	log.Trace().Msgf("[homekit] mdns: %s", entries)

 	go func() {
 		if err := mdns.Serve(mdns.ServiceHAP, entries); err != nil {
@@ -134,6 +135,10 @@ var log zerolog.Logger
 var servers map[string]*server

 func streamHandler(url string) (core.Producer, error) {
+	if srtp.Server == nil {
+		return nil, errors.New("homekit: can't work without SRTP server")
+	}
+
 	return homekit.Dial(url, srtp.Server)
 }

--- a/internal/http/http.go
+++ b/internal/http/http.go
@@ -7,6 +7,7 @@ import (
 	"net/url"
 	"strings"

+	"github.com/AlexxIT/go2rtc/internal/api"
 	"github.com/AlexxIT/go2rtc/internal/streams"
 	"github.com/AlexxIT/go2rtc/pkg/core"
 	"github.com/AlexxIT/go2rtc/pkg/hls"
@@ -22,6 +23,8 @@ func Init() {
 	streams.HandleFunc("httpx", handleHTTP)

 	streams.HandleFunc("tcp", handleTCP)
+
+	api.HandleFunc("api/stream", apiStream)
 }

 func handleHTTP(rawURL string) (core.Producer, error) {
@@ -89,3 +92,26 @@ func handleTCP(rawURL string) (core.Producer, error) {

 	return magic.Open(conn)
 }
+
+func apiStream(w http.ResponseWriter, r *http.Request) {
+	dst := r.URL.Query().Get("dst")
+	stream := streams.Get(dst)
+	if stream == nil {
+		http.Error(w, api.StreamNotFound, http.StatusNotFound)
+		return
+	}
+
+	client, err := magic.Open(r.Body)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	stream.AddProducer(client)
+	defer stream.RemoveProducer(client)
+
+	if err = client.Start(); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+}
--- a/internal/mp4/mp4.go
+++ b/internal/mp4/mp4.go
@@ -91,8 +91,7 @@ func handlerMP4(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	src := query.Get("src")
-	stream := streams.Get(src)
+	stream := streams.GetOrPatch(query)
 	if stream == nil {
 		http.Error(w, api.StreamNotFound, http.StatusNotFound)
 		return
--- a/internal/mpegts/mpegts.go
+++ b/internal/mpegts/mpegts.go
@@ -56,19 +56,17 @@ func inputMpegTS(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	res := &http.Response{Body: r.Body, Request: r}
-	client, err := mpegts.Open(res.Body)
+	client, err := mpegts.Open(r.Body)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}

 	stream.AddProducer(client)
+	defer stream.RemoveProducer(client)

 	if err = client.Start(); err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
-
-	stream.RemoveProducer(client)
 }
--- a/internal/ngrok/ngrok.go
+++ b/internal/ngrok/ngrok.go
@@ -2,12 +2,13 @@ package ngrok

 import (
 	"fmt"
+	"net"
+	"strings"
+
 	"github.com/AlexxIT/go2rtc/internal/app"
 	"github.com/AlexxIT/go2rtc/internal/webrtc"
 	"github.com/AlexxIT/go2rtc/pkg/ngrok"
 	"github.com/rs/zerolog"
-	"net"
-	"strings"
 )

 func Init() {
@@ -39,7 +40,7 @@ func Init() {
 			}

 			// Addr: "//localhost:8555", URL: "tcp://1.tcp.eu.ngrok.io:12345"
-			if msg.Addr == "//localhost:"+webrtc.Port && strings.HasPrefix(msg.URL, "tcp://") {
+			if strings.HasPrefix(msg.Addr, "//localhost:") && strings.HasPrefix(msg.URL, "tcp://") {
 				// don't know if really necessary use IP
 				address, err := ConvertHostToIP(msg.URL[6:])
 				if err != nil {
@@ -49,7 +50,7 @@ func Init() {

 				log.Info().Str("addr", address).Msg("[ngrok] add external candidate for WebRTC")

-				webrtc.AddCandidate(address)
+				webrtc.AddCandidate(address, "tcp")
 			}
 		}
 	})
--- a/internal/rtsp/rtsp.go
+++ b/internal/rtsp/rtsp.go
@@ -26,7 +26,7 @@ func Init() {
 	}

 	// default config
-	conf.Mod.Listen = "0.0.0.0:8554"
+	conf.Mod.Listen = ":8554"
 	conf.Mod.DefaultQuery = "video&audio"

 	app.LoadConfig(&conf)
--- a/internal/srtp/srtp.go
+++ b/internal/srtp/srtp.go
@@ -13,7 +13,7 @@ func Init() {
 	}

 	// default config
-	cfg.Mod.Listen = "0.0.0.0:8443"
+	cfg.Mod.Listen = ":8443"

 	// load config from YAML
 	app.LoadConfig(&cfg)
--- a/internal/streams/helpers.go
+++ b/internal/streams/helpers.go
@@ -6,6 +6,9 @@ import (
 )

 func ParseQuery(s string) url.Values {
+	if len(s) == 0 {
+		return nil
+	}
 	params := url.Values{}
 	for _, key := range strings.Split(s, "#") {
 		var value string
--- a/internal/streams/stream.go
+++ b/internal/streams/stream.go
@@ -22,8 +22,13 @@ func NewStream(source any) *Stream {
 		}
 	case []any:
 		s := new(Stream)
-		for _, source := range source {
-			s.producers = append(s.producers, NewProducer(source.(string)))
+		for _, src := range source {
+			str, ok := src.(string)
+			if !ok {
+				log.Error().Msgf("[stream] NewStream: Expected string, got %v", src)
+				continue
+			}
+			s.producers = append(s.producers, NewProducer(str))
 		}
 		return s
 	case map[string]any:
--- a/internal/streams/stream_test.go
+++ b/internal/streams/stream_test.go
@@ -10,7 +10,7 @@ import (

 func TestRecursion(t *testing.T) {
 	// create stream with some source
-	stream1 := New("from_yaml", "does not matter")
+	stream1 := New("from_yaml", "does_not_matter")
 	require.Len(t, streams, 1)

 	// ask another unnamed stream that links go2rtc
--- a/internal/webrtc/README.md
+++ b/internal/webrtc/README.md
@@ -1,3 +1,14 @@
+## Config
+
+- supported TCP: fixed port (default), disabled 
+- supported UDP: random port (default), fixed port
+
+| Config examples       | TCP   | UDP    |
+|-----------------------|-------|--------|
+| `listen: ":8555/tcp"` | fixed | random |
+| `listen: ":8555"`     | fixed | fixed  |
+| `listen: ""`          | no    | random |
+
 ## Userful links

 - https://www.ietf.org/archive/id/draft-ietf-wish-whip-01.html
--- a/internal/webrtc/candidates.go
+++ b/internal/webrtc/candidates.go
@@ -1,58 +1,66 @@
 package webrtc

 import (
+	"net"
+
 	"github.com/AlexxIT/go2rtc/internal/api/ws"
 	"github.com/AlexxIT/go2rtc/pkg/webrtc"
 	"github.com/pion/sdp/v3"
-	"strconv"
-	"strings"
 )

 type Address struct {
-	Host string
-	Port int
+	Host    string
+	Port    string
+	Network string
+	Offset  int
 }

-var addresses []Address
-
-func AddCandidate(address string) {
-	var port int
-
-	// try to get port from address string
-	if i := strings.LastIndexByte(address, ':'); i > 0 {
-		if v, _ := strconv.Atoi(address[i+1:]); v != 0 {
-			address = address[:i]
-			port = v
+func (a *Address) Marshal() string {
+	host := a.Host
+	if host == "stun" {
+		ip, err := webrtc.GetCachedPublicIP()
+		if err != nil {
+			return ""
 		}
+		host = ip.String()
 	}

-	// use default WebRTC port
-	if port == 0 {
-		port, _ = strconv.Atoi(Port)
+	switch a.Network {
+	case "udp":
+		return webrtc.CandidateManualHostUDP(host, a.Port, a.Offset)
+	case "tcp":
+		return webrtc.CandidateManualHostTCPPassive(host, a.Port, a.Offset)
 	}

-	addresses = append(addresses, Address{Host: address, Port: port})
+	return ""
+}
+
+var addresses []*Address
+
+func AddCandidate(address, network string) {
+	host, port, err := net.SplitHostPort(address)
+	if err != nil {
+		return
+	}
+
+	offset := -1 - len(addresses) // every next candidate will have a lower priority
+
+	switch network {
+	case "tcp", "udp":
+		addresses = append(addresses, &Address{host, port, network, offset})
+	default:
+		addresses = append(
+			addresses, &Address{host, port, "udp", offset}, &Address{host, port, "tcp", offset},
+		)
+	}
 }

 func GetCandidates() (candidates []string) {
 	for _, address := range addresses {
-		// using stun server for receive public IP-address
-		if address.Host == "stun" {
-			ip, err := webrtc.GetCachedPublicIP()
-			if err != nil {
-				continue
-			}
-			// this is a copy, original host unchanged
-			address.Host = ip.String()
+		if candidate := address.Marshal(); candidate != "" {
+			candidates = append(candidates, candidate)
 		}
-
-		candidates = append(
-			candidates,
-			webrtc.CandidateManualHostUDP(address.Host, address.Port),
-			webrtc.CandidateManualHostTCPPassive(address.Host, address.Port),
-		)
 	}
-
 	return
 }

--- a/internal/webrtc/client.go
+++ b/internal/webrtc/client.go
@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"net/url"
 	"strings"
+	"sync"
 	"time"

 	"github.com/AlexxIT/go2rtc/internal/api/ws"
@@ -48,7 +49,9 @@ func streamsHandler(rawURL string) (core.Producer, error) {
 			}

 		case "http", "https":
-			if format == "wyze" {
+			if format == "milestone" {
+				return milestoneClient(rawURL, query)
+			} else if format == "wyze" {
 				// https://github.com/mrlt8/docker-wyze-bridge
 				return wyzeClient(rawURL)
 			} else {
@@ -80,6 +83,7 @@ func go2rtcClient(url string) (core.Producer, error) {

 	// waiter will wait PC error or WS error or nil (connection OK)
 	var connState core.Waiter
+	var connMu sync.Mutex

 	prod := webrtc.NewConn(pc)
 	prod.Desc = "WebRTC/WebSocket async"
@@ -88,8 +92,10 @@ func go2rtcClient(url string) (core.Producer, error) {
 		switch msg := msg.(type) {
 		case *pion.ICECandidate:
 			s := msg.ToJSON().Candidate
-			log.Trace().Str("candidate", s).Msg("[webrtc] local")
+			log.Trace().Str("candidate", s).Msg("[webrtc] local ")
+			connMu.Lock()
 			_ = conn.WriteJSON(&ws.Message{Type: "webrtc/candidate", Value: s})
+			connMu.Unlock()

 		case pion.PeerConnectionState:
 			switch msg {
@@ -116,9 +122,9 @@ func go2rtcClient(url string) (core.Producer, error) {

 	// 4. Send offer
 	msg := &ws.Message{Type: "webrtc/offer", Value: offer}
-	if err = conn.WriteJSON(msg); err != nil {
-		return nil, err
-	}
+	connMu.Lock()
+	_ = conn.WriteJSON(msg)
+	connMu.Unlock()

 	// 5. Get answer
 	if err = conn.ReadJSON(msg); err != nil {
@@ -189,10 +195,10 @@ func whepClient(url string) (core.Producer, error) {
 	}

 	req, err := http.NewRequest("POST", url, strings.NewReader(offer))
-	req.Header.Set("Content-Type", MimeSDP)
 	if err != nil {
 		return nil, err
 	}
+	req.Header.Set("Content-Type", MimeSDP)

 	client := http.Client{Timeout: time.Second * 5000}
 	defer client.CloseIdleConnections()
--- a/internal/webrtc/kinesis.go
+++ b/internal/webrtc/kinesis.go
@@ -55,7 +55,7 @@ func kinesisClient(rawURL string, query url.Values, desc string) (core.Producer,
 	defer conn.Close()

 	// 3. Create Peer Connection
-	api, err := webrtc.NewAPI("")
+	api, err := webrtc.NewAPI()
 	if err != nil {
 		return nil, err
 	}
--- a/internal/webrtc/milestone.go
+++ b/internal/webrtc/milestone.go
@@ -0,0 +1,218 @@
+package webrtc
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"github.com/AlexxIT/go2rtc/pkg/core"
+	"github.com/AlexxIT/go2rtc/pkg/tcp"
+	"github.com/AlexxIT/go2rtc/pkg/webrtc"
+	pion "github.com/pion/webrtc/v3"
+)
+
+// This package handles the Milestone WebRTC session lifecycle, including authentication,
+// session creation, and session update with an SDP answer. It is designed to be used with
+// a specific URL format that encodes session parameters. For example:
+// webrtc:https://milestone-host/api#format=milestone#username=User#password=TestPassword#cameraId=a539f254-af05-4d67-a1bb-cd9b3c74d122
+//
+// https://github.com/milestonesys/mipsdk-samples-protocol/tree/main/WebRTC_JavaScript
+
+type milestoneAPI struct {
+	url       string
+	query     url.Values
+	token     string
+	sessionID string
+}
+
+func (m *milestoneAPI) GetToken() error {
+	data := url.Values{
+		"client_id":  {"GrantValidatorClient"},
+		"grant_type": {"password"},
+		"username":   m.query["username"],
+		"password":   m.query["password"],
+	}
+
+	req, err := http.NewRequest("POST", m.url+"/IDP/connect/token", strings.NewReader(data.Encode()))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	// support httpx protocol
+	res, err := tcp.Do(req)
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode != http.StatusOK {
+		return errors.New("milesone: authentication failed: " + res.Status)
+	}
+
+	var payload map[string]interface{}
+	if err = json.NewDecoder(res.Body).Decode(&payload); err != nil {
+		return err
+	}
+
+	token, ok := payload["access_token"].(string)
+	if !ok {
+		return errors.New("milesone: token not found in the response")
+	}
+
+	m.token = token
+
+	return nil
+}
+
+func parseFloat(s string) float64 {
+	if s == "" {
+		return 0
+	}
+	f, _ := strconv.ParseFloat(s, 64)
+	return f
+}
+
+func (m *milestoneAPI) GetOffer() (string, error) {
+	request := struct {
+		CameraId         string `json:"cameraId"`
+		StreamId         string `json:"streamId,omitempty"`
+		PlaybackTimeNode struct {
+			PlaybackTime string  `json:"playbackTime,omitempty"`
+			SkipGaps     bool    `json:"skipGaps,omitempty"`
+			Speed        float64 `json:"speed,omitempty"`
+		} `json:"playbackTimeNode,omitempty"`
+		//ICEServers []string `json:"iceServers,omitempty"`
+		//Resolution string   `json:"resolution,omitempty"`
+	}{
+		CameraId: m.query.Get("cameraId"),
+		StreamId: m.query.Get("streamId"),
+	}
+	request.PlaybackTimeNode.PlaybackTime = m.query.Get("playbackTime")
+	request.PlaybackTimeNode.SkipGaps = m.query.Has("skipGaps")
+	request.PlaybackTimeNode.Speed = parseFloat(m.query.Get("speed"))
+
+	data, err := json.Marshal(request)
+	if err != nil {
+		return "", err
+	}
+
+	req, err := http.NewRequest("POST", m.url+"/REST/v1/WebRTC/Session", bytes.NewBuffer(data))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Authorization", "Bearer "+m.token)
+	req.Header.Set("Content-Type", "application/json")
+
+	res, err := tcp.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode != http.StatusOK {
+		return "", errors.New("milesone: create session: " + res.Status)
+	}
+
+	var response struct {
+		SessionId string `json:"sessionId"`
+		OfferSDP  string `json:"offerSDP"`
+	}
+	if err = json.NewDecoder(res.Body).Decode(&response); err != nil {
+		return "", err
+	}
+
+	var offer pion.SessionDescription
+	if err = json.Unmarshal([]byte(response.OfferSDP), &offer); err != nil {
+		return "", err
+	}
+
+	m.sessionID = response.SessionId
+
+	return offer.SDP, nil
+}
+
+func (m *milestoneAPI) SetAnswer(sdp string) error {
+	answer := pion.SessionDescription{
+		Type: pion.SDPTypeAnswer,
+		SDP:  sdp,
+	}
+	data, err := json.Marshal(answer)
+	if err != nil {
+		return err
+	}
+
+	request := struct {
+		AnswerSDP string `json:"answerSDP"`
+	}{
+		AnswerSDP: string(data),
+	}
+	if data, err = json.Marshal(request); err != nil {
+		return err
+	}
+
+	req, err := http.NewRequest("PATCH", m.url+"/REST/v1/WebRTC/Session/"+m.sessionID, bytes.NewBuffer(data))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", "Bearer "+m.token)
+	req.Header.Set("Content-Type", "application/json")
+
+	res, err := tcp.Do(req)
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode != http.StatusOK {
+		return errors.New("milesone: patch session: " + res.Status)
+	}
+
+	return nil
+}
+
+func milestoneClient(rawURL string, query url.Values) (core.Producer, error) {
+	mc := &milestoneAPI{url: rawURL, query: query}
+	if err := mc.GetToken(); err != nil {
+		return nil, err
+	}
+
+	api, err := webrtc.NewAPI()
+	if err != nil {
+		return nil, err
+	}
+
+	conf := pion.Configuration{}
+	pc, err := api.NewPeerConnection(conf)
+	if err != nil {
+		return nil, err
+	}
+
+	prod := webrtc.NewConn(pc)
+	prod.Desc = "WebRTC/Milestone"
+	prod.Mode = core.ModeActiveProducer
+
+	offer, err := mc.GetOffer()
+	if err != nil {
+		return nil, err
+	}
+
+	if err = prod.SetOffer(offer); err != nil {
+		return nil, err
+	}
+
+	answer, err := prod.GetAnswer()
+	if err != nil {
+		return nil, err
+	}
+
+	if err = mc.SetAnswer(answer); err != nil {
+		return nil, err
+	}
+
+	return prod, nil
+}
--- a/internal/webrtc/openipc.go
+++ b/internal/webrtc/openipc.go
@@ -33,7 +33,7 @@ func openIPCClient(rawURL string, query url.Values) (core.Producer, error) {
 	defer conn.Close()

 	// 3. Create Peer Connection
-	api, err := webrtc.NewAPI("")
+	api, err := webrtc.NewAPI()
 	if err != nil {
 		return nil, err
 	}
--- a/internal/webrtc/server.go
+++ b/internal/webrtc/server.go
@@ -49,6 +49,9 @@ func syncHandler(w http.ResponseWriter, r *http.Request) {
 			http.Error(w, "", http.StatusBadRequest)
 		}

+	case "OPTIONS":
+		w.WriteHeader(http.StatusNoContent)
+
 	default:
 		http.Error(w, "", http.StatusMethodNotAllowed)
 	}
@@ -195,9 +198,7 @@ func inputWebRTC(w http.ResponseWriter, r *http.Request) {
 		case pion.PeerConnectionState:
 			if msg == pion.PeerConnectionStateClosed {
 				stream.RemoveProducer(prod)
-				if _, ok := sessions[id]; ok {
-					delete(sessions, id)
-				}
+				delete(sessions, id)
 			}
 		}
 	})
--- a/internal/webrtc/webrtc.go
+++ b/internal/webrtc/webrtc.go
@@ -2,7 +2,7 @@ package webrtc

 import (
 	"errors"
-	"net"
+	"strings"

 	"github.com/AlexxIT/go2rtc/internal/api"
 	"github.com/AlexxIT/go2rtc/internal/api/ws"
@@ -23,7 +23,7 @@ func Init() {
 		} `yaml:"webrtc"`
 	}

-	cfg.Mod.Listen = "0.0.0.0:8555/tcp"
+	cfg.Mod.Listen = ":8555/tcp"
 	cfg.Mod.IceServers = []pion.ICEServer{
 		{URLs: []string{"stun:stun.l.google.com:19302"}},
 	}
@@ -32,10 +32,20 @@ func Init() {

 	log = app.GetLogger("webrtc")

-	address := cfg.Mod.Listen
+	address, network, _ := strings.Cut(cfg.Mod.Listen, "/")
+
+	var candidateHost []string
+	for _, candidate := range cfg.Mod.Candidates {
+		if strings.HasPrefix(candidate, "host:") {
+			candidateHost = append(candidateHost, candidate[5:])
+			continue
+		}
+
+		AddCandidate(candidate, network)
+	}

 	// create pionAPI with custom codecs list and custom network settings
-	serverAPI, err := webrtc.NewAPI(address)
+	serverAPI, err := webrtc.NewServerAPI(address, network, candidateHost)
 	if err != nil {
 		log.Error().Err(err).Caller().Send()
 		return
@@ -46,9 +56,8 @@ func Init() {

 	if address != "" {
 		log.Info().Str("addr", address).Msg("[webrtc] listen")
-		_, Port, _ = net.SplitHostPort(address)

-		clientAPI, _ = webrtc.NewAPI("")
+		clientAPI, _ = webrtc.NewAPI()
 	}

 	pionConf := pion.Configuration{
@@ -65,10 +74,6 @@ func Init() {
 		}
 	}

-	for _, candidate := range cfg.Mod.Candidates {
-		AddCandidate(candidate)
-	}
-
 	// async WebRTC server (two API versions)
 	ws.HandleFunc("webrtc", asyncHandler)
 	ws.HandleFunc("webrtc/offer", asyncHandler)
@@ -81,7 +86,6 @@ func Init() {
 	streams.HandleFunc("webrtc", streamsHandler)
 }

-var Port string
 var log zerolog.Logger

 var PeerConnection func(active bool) (*pion.PeerConnection, error)
@@ -138,7 +142,7 @@ func asyncHandler(tr *ws.Transport, msg *ws.Message) error {
 			_ = sendAnswer.Wait()

 			s := msg.ToJSON().Candidate
-			log.Trace().Str("candidate", s).Msg("[webrtc] local")
+			log.Trace().Str("candidate", s).Msg("[webrtc] local ")
 			tr.Write(&ws.Message{Type: "webrtc/candidate", Value: s})
 		}
 	})
--- a/main.go
+++ b/main.go
@@ -9,7 +9,9 @@ import (
 	"github.com/AlexxIT/go2rtc/internal/dvrip"
 	"github.com/AlexxIT/go2rtc/internal/echo"
 	"github.com/AlexxIT/go2rtc/internal/exec"
+	"github.com/AlexxIT/go2rtc/internal/expr"
 	"github.com/AlexxIT/go2rtc/internal/ffmpeg"
+	"github.com/AlexxIT/go2rtc/internal/gopro"
 	"github.com/AlexxIT/go2rtc/internal/hass"
 	"github.com/AlexxIT/go2rtc/internal/hls"
 	"github.com/AlexxIT/go2rtc/internal/homekit"
@@ -76,10 +78,12 @@ func main() {
 	homekit.Init()  // homekit source
 	nest.Init()     // nest source
 	bubble.Init()   // bubble source
+	expr.Init()     // expr source
+	gopro.Init()    // gopro source

 	// 6. Helper modules

-	ngrok.Init() // Ngrok module
+	ngrok.Init() // ngrok module
 	srtp.Init()  // SRTP server
 	debug.Init() // debug API

--- a/pkg/aac/adts.go
+++ b/pkg/aac/adts.go
@@ -10,7 +10,7 @@ import (

 func IsADTS(b []byte) bool {
 	_ = b[1]
-	return len(b) > 7 && b[0] == 0xFF && b[1]&0xF0 == 0xF0
+	return len(b) > 7 && b[0] == 0xFF && b[1]&0xF6 == 0xF0
 }

 func ADTSToCodec(b []byte) *core.Codec {
--- a/pkg/aac/producer.go
+++ b/pkg/aac/producer.go
@@ -0,0 +1,73 @@
+package aac
+
+import (
+	"bufio"
+	"encoding/binary"
+	"io"
+
+	"github.com/AlexxIT/go2rtc/pkg/core"
+	"github.com/pion/rtp"
+)
+
+type Producer struct {
+	core.SuperProducer
+	rd *bufio.Reader
+	cl io.Closer
+}
+
+func Open(r io.Reader) (*Producer, error) {
+	rd := bufio.NewReader(r)
+
+	b, err := rd.Peek(8)
+	if err != nil {
+		return nil, err
+	}
+
+	codec := ADTSToCodec(b)
+
+	prod := &Producer{rd: rd, cl: r.(io.Closer)}
+	prod.Type = "ADTS producer"
+	prod.Medias = []*core.Media{
+		{
+			Kind:      core.KindAudio,
+			Direction: core.DirectionRecvonly,
+			Codecs:    []*core.Codec{codec},
+		},
+	}
+	return prod, nil
+}
+
+func (c *Producer) Start() error {
+	for {
+		b, err := c.rd.Peek(6)
+		if err != nil {
+			return err
+		}
+
+		auSize := ReadADTSSize(b)
+		payload := make([]byte, 2+2+auSize)
+		if _, err = io.ReadFull(c.rd, payload[4:]); err != nil {
+			return err
+		}
+
+		c.Recv += int(auSize)
+
+		if len(c.Receivers) == 0 {
+			continue
+		}
+
+		payload[1] = 16 // header size in bits
+		binary.BigEndian.PutUint16(payload[2:], auSize<<3)
+
+		pkt := &rtp.Packet{
+			Header:  rtp.Header{Timestamp: core.Now90000()},
+			Payload: payload,
+		}
+		c.Receivers[0].WriteRTP(pkt)
+	}
+}
+
+func (c *Producer) Stop() error {
+	_ = c.SuperProducer.Close()
+	return c.cl.Close()
+}
--- a/pkg/aac/rtp.go
+++ b/pkg/aac/rtp.go
@@ -28,9 +28,13 @@ func RTPDepay(handler core.HandlerFunc) core.HandlerFunc {
 		headers := packet.Payload[2 : 2+headersSize]
 		units := packet.Payload[2+headersSize:]

-		for len(headers) > 0 {
+		for len(headers) >= 2 {
 			unitSize := binary.BigEndian.Uint16(headers) >> 3

+			if len(units) < int(unitSize) {
+				return
+			}
+
 			unit := units[:unitSize]

 			headers = headers[2:]
--- a/pkg/bits/reader.go
+++ b/pkg/bits/reader.go
@@ -127,3 +127,7 @@ func (r *Reader) ReadSEGolomb() int32 {
 		return int32(b >> 1)
 	}
 }
+
+func (r *Reader) Left() []byte {
+	return r.buf[r.pos:]
+}
--- a/pkg/core/helpers.go
+++ b/pkg/core/helpers.go
@@ -38,15 +38,6 @@ func RandString(size, base byte) string {
 	return string(b)
 }

-func Any(errs ...error) error {
-	for _, err := range errs {
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
 func Between(s, sub1, sub2 string) string {
 	i := strings.Index(s, sub1)
 	if i < 0 {
--- a/pkg/core/readbuffer.go
+++ b/pkg/core/readbuffer.go
@@ -5,7 +5,9 @@ import (
 	"io"
 )

-const ProbeSize = 1024 * 1024 // 1MB
+// ProbeSize
+// in my tests MPEG-TS 40Mbit/s 4K-video require more than 1MB for probe
+const ProbeSize = 5 * 1024 * 1024 // 5MB

 const (
 	BufferDisable       = 0
--- a/pkg/core/track.go
+++ b/pkg/core/track.go
@@ -117,9 +117,9 @@ func (s *Sender) HandleRTP(track *Receiver) {

 	if GetKind(track.Codec.Name) == KindVideo {
 		if track.Codec.IsRTP() {
-			// H.264 2560x1440 4096kbs can have 700+ packets between 25 frames
-			// H.265 5120x1440 can have 700+ packets between two keyframes
-			bufferSize = 1000
+			// in my tests 40Mbit/s 4K-video can generate up to 1500 items
+			// for the h264.RTPDepay => RTPPay queue
+			bufferSize = 5000
 		} else {
 			bufferSize = 50
 		}
@@ -140,9 +140,7 @@ func (s *Sender) HandleRTP(track *Receiver) {
 	go func() {
 		// read packets from buffer channel until it will be closed
 		for packet := range buffer {
-			s.mu.Lock()
 			s.bytes += len(packet.Payload)
-			s.mu.Unlock()
 			s.Handler(packet)
 		}

--- a/pkg/expr/expr.go
+++ b/pkg/expr/expr.go
@@ -0,0 +1,115 @@
+package expr
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"regexp"
+
+	"github.com/AlexxIT/go2rtc/pkg/tcp"
+	"github.com/expr-lang/expr"
+)
+
+func newRequest(method, url string, headers map[string]any) (*http.Request, error) {
+	if method == "" {
+		method = "GET"
+	}
+
+	req, err := http.NewRequest(method, url, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	for k, v := range headers {
+		req.Header.Set(k, fmt.Sprintf("%v", v))
+	}
+
+	return req, nil
+}
+
+func regExp(params ...any) (*regexp.Regexp, error) {
+	exp := params[0].(string)
+	if len(params) >= 2 {
+		// support:
+		//   i  case-insensitive (default false)
+		//   m  multi-line mode: ^ and $ match begin/end line (default false)
+		//   s  let . match \n (default false)
+		// https://pkg.go.dev/regexp/syntax
+		flags := params[1].(string)
+		exp = "(?" + flags + ")" + exp
+	}
+	return regexp.Compile(exp)
+}
+
+var Options = []expr.Option{
+	expr.Function(
+		"fetch",
+		func(params ...any) (any, error) {
+			var req *http.Request
+			var err error
+
+			url := params[0].(string)
+
+			if len(params) == 2 {
+				options := params[1].(map[string]any)
+				method, _ := options["method"].(string)
+				headers, _ := options["headers"].(map[string]any)
+				req, err = newRequest(method, url, headers)
+			} else {
+				req, err = http.NewRequest("GET", url, nil)
+			}
+
+			if err != nil {
+				return nil, err
+			}
+
+			res, err := tcp.Do(req)
+			if err != nil {
+				return nil, err
+			}
+
+			b, _ := io.ReadAll(res.Body)
+
+			return map[string]any{
+				"ok":     res.StatusCode < 400,
+				"status": res.Status,
+				"text":   string(b),
+				"json": func() (v any) {
+					_ = json.Unmarshal(b, &v)
+					return
+				},
+			}, nil
+		},
+		//new(func(url string) map[string]any),
+		//new(func(url string, options map[string]any) map[string]any),
+	),
+	expr.Function(
+		"match",
+		func(params ...any) (any, error) {
+			re, err := regExp(params[1:]...)
+			if err != nil {
+				return nil, err
+			}
+			str := params[0].(string)
+			return re.FindStringSubmatch(str), nil
+		},
+		//new(func(str, expr string) []string),
+		//new(func(str, expr, flags string) []string),
+	),
+	expr.Function(
+		"RegExp",
+		func(params ...any) (any, error) {
+			return regExp(params)
+		},
+	),
+}
+
+func Run(input string) (any, error) {
+	program, err := expr.Compile(input, Options...)
+	if err != nil {
+		return nil, err
+	}
+
+	return expr.Run(program, nil)
+}
--- a/pkg/expr/expr_test.go
+++ b/pkg/expr/expr_test.go
@@ -0,0 +1,17 @@
+package expr
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestMatchHost(t *testing.T) {
+	v, err := Run(`
+let url = "rtsp://user:pass@192.168.1.123/cam/realmonitor?...";
+let host = match(url, "//[^/]+")[0][2:];
+host
+`)
+	require.Nil(t, err)
+	require.Equal(t, "user:pass@192.168.1.123", v)
+}
--- a/pkg/ffmpeg/ffmpeg.go
+++ b/pkg/ffmpeg/ffmpeg.go
@@ -74,7 +74,7 @@ func (a *Args) String() string {
 		b.WriteString(codec)
 	}

-	if a.Filters != nil {
+	if len(a.Filters) > 0 {
 		for i, filter := range a.Filters {
 			if i == 0 {
 				b.WriteString(` -vf "`)
--- a/pkg/flv/amf/amf_test.go
+++ b/pkg/flv/amf/amf_test.go
@@ -141,7 +141,7 @@ func TestNewReader(t *testing.T) {
 			name:   "obs-connect",
 			actual: "020007636f6e6e656374003ff000000000000003000361707002000c617070312f73747265616d3100047479706502000a6e6f6e70726976617465000e737570706f727473476f4177617901010008666c61736856657202001f464d4c452f332e302028636f6d70617469626c653b20464d53632f312e3029000673776655726c02002272746d703a2f2f3139322e3136382e31302e3130312f617070312f73747265616d310005746355726c02002272746d703a2f2f3139322e3136382e31302e3130312f617070312f73747265616d31000009",
 			expect: []any{
-				"connect", 1,
+				"connect", float64(1),
 				map[string]any{
 					"app":            "app1/stream1",
 					"flashVer":       "FMLE/3.0 (compatible; FMSc/1.0)",
--- a/pkg/flv/producer.go
+++ b/pkg/flv/producer.go
@@ -10,6 +10,7 @@ import (
 	"github.com/AlexxIT/go2rtc/pkg/aac"
 	"github.com/AlexxIT/go2rtc/pkg/core"
 	"github.com/AlexxIT/go2rtc/pkg/h264"
+	"github.com/AlexxIT/go2rtc/pkg/h265"
 	"github.com/pion/rtp"
 )

@@ -40,6 +41,21 @@ const (
 	CodecAVC = 7
 )

+const (
+	PacketTypeAVCHeader = iota
+	PacketTypeAVCNALU
+	PacketTypeAVCEnd
+)
+
+const (
+	PacketTypeSequenceStart = iota
+	PacketTypeCodedFrames
+	PacketTypeSequenceEnd
+	PacketTypeCodedFramesX
+	PacketTypeMetadata
+	PacketTypeMPEG2TSSequenceStart
+)
+
 func (c *Producer) GetTrack(media *core.Media, codec *core.Codec) (*core.Receiver, error) {
 	receiver, _ := c.SuperProducer.GetTrack(media, codec)
 	if media.Kind == core.KindVideo {
@@ -70,13 +86,32 @@ func (c *Producer) Start() error {
 			c.audio.WriteRTP(pkt)

 		case TagVideo:
-			// frame type 4b, codecID 4b, avc packet type 8b, composition time 24b
-			if c.video == nil || pkt.Payload[1] == 0 {
+			if c.video == nil {
 				continue
 			}

+			if isExHeader(pkt.Payload) {
+				switch packetType := pkt.Payload[0] & 0b1111; packetType {
+				case PacketTypeCodedFrames:
+					// frame type 4b, packet type 4b, fourCC 32b, composition time 24b
+					pkt.Payload = pkt.Payload[8:]
+				case PacketTypeCodedFramesX:
+					// frame type 4b, packet type 4b, fourCC 32b
+					pkt.Payload = pkt.Payload[5:]
+				default:
+					continue
+				}
+			} else {
+				switch pkt.Payload[1] {
+				case PacketTypeAVCNALU:
+					// frame type 4b, codecID 4b, avc packet type 8b, composition time 24b
+					pkt.Payload = pkt.Payload[5:]
+				default:
+					continue
+				}
+			}
+
 			pkt.Timestamp = TimeToRTP(pkt.Timestamp, c.video.Codec.ClockRate)
-			pkt.Payload = pkt.Payload[5:]
 			c.video.WriteRTP(pkt)
 		}
 	}
@@ -145,20 +180,32 @@ func (c *Producer) probe() error {
 			c.Medias = append(c.Medias, media)

 		case TagVideo:
-			_ = pkt.Payload[1] // bounds
+			var codec *core.Codec

-			_ = pkt.Payload[0] >> 4            // FrameType
-			codecID := pkt.Payload[0] & 0b1111 // CodecID
+			if isExHeader(pkt.Payload) {
+				if string(pkt.Payload[1:5]) != "hvc1" {
+					continue
+				}

-			if codecID != CodecAVC {
-				continue
+				if packetType := pkt.Payload[0] & 0b1111; packetType != PacketTypeSequenceStart {
+					continue
+				}
+
+				codec = h265.ConfigToCodec(pkt.Payload[5:])
+			} else {
+				_ = pkt.Payload[0] >> 4 // FrameType
+
+				if codecID := pkt.Payload[0] & 0b1111; codecID != CodecAVC {
+					continue
+				}
+
+				if packetType := pkt.Payload[1]; packetType != PacketTypeAVCHeader { // check if header
+					continue
+				}
+
+				codec = h264.ConfigToCodec(pkt.Payload[5:])
 			}

-			if pkt.Payload[1] != 0 { // check if header
-				continue
-			}
-
-			codec := h264.ConfigToCodec(pkt.Payload[5:])
 			media := &core.Media{
 				Kind:      core.KindVideo,
 				Direction: core.DirectionRecvonly,
@@ -229,9 +276,15 @@ func (c *Producer) readPacket() (*rtp.Packet, error) {
 		return nil, err
 	}

+	//log.Printf("[FLV] %d %.40x", pkt.PayloadType, pkt.Payload)
+
 	return pkt, nil
 }

 func TimeToRTP(timeMS uint32, clockRate uint32) uint32 {
 	return timeMS * clockRate / 1000
 }
+
+func isExHeader(data []byte) bool {
+	return data[0]&0b1000_0000 != 0
+}
--- a/pkg/gopro/discovery.go
+++ b/pkg/gopro/discovery.go
@@ -0,0 +1,43 @@
+package gopro
+
+import (
+	"net"
+	"net/http"
+	"regexp"
+)
+
+func Discovery() (urls []string) {
+	ints, err := net.Interfaces()
+	if err != nil {
+		return nil
+	}
+
+	// The socket address for USB connections is 172.2X.1YZ.51:8080
+	// https://gopro.github.io/OpenGoPro/http_2_0#socket-address
+	re := regexp.MustCompile(`^172\.2\d\.1\d\d\.`)
+
+	for _, itf := range ints {
+		addrs, err := itf.Addrs()
+		if err != nil {
+			continue
+		}
+
+		for _, addr := range addrs {
+			host := addr.String()
+			if !re.MatchString(host) {
+				continue
+			}
+
+			host = host[:11] + "51" // 172.2x.1xx.xxx
+			res, err := http.Get("http://" + host + ":8080/gopro/webcam/status")
+			if err != nil {
+				continue
+			}
+			_ = res.Body.Close()
+
+			urls = append(urls, host)
+		}
+	}
+
+	return
+}
--- a/pkg/gopro/gopro.go
+++ b/pkg/gopro/gopro.go
@@ -0,0 +1,117 @@
+package gopro
+
+import (
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/AlexxIT/go2rtc/pkg/core"
+	"github.com/AlexxIT/go2rtc/pkg/mpegts"
+)
+
+func Dial(rawURL string) (core.Producer, error) {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return nil, err
+	}
+
+	r := &listener{host: u.Host}
+
+	if err = r.command("/gopro/webcam/stop"); err != nil {
+		return nil, err
+	}
+
+	if err = r.listen(); err != nil {
+		return nil, err
+	}
+
+	if err = r.command("/gopro/webcam/start"); err != nil {
+		return nil, err
+	}
+
+	return mpegts.Open(r)
+}
+
+type listener struct {
+	conn    net.PacketConn
+	host    string
+	packet  []byte
+	packets chan []byte
+}
+
+func (r *listener) Read(p []byte) (n int, err error) {
+	if r.packet == nil {
+		var ok bool
+		if r.packet, ok = <-r.packets; !ok {
+			return 0, io.EOF // channel closed
+		}
+	}
+
+	n = copy(p, r.packet)
+
+	if n < len(r.packet) {
+		r.packet = r.packet[n:]
+	} else {
+		r.packet = nil
+	}
+
+	return
+}
+
+func (r *listener) Close() error {
+	return r.conn.Close()
+}
+
+func (r *listener) command(api string) error {
+	client := &http.Client{Timeout: 5 * time.Second}
+
+	res, err := client.Get("http://" + r.host + ":8080" + api)
+	if err != nil {
+		return err
+	}
+
+	_ = res.Body.Close()
+
+	if res.StatusCode != http.StatusOK {
+		return errors.New("gopro: wrong response: " + res.Status)
+	}
+
+	return nil
+}
+
+func (r *listener) listen() (err error) {
+	if r.conn, err = net.ListenPacket("udp4", ":8554"); err != nil {
+		return
+	}
+
+	r.packets = make(chan []byte, 1024)
+	go r.worker()
+
+	return
+}
+
+func (r *listener) worker() {
+	b := make([]byte, 1500)
+	for {
+		if err := r.conn.SetReadDeadline(time.Now().Add(3 * time.Second)); err != nil {
+			break
+		}
+
+		n, _, err := r.conn.ReadFrom(b)
+		if err != nil {
+			break
+		}
+
+		packet := make([]byte, n)
+		copy(packet, b)
+
+		r.packets <- packet
+	}
+
+	close(r.packets)
+
+	_ = r.command("/gopro/webcam/stop")
+}
--- a/pkg/h264/rtp.go
+++ b/pkg/h264/rtp.go
@@ -29,6 +29,12 @@ func RTPDepay(codec *core.Codec, handler core.HandlerFunc) core.HandlerFunc {
 			return
 		}

+		// Memory overflow protection. Can happen if we miss a lot of packets with the marker.
+		// https://github.com/AlexxIT/go2rtc/issues/675
+		if len(buf) > 5*1024*1024 {
+			buf = buf[: 0 : 512*1024]
+		}
+
 		// Fix TP-Link Tapo TC70: sends SPS and PPS with packet.Marker = true
 		// Reolink Duo 2: sends SPS with Marker and PPS without
 		if packet.Marker && len(payload) < PSMaxSize {
--- a/pkg/h265/avcc.go
+++ b/pkg/h265/avcc.go
@@ -7,8 +7,26 @@ import (
 	"encoding/binary"

 	"github.com/AlexxIT/go2rtc/pkg/core"
+	"github.com/AlexxIT/go2rtc/pkg/h264"
+	"github.com/pion/rtp"
 )

+func RepairAVCC(codec *core.Codec, handler core.HandlerFunc) core.HandlerFunc {
+	vds, sps, pps := GetParameterSet(codec.FmtpLine)
+	ps := h264.JoinNALU(vds, sps, pps)
+
+	return func(packet *rtp.Packet) {
+		switch NALUType(packet.Payload) {
+		case NALUTypeIFrame, NALUTypeIFrame2, NALUTypeIFrame3:
+			clone := *packet
+			clone.Payload = h264.Join(ps, packet.Payload)
+			handler(&clone)
+		default:
+			handler(packet)
+		}
+	}
+}
+
 func AVCCToCodec(avcc []byte) *core.Codec {
 	buf := bytes.NewBufferString("profile-id=1")

--- a/pkg/h265/mpeg4.go
+++ b/pkg/h265/mpeg4.go
@@ -1,7 +1,40 @@
 // Package h265 - MPEG4 format related functions
 package h265

-import "encoding/binary"
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/binary"
+
+	"github.com/AlexxIT/go2rtc/pkg/core"
+)
+
+func DecodeConfig(conf []byte) (profile, vps, sps, pps []byte) {
+	profile = conf[1:4]
+
+	b := conf[23:]
+	if binary.BigEndian.Uint16(b[1:]) != 1 {
+		return
+	}
+	vpsSize := binary.BigEndian.Uint16(b[3:])
+	vps = b[5 : 5+vpsSize]
+
+	b = conf[23+5+vpsSize:]
+	if binary.BigEndian.Uint16(b[1:]) != 1 {
+		return
+	}
+	spsSize := binary.BigEndian.Uint16(b[3:])
+	sps = b[5 : 5+spsSize]
+
+	b = conf[23+5+vpsSize+5+spsSize:]
+	if binary.BigEndian.Uint16(b[1:]) != 1 {
+		return
+	}
+	ppsSize := binary.BigEndian.Uint16(b[3:])
+	pps = b[5 : 5+ppsSize]
+
+	return
+}

 func EncodeConfig(vps, sps, pps []byte) []byte {
 	vpsSize := uint16(len(vps))
@@ -38,3 +71,28 @@ func EncodeConfig(vps, sps, pps []byte) []byte {

 	return buf
 }
+
+func ConfigToCodec(conf []byte) *core.Codec {
+	buf := bytes.NewBufferString("profile-id=1")
+
+	_, vps, sps, pps := DecodeConfig(conf)
+	if vps != nil {
+		buf.WriteString(";sprop-vps=")
+		buf.WriteString(base64.StdEncoding.EncodeToString(vps))
+	}
+	if sps != nil {
+		buf.WriteString(";sprop-sps=")
+		buf.WriteString(base64.StdEncoding.EncodeToString(sps))
+	}
+	if pps != nil {
+		buf.WriteString(";sprop-pps=")
+		buf.WriteString(base64.StdEncoding.EncodeToString(pps))
+	}
+
+	return &core.Codec{
+		Name:        core.CodecH265,
+		ClockRate:   90000,
+		FmtpLine:    buf.String(),
+		PayloadType: core.PayloadTypeRAW,
+	}
+}
--- a/pkg/h265/rtp.go
+++ b/pkg/h265/rtp.go
@@ -55,6 +55,14 @@ func RTPDepay(codec *core.Codec, handler core.HandlerFunc) core.HandlerFunc {
 			case 1: // end
 				buf = append(buf, data[3:]...)
 				binary.BigEndian.PutUint32(buf[nuStart:], uint32(len(buf)-nuStart-4))
+			case 3: // wrong RFC 7798 realisation from OpenIPC project
+				// A non-fragmented NAL unit MUST NOT be transmitted in one FU; i.e.,
+				// the Start bit and End bit must not both be set to 1 in the same FU
+				// header.
+				nuType = data[2] & 0x3F
+				buf = binary.BigEndian.AppendUint32(buf, uint32(len(data))-1) // NAL unit size
+				buf = append(buf, (data[0]&0x81)|(nuType<<1), data[1])
+				buf = append(buf, data[3:]...)
 			}
 		} else {
 			nuStart = len(buf)
--- a/pkg/hap/README.md
+++ b/pkg/hap/README.md
@@ -50,4 +50,5 @@ Requires ffmpeg built with `--enable-libfdk-aac`
 - [Extracting HomeKit Pairing Keys](https://pvieito.com/2019/12/extract-homekit-pairing-keys)
 - [HAP in AirPlay2 receiver](https://github.com/openairplay/airplay2-receiver/blob/master/ap2/pairing/hap.py)
 - [HomeKit Secure Video Unofficial Specification](https://github.com/Supereg/secure-video-specification)
- [Homebridge Camera FFmpeg](https://sunoo.github.io/homebridge-camera-ffmpeg/configs/)
+- [Homebridge Camera FFmpeg](https://sunoo.github.io/homebridge-camera-ffmpeg/configs/)
+- https://github.com/ljezny/Particle-HAP/blob/master/HAP-Specification-Non-Commercial-Version.pdf
--- a/pkg/hap/camera/accessory.go
+++ b/pkg/hap/camera/accessory.go
@@ -62,6 +62,7 @@ func ServiceCameraRTPStreamManagement() *hap.Service {
 				VideoAttrs: []VideoAttrs{
 					{Width: 1920, Height: 1080, Framerate: 30},
 					{Width: 1280, Height: 720, Framerate: 30}, // important for iPhones
+					{Width: 320, Height: 240, Framerate: 15}, // apple watch
 				},
 			},
 		},
--- a/pkg/hap/client.go
+++ b/pkg/hap/client.go
@@ -83,6 +83,10 @@ func (c *Client) DeviceHost() string {
 }

 func (c *Client) Dial() (err error) {
+	if len(c.ClientID) == 0 || len(c.ClientPrivate) == 0 {
+		return errors.New("hap: can't dial witout client_id or client_private")
+	}
+
 	// update device address (host and/or port) before dial
 	_ = mdns.QueryOrDiscovery(c.DeviceHost(), mdns.ServiceHAP, func(entry *mdns.ServiceEntry) bool {
 		if entry.Complete() && entry.Info["id"] == c.DeviceID {
--- a/pkg/hass/client.go
+++ b/pkg/hass/client.go
@@ -2,10 +2,11 @@ package hass

 import (
 	"errors"
+	"net/url"
+
 	"github.com/AlexxIT/go2rtc/pkg/core"
 	"github.com/AlexxIT/go2rtc/pkg/webrtc"
 	pion "github.com/pion/webrtc/v3"
-	"net/url"
 )

 type Client struct {
@@ -48,7 +49,7 @@ func NewClient(rawURL string) (*Client, error) {
 	defer hassAPI.Close()

 	// 2. Create WebRTC client
-	rtcAPI, err := webrtc.NewAPI("")
+	rtcAPI, err := webrtc.NewAPI()
 	if err != nil {
 		return nil, err
 	}
--- a/pkg/homekit/consumer.go
+++ b/pkg/homekit/consumer.go
@@ -10,6 +10,7 @@ import (
 	"github.com/AlexxIT/go2rtc/pkg/core"
 	"github.com/AlexxIT/go2rtc/pkg/h264"
 	"github.com/AlexxIT/go2rtc/pkg/hap/camera"
+	"github.com/AlexxIT/go2rtc/pkg/opus"
 	"github.com/AlexxIT/go2rtc/pkg/srtp"
 	"github.com/pion/rtp"
 )
@@ -24,6 +25,7 @@ type Consumer struct {
 	sessionID    string
 	videoSession *srtp.Session
 	audioSession *srtp.Session
+	audioRTPTime byte
 }

 func NewConsumer(conn net.Conn, server *srtp.Server) *Consumer {
@@ -113,6 +115,7 @@ func (c *Consumer) SetConfig(conf *camera.SelectedStreamConfig) bool {
 	c.audioSession.Remote.SSRC = conf.AudioCodec.RTPParams[0].SSRC
 	c.audioSession.PayloadType = conf.AudioCodec.RTPParams[0].PayloadType
 	c.audioSession.RTCPInterval = toDuration(conf.AudioCodec.RTPParams[0].RTCPInterval)
+	c.audioRTPTime = conf.AudioCodec.CodecParams[0].RTPTime[0]

 	c.srtp.AddSession(c.videoSession)
 	c.srtp.AddSession(c.audioSession)
@@ -155,6 +158,8 @@ func (c *Consumer) AddTrack(media *core.Media, codec *core.Codec, track *core.Re
 		} else {
 			sender.Handler = h264.RepairAVCC(track.Codec, sender.Handler)
 		}
+	case core.CodecOpus:
+		sender.Handler = opus.RepackToHAP(c.audioRTPTime, sender.Handler)
 	}

 	sender.HandleRTP(track)
--- a/pkg/homekit/helpers.go
+++ b/pkg/homekit/helpers.go
@@ -2,6 +2,7 @@ package homekit

 import (
 	"encoding/hex"
+	"slices"

 	"github.com/AlexxIT/go2rtc/pkg/aac"
 	"github.com/AlexxIT/go2rtc/pkg/core"
@@ -20,17 +21,16 @@ func videoToMedia(codecs []camera.VideoCodec) *core.Media {

 	for _, codec := range codecs {
 		for _, param := range codec.CodecParams {
-			for _, profileID := range param.ProfileID {
-				for _, level := range param.Level {
-					profile := videoProfiles[profileID] + videoLevels[level]
-					mediaCodec := &core.Codec{
-						Name:      videoCodecs[codec.CodecType],
-						ClockRate: 90000,
-						FmtpLine:  "profile-level-id=" + profile,
-					}
-					media.Codecs = append(media.Codecs, mediaCodec)
-				}
+			// get best profile and level
+			profileID := slices.Max(param.ProfileID)
+			level := slices.Max(param.Level)
+			profile := videoProfiles[profileID] + videoLevels[level]
+			mediaCodec := &core.Codec{
+				Name:      videoCodecs[codec.CodecType],
+				ClockRate: 90000,
+				FmtpLine:  "profile-level-id=" + profile,
 			}
+			media.Codecs = append(media.Codecs, mediaCodec)
 		}
 	}

@@ -55,7 +55,7 @@ func audioToMedia(codecs []camera.AudioCodec) *core.Media {
 				}

 				if mediaCodec.Name == core.CodecELD {
-					// onli this version works with FFmpeg
+					// only this version works with FFmpeg
 					conf := aac.EncodeConfig(aac.TypeAACELD, 24000, 1, true)
 					mediaCodec.FmtpLine = aac.FMTP + hex.EncodeToString(conf)
 				}
@@ -71,6 +71,7 @@ func audioToMedia(codecs []camera.AudioCodec) *core.Media {
 func trackToVideo(track *core.Receiver, video0 *camera.VideoCodec) *camera.VideoCodec {
 	profileID := video0.CodecParams[0].ProfileID[0]
 	level := video0.CodecParams[0].Level[0]
+	attrs := video0.VideoAttrs[0]

 	if track != nil {
 		profile := h264.GetProfileLevelID(track.Codec.FmtpLine)
@@ -88,6 +89,12 @@ func trackToVideo(track *core.Receiver, video0 *camera.VideoCodec) *camera.Video
 				break
 			}
 		}
+
+		for _, s := range video0.VideoAttrs {
+			if s.Width > attrs.Width || s.Height > attrs.Height {
+				attrs = s
+			}
+		}
 	}

 	return &camera.VideoCodec{
@@ -98,9 +105,7 @@ func trackToVideo(track *core.Receiver, video0 *camera.VideoCodec) *camera.Video
 				Level:     []byte{level},
 			},
 		},
-		VideoAttrs: []camera.VideoAttrs{
-			{Width: 1920, Height: 1080, Framerate: 30},
-		},
+		VideoAttrs: []camera.VideoAttrs{attrs},
 	}
 }

--- a/pkg/homekit/proxy.go
+++ b/pkg/homekit/proxy.go
@@ -55,11 +55,8 @@ func proxy(r, w net.Conn, pair ServerPair) error {
 			continue
 		}

-		//if n > 512 {
-		//	log.Printf("[hap] %d bytes => %s\n%s...", n, w.RemoteAddr(), b[:512])
-		//} else {
-		//	log.Printf("[hap] %d bytes => %s\n%s", n, w.RemoteAddr(), b[:n])
-		//}
+		//log.Printf("[hap] %d bytes => %s\n%.512s", n, w.RemoteAddr(), b[:n])
+
 		if _, err = w.Write(b[:n]); err != nil {
 			break
 		}
--- a/pkg/isapi/client.go
+++ b/pkg/isapi/client.go
@@ -2,12 +2,13 @@ package isapi

 import (
 	"errors"
-	"github.com/AlexxIT/go2rtc/pkg/core"
-	"github.com/AlexxIT/go2rtc/pkg/tcp"
 	"io"
 	"net"
 	"net/http"
 	"net/url"
+
+	"github.com/AlexxIT/go2rtc/pkg/core"
+	"github.com/AlexxIT/go2rtc/pkg/tcp"
 )

 type Client struct {
@@ -84,8 +85,15 @@ func (c *Client) Dial() (err error) {
 }

 func (c *Client) Open() (err error) {
-	link := c.url + "/ISAPI/System/TwoWayAudio/channels/" + c.channel
+	// Hikvision ISAPI may not accept a new open request if the previous one was not closed (e.g.
+	// using the test button on-camera or via curl command) but a close request can be sent even if
+	// the audio is already closed. So, we send a close request first and then open it again. Seems
+	// janky but it works.
+	if err = c.Close(); err != nil {
+		return err
+	}

+	link := c.url + "/ISAPI/System/TwoWayAudio/channels/" + c.channel
 	req, err := http.NewRequest("PUT", link+"/open", nil)
 	if err != nil {
 		return err
@@ -124,8 +132,8 @@ func (c *Client) Open() (err error) {
 }

 func (c *Client) Close() (err error) {
-	link := c.url + "/ISAPI/System/TwoWayAudio/channels/" + c.channel + "/close"
-	req, err := http.NewRequest("PUT", link+"/open", nil)
+	link := c.url + "/ISAPI/System/TwoWayAudio/channels/" + c.channel
+	req, err := http.NewRequest("PUT", link+"/close", nil)
 	if err != nil {
 		return err
 	}
--- a/pkg/ivideon/client.go
+++ b/pkg/ivideon/client.go
@@ -132,6 +132,9 @@ func (c *Client) Handle() error {
 		case "stream-init":
 			continue

+		case "metadata":
+			continue
+
 		case "fragment":
 			_, data, err = c.conn.ReadMessage()
 			if err != nil {
@@ -183,6 +186,9 @@ func (c *Client) getTracks() error {
 		}

 		switch msg.Type {
+		case "metadata":
+			continue
+
 		case "stream-init":
 			s := msg.CodecString
 			i := strings.IndexByte(s, '.')
--- a/pkg/magic/bitstream/producer.go
+++ b/pkg/magic/bitstream/producer.go
@@ -70,13 +70,15 @@ func (c *Producer) Start() error {
 				break
 			}

-			pkt := &rtp.Packet{
-				Header:  rtp.Header{Timestamp: core.Now90000()},
-				Payload: annexb.EncodeToAVCC(buf[:i], true),
-			}
-			c.Receivers[0].WriteRTP(pkt)
+			if len(c.Receivers) > 0 {
+				pkt := &rtp.Packet{
+					Header:  rtp.Header{Timestamp: core.Now90000()},
+					Payload: annexb.EncodeToAVCC(buf[:i], true),
+				}
+				c.Receivers[0].WriteRTP(pkt)

-			//log.Printf("[AVC] %v, len: %d", h264.Types(pkt.Payload), len(pkt.Payload))
+				//log.Printf("[AVC] %v, len: %d", h264.Types(pkt.Payload), len(pkt.Payload))
+			}

 			buf = buf[i:]
 		}
--- a/pkg/magic/producer.go
+++ b/pkg/magic/producer.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"io"

+	"github.com/AlexxIT/go2rtc/pkg/aac"
 	"github.com/AlexxIT/go2rtc/pkg/core"
 	"github.com/AlexxIT/go2rtc/pkg/flv"
 	"github.com/AlexxIT/go2rtc/pkg/h264/annexb"
@@ -33,6 +34,9 @@ func Open(r io.Reader) (core.Producer, error) {
 	case bytes.HasPrefix(b, []byte(flv.Signature)):
 		return flv.Open(rd)

+	case bytes.HasPrefix(b, []byte{0xFF, 0xF1}):
+		return aac.Open(rd)
+
 	case bytes.HasPrefix(b, []byte("--")):
 		return multipart.Open(rd)

@@ -40,5 +44,16 @@ func Open(r io.Reader) (core.Producer, error) {
 		return mpegts.Open(rd)
 	}

-	return nil, errors.New("magic: unsupported header: " + hex.EncodeToString(b))
+	// support MJPEG with trash on start
+	// https://github.com/AlexxIT/go2rtc/issues/747
+	if b, err = rd.Peek(4096); err != nil {
+		return nil, err
+	}
+
+	if i := bytes.Index(b, []byte{0xFF, 0xD8, 0xFF, 0xDB}); i > 0 {
+		_, _ = io.ReadFull(rd, make([]byte, i))
+		return mjpeg.Open(rd)
+	}
+
+	return nil, errors.New("magic: unsupported header: " + hex.EncodeToString(b[:4]))
 }
--- a/pkg/mdns/client.go
+++ b/pkg/mdns/client.go
@@ -219,7 +219,7 @@ func (b *Browser) ListenMulticastUDP() error {
 		},
 	}

-	b.Recv, err = lc2.ListenPacket(ctx, "udp4", "0.0.0.0:5353")
+	b.Recv, err = lc2.ListenPacket(ctx, "udp4", ":5353")

 	return err
 }
--- a/pkg/mdns/syscall_freebsd.go
+++ b/pkg/mdns/syscall_freebsd.go
@@ -0,0 +1,24 @@
+package mdns
+
+import (
+	"syscall"
+)
+
+func SetsockoptInt(fd uintptr, level, opt int, value int) (err error) {
+	// change SO_REUSEADDR and REUSEPORT flags simultaneously for BSD-like OS
+	// https://github.com/AlexxIT/go2rtc/issues/626
+	// https://stackoverflow.com/questions/14388706/how-do-so-reuseaddr-and-so-reuseport-differ/14388707
+	if opt == syscall.SO_REUSEADDR {
+		if err = syscall.SetsockoptInt(int(fd), level, opt, value); err != nil {
+			return
+		}
+
+		opt = syscall.SO_REUSEPORT
+	}
+
+	return syscall.SetsockoptInt(int(fd), level, opt, value)
+}
+
+func SetsockoptIPMreq(fd uintptr, level, opt int, mreq *syscall.IPMreq) (err error) {
+	return syscall.SetsockoptIPMreq(int(fd), level, opt, mreq)
+}
--- a/pkg/mp4/consumer.go
+++ b/pkg/mp4/consumer.go
@@ -106,6 +106,8 @@ func (c *Consumer) AddTrack(media *core.Media, _ *core.Codec, track *core.Receiv

 		if track.Codec.IsRTP() {
 			handler.Handler = h265.RTPDepay(track.Codec, handler.Handler)
+		} else {
+			handler.Handler = h265.RepairAVCC(track.Codec, handler.Handler)
 		}

 	default:
--- a/pkg/mpegts/demuxer.go
+++ b/pkg/mpegts/demuxer.go
@@ -1,6 +1,7 @@
 package mpegts

 import (
+	"bytes"
 	"errors"
 	"io"

@@ -98,6 +99,11 @@ func (d *Demuxer) skip(i byte) {
 	d.pos += i
 }

+func (d *Demuxer) readBytes(i byte) []byte {
+	d.pos += i
+	return d.buf[d.pos-i : d.pos]
+}
+
 func (d *Demuxer) readPSIHeader() {
 	// https://en.wikipedia.org/wiki/Program-specific_information#Table_Sections
 	pointer := d.readByte() // Pointer field
@@ -159,7 +165,11 @@ func (d *Demuxer) readPMT() {
 		_ = d.readBits(4)          // Reserved bits
 		_ = d.readBits(2)          // ES Info length unused bits
 		size = d.readBits(10)      // ES Info length
-		d.skip(byte(size))
+		info := d.readBytes(byte(size))
+
+		if streamType == StreamTypePrivate && bytes.HasPrefix(info, opusInfo) {
+			streamType = StreamTypePrivateOPUS
+		}

 		d.pes[pid] = &PES{StreamType: streamType}
 	}
@@ -175,7 +185,7 @@ func (d *Demuxer) readPES(pid uint16, start bool) *rtp.Packet {

 	// if new payload beging
 	if start {
-		if pes.Payload != nil {
+		if len(pes.Payload) != 0 {
 			d.pos = skipRead
 			return pes.GetPacket() // finish previous packet
 		}
@@ -314,12 +324,13 @@ const (

 // https://en.wikipedia.org/wiki/Program-specific_information#Elementary_stream_types
 const (
-	StreamTypeMetadata = 0    // Reserved
-	StreamTypePrivate  = 0x06 // PCMU or PCMA or FLAC from FFmpeg
-	StreamTypeAAC      = 0x0F
-	StreamTypeH264     = 0x1B
-	StreamTypeH265     = 0x24
-	StreamTypePCMATapo = 0x90
+	StreamTypeMetadata    = 0    // Reserved
+	StreamTypePrivate     = 0x06 // PCMU or PCMA or FLAC from FFmpeg
+	StreamTypeAAC         = 0x0F
+	StreamTypeH264        = 0x1B
+	StreamTypeH265        = 0x24
+	StreamTypePCMATapo    = 0x90
+	StreamTypePrivateOPUS = 0xEB
 )

 // PES - Packetized Elementary Stream
@@ -397,6 +408,23 @@ func (p *PES) GetPacket() (pkt *rtp.Packet) {
 		}

 		//p.Timestamp += uint32(len(p.Payload)) // update next timestamp!
+
+	case StreamTypePrivateOPUS:
+		p.Sequence++
+
+		pkt = &rtp.Packet{
+			Header: rtp.Header{
+				Version:        2,
+				Marker:         true,
+				PayloadType:    p.StreamType,
+				SequenceNumber: p.Sequence,
+				Timestamp:      p.PTS,
+			},
+		}
+
+		pkt.Payload, p.Payload = CutOPUSPacket(p.Payload)
+		p.PTS += opusDT
+		return
 	}

 	p.Payload = nil
--- a/pkg/mpegts/opus.go
+++ b/pkg/mpegts/opus.go
@@ -0,0 +1,66 @@
+package mpegts
+
+import (
+	"github.com/AlexxIT/go2rtc/pkg/bits"
+)
+
+// opusDT - each AU from FFmpeg has 5 OPUS packets. Each packet len = 960 in the 48000 clock.
+const opusDT = 960 * ClockRate / 48000
+
+// https://opus-codec.org/docs/
+var opusInfo = []byte{ // registration_descriptor
+	0x05,               // descriptor_tag
+	0x04,               // descriptor_length
+	'O', 'p', 'u', 's', // format_identifier
+}
+
+//goland:noinspection GoSnakeCaseUsage
+func CutOPUSPacket(b []byte) (packet []byte, left []byte) {
+	r := bits.NewReader(b)
+
+	size := opus_control_header(r)
+	if size == 0 {
+		return nil, nil
+	}
+
+	packet = r.ReadBytes(size)
+	left = r.Left()
+	return
+}
+
+//goland:noinspection GoSnakeCaseUsage
+func opus_control_header(r *bits.Reader) int {
+	control_header_prefix := r.ReadBits(11)
+	if control_header_prefix != 0x3FF {
+		return 0
+	}
+
+	start_trim_flag := r.ReadBit()
+	end_trim_flag := r.ReadBit()
+	control_extension_flag := r.ReadBit()
+	_ = r.ReadBits(2) // reserved
+
+	var payload_size int
+	for {
+		i := r.ReadByte()
+		payload_size += int(i)
+		if i < 255 {
+			break
+		}
+	}
+
+	if start_trim_flag != 0 {
+		_ = r.ReadBits(3)
+		_ = r.ReadBits(13)
+	}
+	if end_trim_flag != 0 {
+		_ = r.ReadBits(3)
+		_ = r.ReadBits(13)
+	}
+	if control_extension_flag != 0 {
+		control_extension_length := r.ReadByte()
+		_ = r.ReadBytes(int(control_extension_length)) // reserved
+	}
+
+	return payload_size
+}
--- a/pkg/mpegts/producer.go
+++ b/pkg/mpegts/producer.go
@@ -87,7 +87,7 @@ func (c *Producer) probe() error {
 		case StreamTypeMetadata:
 			for _, streamType := range pkt.Payload {
 				switch streamType {
-				case StreamTypeH264, StreamTypeH265, StreamTypeAAC:
+				case StreamTypeH264, StreamTypeH265, StreamTypeAAC, StreamTypePrivateOPUS:
 					waitType = append(waitType, streamType)
 				}
 			}
@@ -118,6 +118,19 @@ func (c *Producer) probe() error {
 				Codecs:    []*core.Codec{codec},
 			}
 			c.Medias = append(c.Medias, media)
+
+		case StreamTypePrivateOPUS:
+			codec := &core.Codec{
+				Name:      core.CodecOpus,
+				ClockRate: 48000,
+				Channels:  2,
+			}
+			media := &core.Media{
+				Kind:      core.KindAudio,
+				Direction: core.DirectionRecvonly,
+				Codecs:    []*core.Codec{codec},
+			}
+			c.Medias = append(c.Medias, media)
 		}
 	}

@@ -134,6 +147,8 @@ func StreamType(codec *core.Codec) uint8 {
 		return StreamTypeAAC
 	case core.CodecPCMA:
 		return StreamTypePCMATapo
+	case core.CodecOpus:
+		return StreamTypePrivateOPUS
 	}
 	return 0
 }
--- a/pkg/nest/api.go
+++ b/pkg/nest/api.go
@@ -14,6 +14,13 @@ import (
 type API struct {
 	Token     string
 	ExpiresAt time.Time
+
+	StreamProjectID string
+	StreamDeviceID  string
+	StreamSessionID string
+	StreamExpiresAt time.Time
+
+	extendTimer *time.Timer
 }

 type Auth struct {
@@ -159,7 +166,7 @@ func (a *API) ExchangeSDP(projectID, deviceID, offer string) (string, error) {
 		Results struct {
 			Answer         string    `json:"answerSdp"`
 			ExpiresAt      time.Time `json:"expiresAt"`
-			MediaSessionId string    `json:"mediaSessionId"`
+			MediaSessionID string    `json:"mediaSessionId"`
 		} `json:"results"`
 	}

@@ -167,9 +174,65 @@ func (a *API) ExchangeSDP(projectID, deviceID, offer string) (string, error) {
 		return "", err
 	}

+	a.StreamProjectID = projectID
+	a.StreamDeviceID = deviceID
+	a.StreamSessionID = resv.Results.MediaSessionID
+	a.StreamExpiresAt = resv.Results.ExpiresAt
+
 	return resv.Results.Answer, nil
 }

+func (a *API) ExtendStream() error {
+	var reqv struct {
+		Command string `json:"command"`
+		Params  struct {
+			MediaSessionID string `json:"mediaSessionId"`
+		} `json:"params"`
+	}
+	reqv.Command = "sdm.devices.commands.CameraLiveStream.ExtendWebRtcStream"
+	reqv.Params.MediaSessionID = a.StreamSessionID
+
+	b, err := json.Marshal(reqv)
+	if err != nil {
+		return err
+	}
+
+	uri := "https://smartdevicemanagement.googleapis.com/v1/enterprises/" +
+		a.StreamProjectID + "/devices/" + a.StreamDeviceID + ":executeCommand"
+	req, err := http.NewRequest("POST", uri, bytes.NewReader(b))
+	if err != nil {
+		return err
+	}
+
+	req.Header.Set("Authorization", "Bearer "+a.Token)
+
+	client := &http.Client{Timeout: time.Second * 5000}
+	res, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+
+	if res.StatusCode != 200 {
+		return errors.New("nest: wrong status: " + res.Status)
+	}
+
+	var resv struct {
+		Results struct {
+			ExpiresAt      time.Time `json:"expiresAt"`
+			MediaSessionID string    `json:"mediaSessionId"`
+		} `json:"results"`
+	}
+
+	if err = json.NewDecoder(res.Body).Decode(&resv); err != nil {
+		return err
+	}
+
+	a.StreamSessionID = resv.Results.MediaSessionID
+	a.StreamExpiresAt = resv.Results.ExpiresAt
+
+	return nil
+}
+
 type Device struct {
 	Name string `json:"name"`
 	Type string `json:"type"`
@@ -203,3 +266,23 @@ type Device struct {
 	//	DisplayName string `json:"displayName"`
 	//} `json:"parentRelations"`
 }
+
+func (a *API) StartExtendStreamTimer() {
+	// Calculate the duration until 30 seconds before the stream expires
+	duration := time.Until(a.StreamExpiresAt.Add(-30 * time.Second))
+	a.extendTimer = time.AfterFunc(duration, func() {
+		if err := a.ExtendStream(); err != nil {
+			return
+		}
+		duration = time.Until(a.StreamExpiresAt.Add(-30 * time.Second))
+		a.extendTimer.Reset(duration)
+	})
+
+}
+
+func (a *API) StopExtendStreamTimer() {
+	if a.extendTimer == nil {
+		return
+	}
+	a.extendTimer.Stop()
+}
--- a/pkg/nest/client.go
+++ b/pkg/nest/client.go
@@ -2,14 +2,16 @@ package nest

 import (
 	"errors"
+	"net/url"
+
 	"github.com/AlexxIT/go2rtc/pkg/core"
 	"github.com/AlexxIT/go2rtc/pkg/webrtc"
 	pion "github.com/pion/webrtc/v3"
-	"net/url"
 )

 type Client struct {
 	conn *webrtc.Conn
+	api  *API
 }

 func NewClient(rawURL string) (*Client, error) {
@@ -34,7 +36,7 @@ func NewClient(rawURL string) (*Client, error) {
 		return nil, err
 	}

-	rtcAPI, err := webrtc.NewAPI("")
+	rtcAPI, err := webrtc.NewAPI()
 	if err != nil {
 		return nil, err
 	}
@@ -73,7 +75,7 @@ func NewClient(rawURL string) (*Client, error) {
 		return nil, err
 	}

-	return &Client{conn: conn}, nil
+	return &Client{conn: conn, api: nestAPI}, nil
 }

 func (c *Client) GetMedias() []*core.Media {
@@ -89,10 +91,12 @@ func (c *Client) AddTrack(media *core.Media, codec *core.Codec, track *core.Rece
 }

 func (c *Client) Start() error {
+	c.api.StartExtendStreamTimer()
 	return c.conn.Start()
 }

 func (c *Client) Stop() error {
+	c.api.StopExtendStreamTimer()
 	return c.conn.Stop()
 }

--- a/pkg/opus/README.md
+++ b/pkg/opus/README.md
@@ -0,0 +1,5 @@
+## Useful links
+
+- [RFC 3550: RTP: A Transport Protocol for Real-Time Applications](https://datatracker.ietf.org/doc/html/rfc3550)
+- [RFC 6716: Definition of the Opus Audio Codec](https://datatracker.ietf.org/doc/html/rfc6716)
+- [RFC 7587: RTP Payload Format for the Opus Speech and Audio Codec](https://datatracker.ietf.org/doc/html/rfc7587)
--- a/pkg/opus/homekit.go
+++ b/pkg/opus/homekit.go
@@ -0,0 +1,96 @@
+package opus
+
+import (
+	"github.com/AlexxIT/go2rtc/pkg/core"
+	"github.com/pion/rtp"
+)
+
+// Some info about this magic:
+// - Apple has no respect for RFC 7587 standard and using RFC 3550 for RTP timestamps
+// - Apple can request packets with 20ms duration over LAN connection and 60ms over LTE
+// - FFmpeg produce packets with 20ms duration by default and only one frame per packet
+// - FFmpeg should use "-min_comp 0" option, so every packet will be same duration
+// - Apple doesn't care about real sample rate of track
+// - Apple only cares about proper timestamp based on REQUESTED sample rate
+
+// RepackToHAP - convert standart RTP packet with OPUS to HAP packet
+// We expect that:
+// - incoming packet will be 20ms duration and only one frame per packet
+// - outgouing packet will be 20ms or 60ms duration
+// - incoming sample rate will be any (but not very big if we needs 60ms packets for output)
+// - outgouing sample rate will be 16000
+// https://github.com/AlexxIT/go2rtc/issues/667
+func RepackToHAP(rtpTime byte, handler core.HandlerFunc) core.HandlerFunc {
+	switch rtpTime {
+	case 20:
+		return repackToHAP20(handler)
+	case 60:
+		return repackToHAP60(handler)
+	}
+	return handler
+}
+
+// we using only one sample rate in the pkg/hap/camera/accessory.go
+const (
+	timestamp20 = 16000 * 0.020
+	timestamp60 = 16000 * 0.060
+)
+
+// repackToHAP20 - just fix RTP timestamp from RFC 7587 to RFC 3550
+func repackToHAP20(handler core.HandlerFunc) core.HandlerFunc {
+	var timestamp uint32
+
+	return func(pkt *rtp.Packet) {
+		timestamp += timestamp20
+
+		clone := *pkt
+		clone.Timestamp = timestamp
+		handler(&clone)
+	}
+}
+
+// repackToHAP60 - collect 20ms frames to single 60ms packet
+// thanks to @civita idea https://github.com/AlexxIT/go2rtc/pull/843
+func repackToHAP60(handler core.HandlerFunc) core.HandlerFunc {
+	var sequence uint16
+	var timestamp uint32
+
+	var framesCount byte
+	var framesSize []byte
+	var framesData []byte
+
+	return func(pkt *rtp.Packet) {
+		framesData = append(framesData, pkt.Payload[1:]...)
+
+		if framesCount++; framesCount < 3 {
+			if frameSize := len(pkt.Payload) - 1; frameSize >= 252 {
+				b0 := 252 + byte(frameSize)&0b11
+				framesSize = append(framesSize, b0, byte(frameSize/4)-b0)
+			} else {
+				framesSize = append(framesSize, byte(frameSize))
+			}
+			return
+		}
+
+		toc := pkt.Payload[0]
+
+		payload := make([]byte, 2, 2+len(framesSize)+len(framesData))
+		payload[0] = toc | 0b11  // code 3 (multiple frames per packet)
+		payload[1] = 0b1000_0011 // VBR, no padding, 3 frames
+		payload = append(payload, framesSize...)
+		payload = append(payload, framesData...)
+
+		sequence++
+		timestamp += timestamp60
+
+		clone := *pkt
+		clone.Payload = payload
+		clone.SequenceNumber = sequence
+		clone.Timestamp = timestamp
+		handler(&clone)
+
+		framesCount = 0
+		framesSize = framesSize[:0]
+		framesData = framesData[:0]
+	}
+}
--- a/pkg/opus/opus.go
+++ b/pkg/opus/opus.go
@@ -0,0 +1,69 @@
+package opus
+
+import (
+	"time"
+
+	"github.com/AlexxIT/go2rtc/pkg/core"
+	"github.com/pion/rtp"
+	"github.com/rs/zerolog/log"
+)
+
+func Log(handler core.HandlerFunc) core.HandlerFunc {
+	var ts uint32
+
+	return func(pkt *rtp.Packet) {
+		if ts == 0 {
+			ts = pkt.Timestamp
+		}
+
+		toc := pkt.Payload[0]
+		//config := toc >> 3
+		code := toc & 0b11
+
+		frame := parseFrameSize(toc)
+		rate := parseSampleRate(toc)
+
+		log.Printf(
+			"[RTP/OPUS] frame=%s rate=%5d code=%d size=%6d ts=%10d dt=%5d pt=%2d ssrc=%d seq=%d mark=%t",
+			frame, rate, code, len(pkt.Payload), pkt.Timestamp, pkt.Timestamp-ts, pkt.PayloadType, pkt.SSRC, pkt.SequenceNumber, pkt.Marker,
+		)
+
+		ts = pkt.Timestamp
+
+		handler(pkt)
+	}
+}
+
+func parseFrameSize(toc byte) time.Duration {
+	switch toc >> 3 {
+	case 0, 4, 8, 12, 14, 18, 22, 26, 30:
+		return 10_000_000
+	case 1, 5, 9, 13, 15, 19, 23, 27, 31:
+		return 20_000_000
+	case 2, 6, 10:
+		return 40_000_000
+	case 3, 7, 11:
+		return 60_000_000
+	case 16, 20, 24, 28:
+		return 2_500_000
+	case 17, 21, 25, 29:
+		return 5_000_000
+	}
+	return 0
+}
+
+func parseSampleRate(toc byte) uint16 {
+	switch toc >> 3 {
+	case 0, 1, 2, 3, 16, 17, 18, 19:
+		return 8000
+	case 4, 5, 6, 7:
+		return 12000
+	case 8, 9, 10, 11, 20, 21, 22, 23:
+		return 16000
+	case 12, 13, 24, 25, 26, 27:
+		return 24000
+	case 14, 15, 28, 29, 30, 31:
+		return 48000
+	}
+	return 0
+}
--- a/pkg/roborock/client.go
+++ b/pkg/roborock/client.go
@@ -90,7 +90,7 @@ func (c *Client) Connect() error {
 	}

 	// 4. Create Peer Connection
-	api, err := webrtc.NewAPI("")
+	api, err := webrtc.NewAPI()
 	if err != nil {
 		return err
 	}
--- a/pkg/rtsp/client.go
+++ b/pkg/rtsp/client.go
@@ -219,6 +219,9 @@ func (c *Conn) SetupMedia(media *core.Media) (byte, error) {
 			rawURL += "/"
 		}
 		rawURL += media.ID
+	} else if strings.HasPrefix(rawURL, "rtsp://rtsp://") {
+		// fix https://github.com/AlexxIT/go2rtc/issues/830
+		rawURL = rawURL[7:]
 	}
 	trackURL, err := urlParse(rawURL)
 	if err != nil {
--- a/pkg/rtsp/helpers.go
+++ b/pkg/rtsp/helpers.go
@@ -38,9 +38,8 @@ func UnmarshalSDP(rawSDP []byte) ([]*core.Media, error) {

 		// Fix invalid media type (errSDPInvalidValue) caused by
 		// some TP-LINK IP camera, e.g. TL-IPC44GW
-		rawSDP = bytes.ReplaceAll(rawSDP, []byte("m=application/TP-LINK "), []byte("m=application "))
-		// more tplink ipcams
-		rawSDP = bytes.ReplaceAll(rawSDP, []byte("m=application/tp-link "), []byte("m=application "))
+		m := regexp.MustCompile("m=application/[^ ]+")
+		rawSDP = m.ReplaceAll(rawSDP, []byte("m=application"))

 		if err == io.EOF {
 			rawSDP = append(rawSDP, '\n')
@@ -53,6 +52,9 @@ func UnmarshalSDP(rawSDP []byte) ([]*core.Media, error) {
 		}
 	}

+	// fix buggy camera https://github.com/AlexxIT/go2rtc/issues/771
+	forceDirection := sd.Origin.Username == "CV-RTSPHandler"
+
 	var medias []*core.Media

 	for _, md := range sd.MediaDescriptions {
@@ -66,7 +68,7 @@ func UnmarshalSDP(rawSDP []byte) ([]*core.Media, error) {
 			}
 		}

-		if media.Direction == "" {
+		if media.Direction == "" || forceDirection {
 			media.Direction = core.DirectionRecvonly
 		}

--- a/pkg/rtsp/rtsp_test.go
+++ b/pkg/rtsp/rtsp_test.go
@@ -1,8 +1,9 @@
 package rtsp

 import (
-	"github.com/stretchr/testify/assert"
 	"testing"
+
+	"github.com/stretchr/testify/assert"
 )

 func TestURLParse(t *testing.T) {
@@ -107,3 +108,54 @@ a=sendonly`
 	assert.Nil(t, err)
 	assert.Len(t, medias, 3)
 }
+
+func TestBugSDP4(t *testing.T) {
+	s := `v=0
+o=- 14665860 31787219 1 IN IP4 10.0.0.94
+s=Session streamed by "MERCURY RTSP Server"
+t=0 0
+m=video 0 RTP/AVP 96
+c=IN IP4 0.0.0.0
+b=AS:4096
+a=range:npt=0-
+a=control:track1
+a=rtpmap:96 H264/90000
+a=fmtp:96 packetization-mode=1; profile-level-id=640016; sprop-parameter-sets=Z2QAFqzGoCgPaEAAAAMAQAAAB6E=,aOqPLA==
+m=audio 0 RTP/AVP 8
+a=rtpmap:8 PCMA/8000
+a=control:track2
+m=application/MERCURY 0 RTP/AVP smart/1/90000
+a=rtpmap:95 MERCURY/90000
+a=control:track3
+`
+	medias, err := UnmarshalSDP([]byte(s))
+	assert.Nil(t, err)
+	assert.Len(t, medias, 3)
+}
+
+func TestBugSDP5(t *testing.T) {
+	s := `v=0
+o=CV-RTSPHandler 1123412 0 IN IP4 192.168.1.22
+s=Camera
+c=IN IP4 192.168.1.22
+t=0 0
+a=charset:Shift_JIS
+a=range:npt=0-
+a=control:*
+a=etag:1234567890
+m=video 0 RTP/AVP 99
+a=rtpmap:99 H264/90000
+a=fmtp:99 profile-level-id=42A01E;packetization-mode=1;sprop-parameter-sets=Z0KgKedAPAET8uAIEAABd2AAK/IGAAADAC+vCAAAHc1lP//jAAADABfXhAAADuayn//wIA==,aN48gA==
+a=control:trackID=1
+a=sendonly
+m=audio 0 RTP/AVP 127
+a=rtpmap:127 mpeg4-generic/8000/1
+a=fmtp:127 streamtype=5; profile-level-id=15; mode=AAC-hbr; sizeLength=13; indexLength=3; indexDeltalength=3; config=1588; CTSDeltaLength=0; DTSDeltaLength=0;
+a=control:trackID=2
+`
+	medias, err := UnmarshalSDP([]byte(s))
+	assert.Nil(t, err)
+	assert.Len(t, medias, 2)
+	assert.Equal(t, "recvonly", medias[0].Direction)
+	assert.Equal(t, "recvonly", medias[1].Direction)
+}
--- a/pkg/shell/shell.go
+++ b/pkg/shell/shell.go
@@ -2,9 +2,7 @@ package shell

 import (
 	"os"
-	"os/exec"
 	"os/signal"
-	"path/filepath"
 	"regexp"
 	"strings"
 	"syscall"
@@ -14,35 +12,28 @@ func QuoteSplit(s string) []string {
 	var a []string

 	for len(s) > 0 {
-		is := strings.IndexByte(s, ' ')
-		if is >= 0 {
-			// skip prefix and double spaces
-			if is == 0 {
-				// goto next symbol
-				s = s[1:]
-				continue
+		switch c := s[0]; c {
+		case '\t', '\n', '\r', ' ': // unicode.IsSpace
+			s = s[1:]
+		case '"', '\'': // quote chars
+			if i := strings.IndexByte(s[1:], c); i > 0 {
+				a = append(a, s[1:i+1])
+				s = s[i+2:]
+			} else {
+				return nil // error
 			}
-
-			// check if quote in word
-			if i := strings.IndexByte(s[:is], '"'); i >= 0 {
-				// search quote end
-				if is = strings.Index(s, `" `); is > 0 {
-					is += 1
-				} else {
-					is = -1
-				}
+		default:
+			i := strings.IndexAny(s, "\t\n\r ")
+			if i > 0 {
+				a = append(a, s[:i])
+				s = s[i:]
+			} else {
+				a = append(a, s)
+				s = ""
 			}
 		}
-
-		if is >= 0 {
-			a = append(a, strings.ReplaceAll(s[:is], `"`, ""))
-			s = s[is+1:]
-		} else {
-			//add last word
-			a = append(a, s)
-			break
-		}
 	}
+
 	return a
 }

@@ -77,20 +68,3 @@ func RunUntilSignal() {
 	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
 	println("exit with signal:", (<-sigs).String())
 }
-
-// Restart idea taken from https://github.com/tillberg/autorestart
-// Copyright (c) 2015, Dan Tillberg
-func Restart() {
-	path, err := exec.LookPath(os.Args[0])
-	if err != nil {
-		return
-	}
-	path, err = filepath.Abs(path)
-	if err != nil {
-		return
-	}
-	path = filepath.Clean(path)
-	if err = syscall.Exec(path, os.Args, os.Environ()); err != nil {
-		panic(err)
-	}
-}
--- a/pkg/shell/shell_test.go
+++ b/pkg/shell/shell_test.go
@@ -0,0 +1,18 @@
+package shell
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestQuoteSplit(t *testing.T) {
+	s := `
+python "-c" 'import time
+print("time", time.time())'
+`
+	require.Equal(t, []string{"python", "-c", "import time\nprint(\"time\", time.time())"}, QuoteSplit(s))
+
+	s = `ffmpeg -i "video=FaceTime HD Camera" -i "DeckLink SDI (2)"`
+	require.Equal(t, []string{"ffmpeg", "-i", `video=FaceTime HD Camera`, "-i", "DeckLink SDI (2)"}, QuoteSplit(s))
+}
--- a/pkg/srtp/server.go
+++ b/pkg/srtp/server.go
@@ -57,7 +57,8 @@ func (s *Server) DelSession(session *Session) {

 	delete(s.sessions, session.Remote.SSRC)

-	if len(s.sessions) == 0 {
+	// check s.conn for https://github.com/AlexxIT/go2rtc/issues/734
+	if len(s.sessions) == 0 && s.conn != nil {
 		_ = s.conn.Close()
 	}

--- a/pkg/stdin/client.go
+++ b/pkg/stdin/client.go
@@ -0,0 +1,41 @@
+package stdin
+
+import (
+	"io"
+	"os/exec"
+
+	"github.com/AlexxIT/go2rtc/pkg/core"
+)
+
+type Client struct {
+	cmd  *exec.Cmd
+	pipe io.WriteCloser
+
+	medias []*core.Media
+	sender *core.Sender
+	send   int
+}
+
+func NewClient(cmd *exec.Cmd) (*Client, error) {
+	pipe, err := PipeCloser(cmd)
+	if err != nil {
+		return nil, err
+	}
+
+	c := &Client{
+		pipe: pipe,
+		cmd:  cmd,
+		medias: []*core.Media{
+			{
+				Kind:      core.KindAudio,
+				Direction: core.DirectionSendonly,
+				Codecs: []*core.Codec{
+					{Name: core.CodecPCMA, ClockRate: 8000},
+					{Name: core.CodecPCM},
+				},
+			},
+		},
+	}
+
+	return c, nil
+}
--- a/pkg/stdin/consumer.go
+++ b/pkg/stdin/consumer.go
@@ -0,0 +1,52 @@
+package stdin
+
+import (
+	"encoding/json"
+
+	"github.com/AlexxIT/go2rtc/pkg/core"
+	"github.com/pion/rtp"
+)
+
+func (c *Client) GetMedias() []*core.Media {
+	return c.medias
+}
+
+func (c *Client) GetTrack(media *core.Media, codec *core.Codec) (*core.Receiver, error) {
+	return nil, core.ErrCantGetTrack
+}
+
+func (c *Client) AddTrack(media *core.Media, _ *core.Codec, track *core.Receiver) error {
+	if c.sender == nil {
+		c.sender = core.NewSender(media, track.Codec)
+		c.sender.Handler = func(packet *rtp.Packet) {
+			_, _ = c.pipe.Write(packet.Payload)
+			c.send += len(packet.Payload)
+		}
+	}
+
+	c.sender.HandleRTP(track)
+	return nil
+}
+
+func (c *Client) Start() (err error) {
+	return c.cmd.Run()
+}
+
+func (c *Client) Stop() (err error) {
+	if c.sender != nil {
+		c.sender.Close()
+	}
+	return c.pipe.Close()
+}
+
+func (c *Client) MarshalJSON() ([]byte, error) {
+	info := &core.Info{
+		Type:   "Exec active consumer",
+		Medias: c.medias,
+		Send:   c.send,
+	}
+	if c.sender != nil {
+		info.Senders = []*core.Sender{c.sender}
+	}
+	return json.Marshal(info)
+}
--- a/pkg/stdin/pipe.go
+++ b/pkg/stdin/pipe.go
@@ -0,0 +1,26 @@
+package stdin
+
+import (
+	"errors"
+	"io"
+	"os/exec"
+)
+
+type pipeCloser struct {
+	io.Writer
+	io.Closer
+	cmd *exec.Cmd
+}
+
+func PipeCloser(cmd *exec.Cmd) (io.WriteCloser, error) {
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return nil, err
+	}
+
+	return pipeCloser{stdin, stdin, cmd}, nil
+}
+
+func (p pipeCloser) Close() (err error) {
+	return errors.Join(p.Closer.Close(), p.cmd.Process.Kill(), p.cmd.Wait())
+}
--- a/pkg/tapo/client.go
+++ b/pkg/tapo/client.go
@@ -1,10 +1,12 @@
 package tapo

 import (
+	"bufio"
 	"bytes"
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/md5"
+	"crypto/sha256"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -14,6 +16,7 @@ import (
 	"net/http"
 	"net/url"
 	"strconv"
+	"strings"

 	"github.com/AlexxIT/go2rtc/pkg/core"
 	"github.com/AlexxIT/go2rtc/pkg/mpegts"
@@ -36,6 +39,7 @@ type Client struct {

 	session1 string
 	session2 string
+	request  string

 	recv int
 	send int
@@ -62,33 +66,25 @@ func (c *Client) newConn() (net.Conn, error) {
 		return nil, err
 	}

-	// support raw username/password
-	username := u.User.Username()
-	password, _ := u.User.Password()
-
-	// or cloud password in place of username
-	if password == "" {
-		password = fmt.Sprintf("%16X", md5.Sum([]byte(username)))
-		username = "admin"
-		u.User = url.UserPassword(username, password)
-	}
-
-	u.Scheme = "http"
-	u.Path = "/stream"
 	if u.Port() == "" {
 		u.Host += ":8800"
 	}

-	// TODO: fix closing connection
-	ctx, pconn := tcp.WithConn()
-	req, err := http.NewRequestWithContext(ctx, "POST", u.String(), nil)
+	req, err := http.NewRequest("POST", "http://"+u.Host+"/stream", nil)
 	if err != nil {
 		return nil, err
 	}

+	query := u.Query()
+
+	if deviceId := query.Get("deviceId"); deviceId != "" {
+		req.URL.RawQuery = "deviceId=" + deviceId
+	}
+
+	req.URL.User = u.User
 	req.Header.Set("Content-Type", "multipart/mixed; boundary=--client-stream-boundary--")

-	res, err := tcp.Do(req)
+	conn, res, err := dial(req)
 	if err != nil {
 		return nil, err
 	}
@@ -98,13 +94,34 @@ func (c *Client) newConn() (net.Conn, error) {
 	}

 	if c.decrypt == nil {
-		c.newDectypter(res, username, password)
+		c.newDectypter(res)
 	}

-	return *pconn, nil
+	channel := query.Get("channel")
+	if channel == "" {
+		channel = "0"
+	}
+
+	subtype := query.Get("subtype")
+	switch subtype {
+	case "", "0":
+		subtype = "HD"
+	case "1":
+		subtype = "VGA"
+	}
+
+	c.request = fmt.Sprintf(
+		`{"params":{"preview":{"audio":["default"],"channels":[%s],"resolutions":["%s"]},"method":"get"},"seq":1,"type":"request"}`,
+		channel, subtype,
+	)
+
+	return conn, nil
 }

-func (c *Client) newDectypter(res *http.Response, username, password string) {
+func (c *Client) newDectypter(res *http.Response) {
+	username := res.Request.URL.User.Username()
+	password, _ := res.Request.URL.User.Password()
+
 	// extract nonce from response
 	// cipher="AES_128_CBC" username="admin" padding="PKCS7_16" algorithm="MD5" nonce="***"
 	nonce := res.Header.Get("Key-Exchange")
@@ -139,7 +156,7 @@ func (c *Client) SetupStream() (err error) {
 	}

 	// audio: default, disable, enable
-	c.session1, err = c.Request(c.conn1, []byte(`{"params":{"preview":{"audio":["default"],"channels":[0],"resolutions":["HD"]},"method":"get"},"seq":1,"type":"request"}`))
+	c.session1, err = c.Request(c.conn1, []byte(c.request))
 	return
 }

@@ -244,3 +261,76 @@ func (c *Client) Request(conn net.Conn, body []byte) (string, error) {
 		return v.Params.SessionID, nil
 	}
 }
+
+func dial(req *http.Request) (net.Conn, *http.Response, error) {
+	conn, err := net.DialTimeout("tcp", req.URL.Host, core.ConnDialTimeout)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	username := req.URL.User.Username()
+	password, _ := req.URL.User.Password()
+	req.URL.User = nil
+
+	if err = req.Write(conn); err != nil {
+		return nil, nil, err
+	}
+
+	r := bufio.NewReader(conn)
+
+	res, err := http.ReadResponse(r, req)
+	if err != nil {
+		return nil, nil, err
+	}
+	_ = res.Body.Close() // ignore response body
+
+	auth := res.Header.Get("WWW-Authenticate")
+
+	if res.StatusCode != http.StatusUnauthorized || !strings.HasPrefix(auth, "Digest") {
+		return nil, nil, fmt.Errorf("Expected StatusCode to be %d, received %d", http.StatusUnauthorized, res.StatusCode)
+	}
+
+	if password == "" {
+		// support cloud password in place of username
+		if strings.Contains(auth, `encrypt_type="3"`) {
+			password = fmt.Sprintf("%32X", sha256.Sum256([]byte(username)))
+		} else {
+			password = fmt.Sprintf("%16X", md5.Sum([]byte(username)))
+		}
+		username = "admin"
+	}
+
+	realm := tcp.Between(auth, `realm="`, `"`)
+	nonce := tcp.Between(auth, `nonce="`, `"`)
+	qop := tcp.Between(auth, `qop="`, `"`)
+	uri := req.URL.RequestURI()
+	ha1 := tcp.HexMD5(username, realm, password)
+	ha2 := tcp.HexMD5(req.Method, uri)
+	nc := "00000001"
+	cnonce := core.RandString(32, 64)
+	response := tcp.HexMD5(ha1, nonce, nc, cnonce, qop, ha2)
+
+	// https://datatracker.ietf.org/doc/html/rfc7616
+	header := fmt.Sprintf(
+		`Digest username="%s", realm="%s", nonce="%s", uri="%s", qop=%s, nc=%s, cnonce="%s", response="%s"`,
+		username, realm, nonce, uri, qop, nc, cnonce, response,
+	)
+
+	if opaque := tcp.Between(auth, `opaque="`, `"`); opaque != "" {
+		header += fmt.Sprintf(`, opaque="%s", algorithm=MD5`, opaque)
+	}
+
+	req.Header.Set("Authorization", header)
+
+	if err = req.Write(conn); err != nil {
+		return nil, nil, err
+	}
+
+	if res, err = http.ReadResponse(r, req); err != nil {
+		return nil, nil, err
+	}
+
+	req.URL.User = url.UserPassword(username, password)
+
+	return conn, res, nil
+}
--- a/pkg/tcp/request.go
+++ b/pkg/tcp/request.go
@@ -2,17 +2,37 @@ package tcp

 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"net"
 	"net/http"
 	"strings"
 	"time"
+
+	"github.com/AlexxIT/go2rtc/pkg/core"
 )

 // Do - http.Client with support Digest Authorization
 func Do(req *http.Request) (*http.Response, error) {
-	if secureClient == nil {
+	var secure *tls.Config
+
+	switch req.URL.Scheme {
+	case "httpx":
+		secure = &tls.Config{InsecureSkipVerify: true}
+		req.URL.Scheme = "https"
+	case "https":
+		if hostname := req.URL.Hostname(); IsIP(hostname) {
+			secure = &tls.Config{InsecureSkipVerify: true}
+		}
+	}
+
+	if secure != nil {
+		ctx := context.WithValue(req.Context(), secureKey, secure)
+		req = req.WithContext(ctx)
+	}
+
+	if client == nil {
 		transport := http.DefaultTransport.(*http.Transport).Clone()

 		dial := transport.DialContext
@@ -23,33 +43,38 @@ func Do(req *http.Request) (*http.Response, error) {
 			}
 			return conn, err
 		}
+		transport.DialTLSContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
+			conn, err := dial(ctx, network, addr)
+			if err != nil {
+				return nil, err
+			}

-		secureClient = &http.Client{
+			var conf *tls.Config
+			if v, ok := ctx.Value(secureKey).(*tls.Config); ok {
+				conf = v
+			} else if host, _, err := net.SplitHostPort(addr); err != nil {
+				conf = &tls.Config{ServerName: addr}
+			} else {
+				conf = &tls.Config{ServerName: host}
+			}
+
+			tlsConn := tls.Client(conn, conf)
+			if err = tlsConn.Handshake(); err != nil {
+				return nil, err
+			}
+
+			if pconn, ok := ctx.Value(connKey).(*net.Conn); ok {
+				*pconn = tlsConn
+			}
+			return tlsConn, err
+		}
+
+		client = &http.Client{
 			Timeout:   time.Second * 5000,
 			Transport: transport,
 		}
 	}

-	var client *http.Client
-
-	if req.URL.Scheme == "httpx" || (req.URL.Scheme == "https" && IsIP(req.URL.Hostname())) {
-		req.URL.Scheme = "https"
-
-		if insecureClient == nil {
-			transport := secureClient.Transport.(*http.Transport).Clone()
-			transport.TLSClientConfig.InsecureSkipVerify = true
-
-			insecureClient = &http.Client{
-				Timeout:   secureClient.Timeout,
-				Transport: transport,
-			}
-		}
-
-		client = insecureClient
-	} else {
-		client = secureClient
-	}
-
 	user := req.URL.User

 	// Hikvision won't answer on Basic auth with any headers
@@ -88,11 +113,11 @@ func Do(req *http.Request) (*http.Response, error) {
 			response := HexMD5(ha1, nonce, ha2)
 			header = fmt.Sprintf(
 				`Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"`,
-				user, realm, nonce, uri, response,
+				username, realm, nonce, uri, response,
 			)
 		case "auth":
 			nc := "00000001"
-			cnonce := "00000001" // TODO: random...
+			cnonce := core.RandString(32, 64)
 			response := HexMD5(ha1, nonce, nc, cnonce, qop, ha2)
 			header = fmt.Sprintf(
 				`Digest username="%s", realm="%s", nonce="%s", uri="%s", qop=%s, nc=%s, cnonce="%s", response="%s"`,
@@ -112,8 +137,12 @@ func Do(req *http.Request) (*http.Response, error) {
 	return res, nil
 }

-var secureClient, insecureClient *http.Client
-var connKey struct{}
+var client *http.Client
+
+type key string
+
+var connKey = key("conn")
+var secureKey = key("secure")

 func WithConn() (context.Context, *net.Conn) {
 	pconn := new(net.Conn)
--- a/pkg/webrtc/api.go
+++ b/pkg/webrtc/api.go
@@ -1,18 +1,21 @@
 package webrtc

 import (
-	"github.com/pion/ice/v2"
+	"net"
+
 	"github.com/pion/interceptor"
 	"github.com/pion/webrtc/v3"
-	"net"
-	"strings"
 )

 // ReceiveMTU = Ethernet MTU (1500) - IP Header (20) - UDP Header (8)
 // https://ffmpeg.org/ffmpeg-all.html#Muxer
 const ReceiveMTU = 1472

-func NewAPI(address string) (*webrtc.API, error) {
+func NewAPI() (*webrtc.API, error) {
+	return NewServerAPI("", "", nil)
+}
+
+func NewServerAPI(address, network string, candidateHost []string) (*webrtc.API, error) {
 	// for debug logs add to env: `PION_LOG_DEBUG=all`
 	m := &webrtc.MediaEngine{}
 	//if err := m.RegisterDefaultCodecs(); err != nil {
@@ -34,33 +37,33 @@ func NewAPI(address string) (*webrtc.API, error) {
 		return name != "hassio" && name != "docker0"
 	})

-	// disable mDNS listener
-	s.SetICEMulticastDNSMode(ice.MulticastDNSModeDisabled)
-
-	// UDP6 may have problems with DNS resolving for STUN servers
-	s.SetNetworkTypes([]webrtc.NetworkType{
-		webrtc.NetworkTypeUDP4, webrtc.NetworkTypeTCP4,
-	})
-
 	// fix https://github.com/pion/webrtc/pull/2407
 	s.SetDTLSInsecureSkipHelloVerify(true)

 	s.SetReceiveMTU(ReceiveMTU)

+	s.SetNAT1To1IPs(candidateHost, webrtc.ICECandidateTypeHost)
+
+	// by default enable IPv4 + IPv6 modes
+	s.SetNetworkTypes([]webrtc.NetworkType{
+		webrtc.NetworkTypeUDP4, webrtc.NetworkTypeTCP4,
+		webrtc.NetworkTypeUDP6, webrtc.NetworkTypeTCP6,
+	})
+
 	if address != "" {
-		address, network, _ := strings.Cut(address, "/")
-		if network == "" || network == "udp" {
-			if ln, err := net.ListenPacket("udp4", address); err == nil {
-				udpMux := webrtc.NewICEUDPMux(nil, ln)
-				s.SetICEUDPMux(udpMux)
-			}
-		}
 		if network == "" || network == "tcp" {
-			if ln, err := net.Listen("tcp4", address); err == nil {
+			if ln, err := net.Listen("tcp", address); err == nil {
 				tcpMux := webrtc.NewICETCPMux(nil, ln, 8)
 				s.SetICETCPMux(tcpMux)
 			}
 		}
+
+		if network == "" || network == "udp" {
+			if ln, err := net.ListenPacket("udp", address); err == nil {
+				udpMux := webrtc.NewICEUDPMux(nil, ln)
+				s.SetICEUDPMux(udpMux)
+			}
+		}
 	}

 	return webrtc.NewAPI(
--- a/Show More
+++ b/Show More