Use unix socket for HA managed go2rtc instance (home-assistant#156968)

Author: edenhaus

homeassistant/components/go2rtc/__init__.py

@@ -2,10 +2,11 @@
 
 from __future__ import annotations
 
+from dataclasses import dataclass
 import logging
 import shutil
 
-from aiohttp import ClientSession
+from aiohttp import ClientSession, UnixConnector
 from aiohttp.client_exceptions import ClientConnectionError, ServerConnectionError
 from awesomeversion import AwesomeVersion
 from go2rtc_client import Go2RtcRestClient
@@ -52,6 +53,7 @@
     CONF_DEBUG_UI,
     DEBUG_UI_URL_MESSAGE,
     DOMAIN,
+    HA_MANAGED_UNIX_SOCKET,
     HA_MANAGED_URL,
     RECOMMENDED_VERSION,
 )
@@ -73,7 +75,7 @@
     extra=vol.ALLOW_EXTRA,
 )
 
-_DATA_GO2RTC: HassKey[str] = HassKey(DOMAIN)
+_DATA_GO2RTC: HassKey[Go2RtcConfig] = HassKey(DOMAIN)
 _RETRYABLE_ERRORS = (ClientConnectionError, ServerConnectionError)
 type Go2RtcConfigEntry = ConfigEntry[WebRTCProvider]
 
@@ -100,8 +102,12 @@ async def async_setup(hass: HomeAssistant, config: ConfigType) -> bool:
             return False
 
         # HA will manage the binary
+        session = ClientSession(connector=UnixConnector(path=HA_MANAGED_UNIX_SOCKET))
         server = Server(
-            hass, binary, enable_ui=config.get(DOMAIN, {}).get(CONF_DEBUG_UI, False)
+            hass,
+            binary,
+            session,
+            enable_ui=config.get(DOMAIN, {}).get(CONF_DEBUG_UI, False),
         )
         try:
             await server.start()
@@ -111,12 +117,15 @@ async def async_setup(hass: HomeAssistant, config: ConfigType) -> bool:
 
         async def on_stop(event: Event) -> None:
             await server.stop()
+            await session.close()
 
         hass.bus.async_listen(EVENT_HOMEASSISTANT_STOP, on_stop)
 
         url = HA_MANAGED_URL
+    else:
+        session = async_get_clientsession(hass)
 
-    hass.data[_DATA_GO2RTC] = url
+    hass.data[_DATA_GO2RTC] = Go2RtcConfig(url, session)
     discovery_flow.async_create_flow(
         hass, DOMAIN, context={"source": SOURCE_SYSTEM}, data={}
     )
@@ -132,8 +141,9 @@ async def _remove_go2rtc_entries(hass: HomeAssistant) -> None:
 async def async_setup_entry(hass: HomeAssistant, entry: Go2RtcConfigEntry) -> bool:
     """Set up go2rtc from a config entry."""
 
-    url = hass.data[_DATA_GO2RTC]
-    session = async_get_clientsession(hass)
+    config = hass.data[_DATA_GO2RTC]
+    url = config.url
+    session = config.session
     client = Go2RtcRestClient(session, url)
     # Validate the server URL
     try:
@@ -342,3 +352,11 @@ async def teardown(self) -> None:
         for ws_client in self._sessions.values():
             await ws_client.close()
         self._sessions.clear()
+
+
+@dataclass
+class Go2RtcConfig:
+    """Go2rtc configuration."""
+
+    url: str
+    session: ClientSession

homeassistant/components/go2rtc/const.py

@@ -6,4 +6,5 @@
 DEBUG_UI_URL_MESSAGE = "Url and debug_ui cannot be set at the same time."
 HA_MANAGED_API_PORT = 11984
 HA_MANAGED_URL = f"http://localhost:{HA_MANAGED_API_PORT}/"
+HA_MANAGED_UNIX_SOCKET = "/run/go2rtc.sock"
 RECOMMENDED_VERSION = "1.9.12"

homeassistant/components/go2rtc/server.py

@@ -6,13 +6,13 @@
 import logging
 from tempfile import NamedTemporaryFile
 
+from aiohttp import ClientSession
 from go2rtc_client import Go2RtcRestClient
 
 from homeassistant.core import HomeAssistant
 from homeassistant.exceptions import HomeAssistantError
-from homeassistant.helpers.aiohttp_client import async_get_clientsession
 
-from .const import HA_MANAGED_API_PORT, HA_MANAGED_URL
+from .const import HA_MANAGED_API_PORT, HA_MANAGED_UNIX_SOCKET, HA_MANAGED_URL
 
 _LOGGER = logging.getLogger(__name__)
 _TERMINATE_TIMEOUT = 5
@@ -23,7 +23,8 @@
 _RESPAWN_COOLDOWN = 1
 
 # Default configuration for HA
-# - Api is listening only on localhost
+# - Unix socket for secure local communication
+# - HTTP API only enabled when UI is enabled
 # - Enable rtsp for localhost only as ffmpeg needs it
 # - Clear default ice servers
 _GO2RTC_CONFIG_FORMAT = r"""# This file is managed by Home Assistant
@@ -33,7 +34,8 @@
   modules: {app_modules}
 
 api:
-  listen: "{api_ip}:{api_port}"
+  listen: "{listen_config}"
+  unix_listen: "{unix_socket}"
   allow_paths: {api_allow_paths}
 
 # ffmpeg needs the exec module
@@ -120,20 +122,24 @@ def _create_temp_file(enable_ui: bool) -> str:
     """Create temporary config file."""
     app_modules: tuple[str, ...] = _APP_MODULES
     api_paths: tuple[str, ...] = _API_ALLOW_PATHS
-    api_ip = _LOCALHOST_IP
+
     if enable_ui:
         app_modules = _UI_APP_MODULES
         api_paths = _UI_API_ALLOW_PATHS
         # Listen on all interfaces for allowing access from all ips
-        api_ip = ""
+        listen_config = f":{HA_MANAGED_API_PORT}"
+    else:
+        # Disable HTTP listening when UI is not enabled
+        # as HA does not use it.
+        listen_config = ""
 
     # Set delete=False to prevent the file from being deleted when the file is closed
     # Linux is clearing tmp folder on reboot, so no need to delete it manually
     with NamedTemporaryFile(prefix="go2rtc_", suffix=".yaml", delete=False) as file:
         file.write(
             _GO2RTC_CONFIG_FORMAT.format(
-                api_ip=api_ip,
-                api_port=HA_MANAGED_API_PORT,
+                listen_config=listen_config,
+                unix_socket=HA_MANAGED_UNIX_SOCKET,
                 app_modules=_format_list_for_yaml(app_modules),
                 api_allow_paths=_format_list_for_yaml(api_paths),
             ).encode()
@@ -145,11 +151,17 @@ class Server:
     """Go2rtc server."""
 
     def __init__(
-        self, hass: HomeAssistant, binary: str, *, enable_ui: bool = False
+        self,
+        hass: HomeAssistant,
+        binary: str,
+        session: ClientSession,
+        *,
+        enable_ui: bool = False,
     ) -> None:
         """Initialize the server."""
         self._hass = hass
         self._binary = binary
+        self._session = session
         self._log_buffer: deque[str] = deque(maxlen=_LOG_BUFFER_SIZE)
         self._process: asyncio.subprocess.Process | None = None
         self._startup_complete = asyncio.Event()
@@ -197,7 +209,7 @@ async def _start(self) -> None:
             raise Go2RTCServerStartError from err
 
         # Check the server version
-        client = Go2RtcRestClient(async_get_clientsession(self._hass), HA_MANAGED_URL)
+        client = Go2RtcRestClient(self._session, HA_MANAGED_URL)
         await client.validate_server_version()
 
     async def _log_output(self, process: asyncio.subprocess.Process) -> None:
@@ -269,7 +281,7 @@ async def _monitor_process(self) -> None:
 
     async def _monitor_api(self) -> None:
         """Raise if the go2rtc process terminates."""
-        client = Go2RtcRestClient(async_get_clientsession(self._hass), HA_MANAGED_URL)
+        client = Go2RtcRestClient(self._session, HA_MANAGED_URL)
 
         _LOGGER.debug("Monitoring go2rtc API")
         try:

tests/components/go2rtc/snapshots/test_server.ambr

@@ -3,7 +3,7 @@
   _CallList([
     _Call(
       tuple(
-        b'# This file is managed by Home Assistant\n# Do not edit it manually\n\napp:\n  modules: ["api","exec","ffmpeg","http","mjpeg","onvif","rtmp","rtsp","srtp","webrtc","ws"]\n\napi:\n  listen: "127.0.0.1:11984"\n  allow_paths: ["/","/api","/api/frame.jpeg","/api/schemes","/api/streams","/api/webrtc","/api/ws"]\n\n# ffmpeg needs the exec module\n# Restrict execution to only ffmpeg binary\nexec:\n  allow_paths:\n    - ffmpeg\n\nrtsp:\n  listen: "127.0.0.1:18554"\n\nwebrtc:\n  listen: ":18555/tcp"\n  ice_servers: []\n',
+        b'# This file is managed by Home Assistant\n# Do not edit it manually\n\napp:\n  modules: ["api","exec","ffmpeg","http","mjpeg","onvif","rtmp","rtsp","srtp","webrtc","ws"]\n\napi:\n  listen: ""\n  unix_listen: "/run/go2rtc.sock"\n  allow_paths: ["/","/api","/api/frame.jpeg","/api/schemes","/api/streams","/api/webrtc","/api/ws"]\n\n# ffmpeg needs the exec module\n# Restrict execution to only ffmpeg binary\nexec:\n  allow_paths:\n    - ffmpeg\n\nrtsp:\n  listen: "127.0.0.1:18554"\n\nwebrtc:\n  listen: ":18555/tcp"\n  ice_servers: []\n',
       ),
       dict({
       }),
@@ -14,7 +14,7 @@
   _CallList([
     _Call(
       tuple(
-        b'# This file is managed by Home Assistant\n# Do not edit it manually\n\napp:\n  modules: ["api","exec","ffmpeg","http","mjpeg","onvif","rtmp","rtsp","srtp","webrtc","ws","debug"]\n\napi:\n  listen: ":11984"\n  allow_paths: ["/","/api","/api/frame.jpeg","/api/schemes","/api/streams","/api/webrtc","/api/ws","/api/config","/api/log","/api/streams.dot"]\n\n# ffmpeg needs the exec module\n# Restrict execution to only ffmpeg binary\nexec:\n  allow_paths:\n    - ffmpeg\n\nrtsp:\n  listen: "127.0.0.1:18554"\n\nwebrtc:\n  listen: ":18555/tcp"\n  ice_servers: []\n',
+        b'# This file is managed by Home Assistant\n# Do not edit it manually\n\napp:\n  modules: ["api","exec","ffmpeg","http","mjpeg","onvif","rtmp","rtsp","srtp","webrtc","ws","debug"]\n\napi:\n  listen: ":11984"\n  unix_listen: "/run/go2rtc.sock"\n  allow_paths: ["/","/api","/api/frame.jpeg","/api/schemes","/api/streams","/api/webrtc","/api/ws","/api/config","/api/log","/api/streams.dot"]\n\n# ffmpeg needs the exec module\n# Restrict execution to only ffmpeg binary\nexec:\n  allow_paths:\n    - ffmpeg\n\nrtsp:\n  listen: "127.0.0.1:18554"\n\nwebrtc:\n  listen: ":18555/tcp"\n  ice_servers: []\n',
       ),
       dict({
       }),

tests/components/go2rtc/test_init.py

@@ -3,8 +3,9 @@
 from collections.abc import Awaitable, Callable
 import logging
 from typing import NamedTuple
-from unittest.mock import AsyncMock, Mock, patch
+from unittest.mock import ANY, AsyncMock, Mock, patch
 
+from aiohttp import UnixConnector
 from aiohttp.client_exceptions import ClientConnectionError, ServerConnectionError
 from awesomeversion import AwesomeVersion
 from go2rtc_client import Stream
@@ -38,11 +39,13 @@
     CONF_DEBUG_UI,
     DEBUG_UI_URL_MESSAGE,
     DOMAIN,
+    HA_MANAGED_UNIX_SOCKET,
     RECOMMENDED_VERSION,
 )
 from homeassistant.components.stream import Orientation
 from homeassistant.config_entries import ConfigEntryState
 from homeassistant.const import CONF_URL
+from homeassistant.core import EVENT_HOMEASSISTANT_STOP
 from homeassistant.exceptions import HomeAssistantError
 from homeassistant.helpers import issue_registry as ir
 from homeassistant.helpers.typing import ConfigType
@@ -215,7 +218,9 @@ async def test_setup_go_binary(
     assert (len(hass.config_entries.async_entries(DOMAIN)) == 1) == has_go2rtc_entry
 
     def after_setup() -> None:
-        server.assert_called_once_with(hass, "/usr/bin/go2rtc", enable_ui=ui_enabled)
+        server.assert_called_once_with(
+            hass, "/usr/bin/go2rtc", ANY, enable_ui=ui_enabled
+        )
         server_start.assert_called_once()
 
     await _test_setup_and_signaling(
@@ -905,3 +910,53 @@ async def test_stream_orientation_with_generic_camera(
             rest_client,
             "ffmpeg:https://test.stream/video.m3u8#video=h264#audio=copy#raw=-vf vflip",
         )
+
+
+@pytest.mark.usefixtures(
+    "mock_get_binary",
+    "mock_is_docker_env",
+    "mock_go2rtc_entry",
+    "rest_client",
+    "server",
+)
+async def test_unix_socket_connection(hass: HomeAssistant) -> None:
+    """Test Unix socket is used for HA-managed go2rtc instances."""
+    config = {DOMAIN: {}}
+
+    with patch("homeassistant.components.go2rtc.ClientSession") as mock_session_cls:
+        mock_session = AsyncMock()
+        mock_session_cls.return_value = mock_session
+
+        assert await async_setup_component(hass, DOMAIN, config)
+        await hass.async_block_till_done(wait_background_tasks=True)
+
+        # Verify ClientSession was created with UnixConnector
+        mock_session_cls.assert_called_once()
+        call_kwargs = mock_session_cls.call_args[1]
+        assert "connector" in call_kwargs
+        connector = call_kwargs["connector"]
+        assert isinstance(connector, UnixConnector)
+        assert connector.path == HA_MANAGED_UNIX_SOCKET
+
+        hass.bus.async_fire(EVENT_HOMEASSISTANT_STOP)
+        await hass.async_block_till_done()
+
+        mock_session.close.assert_called_once()
+
+
+@pytest.mark.usefixtures("rest_client", "server")
+async def test_unix_socket_not_used_for_custom_server(hass: HomeAssistant) -> None:
+    """Test Unix socket is not used for custom go2rtc instances."""
+    config = {DOMAIN: {CONF_URL: "http://localhost:1984/"}}
+
+    with patch(
+        "homeassistant.components.go2rtc.async_get_clientsession"
+    ) as mock_get_session:
+        mock_session = AsyncMock()
+        mock_get_session.return_value = mock_session
+
+        assert await async_setup_component(hass, DOMAIN, config)
+        await hass.async_block_till_done(wait_background_tasks=True)
+
+        # Verify standard clientsession was used, not UnixConnector
+        mock_get_session.assert_called_once_with(hass)

tests/components/go2rtc/test_server.py

@@ -23,9 +23,15 @@ def enable_ui() -> bool:
 
 
 @pytest.fixture
-def server(hass: HomeAssistant, enable_ui: bool) -> Server:
+def mock_session() -> AsyncMock:
+    """Fixture to provide a mock ClientSession."""
+    return AsyncMock()
+
+
+@pytest.fixture
+def server(hass: HomeAssistant, mock_session: AsyncMock, enable_ui: bool) -> Server:
     """Fixture to initialize the Server."""
-    return Server(hass, binary=TEST_BINARY, enable_ui=enable_ui)
+    return Server(hass, binary=TEST_BINARY, session=mock_session, enable_ui=enable_ui)
 
 
 @pytest.fixture