nginx rtmp/hls server setup

auth.lua

-- add users:
-- $ htpasswd -s -c /etc/nginx-rtmp/.htpasswd streamname
-- stream:
-- $ ffmpeg -i foo.mp4 -c copy -f flv rtmp://abc.de/streamname?auth=password

local users = {}
for line in io.lines("/etc/nginx-rtmp/.htpasswd") do
    local user, pass = line:match("([^:]+):{SHA}([^\n]+)")
    users[user] = pass
end

auth = function()
    ngx.req.read_body()
    local args = ngx.req.get_post_args()

    if not users[args.name] or users[args.name] ~= ngx.encode_base64(ngx.sha1_bin(args.auth)) then
        ngx.log(ngx.ERR, string.format("Authentication failed (user %s, pass %s)", args.name or "", args.auth or ""))
        ngx.exit(ngx.HTTP_FORBIDDEN)
    end
end

nginx.conf

user             www;
error_log        /var/log/nginx-rtmp/error.log;
pid              /run/nginx-rtmp.pid;
worker_processes 1;

events {
    worker_connections 1024;
}

rtmp {
    server {
        listen 1935;
        application live {
            live                on;
            hls                 on;
            hls_path            /tmp/hls;
            hls_fragment        10s;
            hls_playlist_length 20s;
            hls_base_url        http://abc.de:1953/hls;
            on_publish          http://abc.de:1953/auth;
            allow play          all;
            wait_key            on;
            wait_video          on;
        }
    }
}

http {
    include          mime.types;
    default_type     application/octet-stream;
    sendfile         on;
    init_by_lua_file /etc/nginx-rtmp/auth.lua;

    server {
        server_name abc.de;
        listen      1953;

        location /hls {
            root       /tmp;
            add_header Cache-Control no-cache;
            add_header Access-Control-Allow-Origin *;
            types {
                application/vnd.apple.mpegurl m3u8;
                video/mp2t                    ts;
            }
        }

        location /auth {
            content_by_lua_block {
                return auth()
            }
        }
    }
}

setup.sh

./configure --prefix=/usr/local/share/nginx-rtmp --sbin-path=/usr/local/bin/nginx-rtmp \
  --conf-path=/etc/nginx-rtmp/nginx.conf --error-log-path=/var/log/nginx-rtmp/error.log \
  --http-log-path=/var/log/nginx-rtmp/access.log --pid-path=/run/nginx-rtmp.pid \
  --lock-path=/run/nginx-rtmp.lock --user=www --group=www --without-http_charset_module \
  --without-http_gzip_module --without-http_ssi_module --without-http_userid_module \
  --without-http_access_module --without-http_auth_basic_module --without-http_autoindex_module \
  --without-http_geo_module --without-http_map_module --without-http_split_clients_module \
  --without-http_referer_module --without-http_rewrite_module --without-http_proxy_module \
  --without-http_fastcgi_module --without-http_uwsgi_module --without-http_scgi_module \
  --without-http_memcached_module --without-http_limit_conn_module --without-http_limit_req_module \
  --without-http_empty_gif_module --without-http_browser_module --without-http_upstream_hash_module \
  --without-http_upstream_ip_hash_module --without-http_upstream_least_conn_module \
  --without-http_upstream_keepalive_module --without-http_upstream_zone_module \
  --add-module=modules/rtmp --add-module=modules/lua