Live preview¶
For a device that serves a media stream, an operator can view low-latency live video directly in the browser, with no extra connection to the device. Live preview reuses the same reverse tunnel the device already holds for control; a cluster-side media relay ingests the device's native stream and republishes it for the browser. It is one capability for media-capable devices, not the platform's focus — devices without a stream simply don't use it.
In-browser preview for media-capable devices¶
Some managed devices — encoders, cameras, streamers — produce a live media stream alongside their control interface. For those devices, live preview lets an authorized operator watch that stream in the browser as sub-second video, without installing a player, opening a device port, or making a second connection to the hardware. The device is still managed like every other IP device: outbound-only tunnel, device shadow, adapters, native GUI access. Preview is an added convenience on top of that, available precisely when a device has a stream to show. A device with no media stream is fully managed without it, and nothing in the platform depends on the preview path existing.
How the media path works¶
Preview is built from three stages that keep the device's exposure unchanged. First, it reuses the device's existing reverse tunnel — the same channel the device already holds for control — so no additional device-side connection is opened. Second, a cluster-side media relay ingests the device's native stream (for example RTSP, RTMP, or HLS) off that tunnel and republishes it as WHEP. Third, the browser establishes a direct WebRTC connection to the relay and renders low-latency video. The device only ever emits its native stream into its own tunnel, exactly as it already does; the relay, running on the cluster, is what adapts that stream into something a browser can play in real time.
Security and failover behavior¶
Live preview inherits the surrounding platform's guarantees rather than adding new exposure. A preview session runs under the device's tenant scope and permissions, so only operators authorized for that device can start one. It adds no inbound exposure to the device: the device still accepts nothing inbound, and the stream leaves only through the tunnel it already maintains. And because the preview rides that tunnel, it follows the device on node failover — if the device's channel moves to another cluster node, the relay follows, and preview continues from the new node. The browser's WebRTC connection is to the cluster relay, never directly to the device, so the device's zero-inbound posture is preserved throughout.
Proportion and dependencies¶
Live preview is intentionally scoped. It applies only to devices that serve a media stream, it occupies one capability page rather than a top-level section, and it changes nothing about how non-media devices are managed. The media relay is described by role — a cluster-side component that ingests and republishes — and preview relies on no separate device connection, no configuration on the device beyond the stream it already produces, and no standing infrastructure that other features depend on. In short, it is a useful mode for the subset of devices that have video to show, kept in proportion to a platform whose job is general remote-device management.