Confused on how to stream HTTP without HTSP access, through reverse proxy.

Backin69

Hi All,

So my original plan of using a reverse proxy to stream both a HD and a mobile stream have become a bit confusing.

I'm going to leave HTSP alone for a minute, as I have a backup plan for this and don't want to confuse things further. I also read a recent post on this forum explaining why that won't work.

I have a reverse proxy setup that is running port 9981 through to another machine and serving it on 443 with SSL enabled. This works to the extent I can log in and everything and that's all good.
Now the issue I have is that I can't seem to get any app to actually get logged in here and download a playlist/EPG. All the errors are opaque and offer no assistance in tracing the actual problem.

What is the correct method here to actually make this work? Presumably this an "IPTV" log in and should just work?

Any of the android players for TVHeadend all want the HTSP port, so they're immediately out.

The only player that can get to work is "Sparkle TV", however the user needs admin access for this to work otherwise they'll get a forbidden error! What is this about?

As you can see I'm very confused here and I'm not trying to do anything to complicated. Just think I need a nudge in the correct direction.

Backin69

OK, major correction to the above.

Sparkle doesn't need admin access to work. It needs the web interface enabled, which makes sense.

Backin69

Tried a few different players. Dream player for TVHeadend does get the EPG data and get logged in. However it can't play any streams. It doesn't specify, but I'll guess since it's for TVHeadend specifically, it's probably trying the HTSP port...

Dream player for IPTV doesn't have HTTP auth for the M3U list, so I can't use that to load channels.

I actually feel like the issue I'm having is just that I can't find a player that does HTTP auth and supports M3U lists...

ukn_unknown

Backin69 maybe you have to reevaluate the encryption scheme.
Alternative options:

tunneling over SSH. I never did a connection from mobile to server, but I assume is possible. You can tunnel any ports you like (including 9981 and 9982). This is recommended if you have access to server WAN ip from outside (not behind a NAT from your ISP).
VPN (like https://tailscale.com/use-cases/remote-access), personally I connected from windows to server, but I assume they have an option for mobile access. Recommended if your server is not accessible from outside (when your ISP making a NAT ... like when you use internet connection over cell-data for your server).

Backin69

ukn_unknown

Appreciate the suggestions. I actually already have a VPN on that machine, so could access it that way. However the proxy is more than just an access related requirement, it's fulfilling other needs as well.

DeltaMikeCharlie

I actually came across that last night, and that has actually resolved issues with downloading the XMLTV and M3U files!

However, I still ahven't found a player other than Sparkle that support HTTPS auth, so I'm still stuck!

Summary after all my fumbling about:
I actually have what I need to work, working. However to actually use it, I need to find an Android player that supports HTTPS and one of TVHeadends provided formats like the M3U file over HTTPS.

The only player that has worked so far is Sparkle and that's just not suitable for touch screen devices.

DeltaMikeCharlie

Maybe this could be helpful. It's on a different topic, but some parts could still be applicable.

https://docs.tvheadend.org/documentation/https-access-via-reverse-proxy

DeltaMikeCharlie

Backin69 Sparkle and that's just not suitable for touch screen devices.

Have you tried Kodi with 'touch mode' enabled on the Estuary skin?

The pvr.hts addon is used to connect to TVH. It has a connection HTTPS option.

Backin69

DeltaMikeCharlie

Unfortunatly from the GIT from pvr.hts:

"kodi-pvr/pvr.hts: Kodi's Tvheadend HTSP client addon"

Anything that has been designed for TVHeadend specifically is going to use the HTSP port, not the HTTP(S) port.

DeltaMikeCharlie

Backin69 Anything that has been designed for TVHeadend specifically is going to use the HTSP port, not the HTTP(S) port.

Backin69

DeltaMikeCharlie

Yup, so that's https for log in on the http port and will allow you to download the epg etc, it will still use HTSP for the video stream when you try to play it.

Backin69

I've actually managed to get the m3u downloading from a web browser without tripping auth and using:

https://USERNAME:PASSWORD@TVHeadend.URL:9981

However I don't know if that's the browser allowing that or if it's being passed back in plain text...

Backin69

Just to correct that since I can't seem to edit it. I meant to write:

https://USERNAME:PASSWORD@TVHeadend.URL:9981/playlist/channels.m3u

Now. I've gotten a bit further in that I can generate an m3u with this. The next issue is that it's missing the actual domain string and I can't seem to find where to change it... So in the M3u the channels are missing the domain like so:
https:///stream/channelid/32020664?profile=MobileStream

I know someone is going to point me towards this:


The public-facing host name, port number and path returned by TVH within documents such as an M3U can also be modified.  As TVH only recognises the X-Forwarded-Host:header when the Host:header is not present, it is recommended that only the Host:header be modified by the proxy in for following format:

Host: <External host>[:<External port>][/<External path>]```

However I don't really understand what it's saying.

Backin69

Well the formatting on that got fairly messed up.

The proxy server is *ALREADY telling TVHeadend that it needs to return a HTTPs link. What it needs is the host ONLY to be added. I was trying to do both.

Tony Wagner

On iOS/tvOS, you can use TvhClient. It can ignore HTSP and stream over HTTP. (There’s an Android app with the same name but it is unrelated and appears to require HTSP).

Tony Wagner

If you want to avoid having your username/password in the URL, you can generate a persistent auth token instead.

Then just add it as a parameter in your URL. This is how I stream a channel with it:
https://my.domain.name/tvheadend/stream/channelid/1234567890?profile=pass&auth=mypersistentauthtoken

Backin69

Tony Wagner

THat's actually a great bit of advice Tony thanks.

I'm nearly there with the proxy stuff. I'm just stuck on getting the header to TVH right so it sends back the correct URL on the M3U. I'll say I'll get it.

Backin69

I actually have the m3u file being generate now correctly by tv headend and the log in working.
HOWEVER. I didn't think that of course the stream link doesn't have the username and password.

Must see if TVheadend can add the persistent log in to the m3u.

Backin69

Oh I have it! You just add in auth before the chanels part of the playlist request!!! Nice.

DeltaMikeCharlie

Backin69 Oh I have it!

Wonderful news. When you have a moment, would you consider making a post that consolidates and summarises all of the proxy settings and URL tweaks in your solution? This could be helpful to future users.

Backin69

DeltaMikeCharlie

I detest people who don't don't write down what fixed a problem in forums, but in this case I'll probably do more harm than good as I was chopping and changing everything to make this work, so I'll just put down some bullet points on streaming over HTTP and ignoring HTSP over a HTTP reverse proxy.
Might be some use to some people.

Your reverse proxy needs to set the "x-forwarded-for:" thingy in the header to HTTPS if it supports it. Most do this by default.
You need to set your reverse proxy to send the "HOST" variable in the header. This is the link where you'll find the TV headend "base" URL. This gets passed back to TVHeadend so it can format the playlist M3U correctly.
When getting the M3U, most simple IPTV players do not support HTTP auth. We can bypass this by adding the username and password into the URL for grabbing the stream.
Putting in /auth/ as part of the api call for the M3U file will tell TVHeadend to put an auth token at the end of all your stream links, meaning your user:pass link will only be used initially (you can probably bypass this with an auth token, but these expire).
To request the full channel list, the URL is in this format:
USERNAME:PASSWORD@MyProxyURL.com/playlist/auth/channels.m3u
Similarly the EPG data in XML format is:
USERNAME:PASSWORD@MyProxyURL.com/xmltv/channels
Don't even bother trying to get a player working on a device until you have the above passing you back the correct M3U file for playing a stream. Verify it on a computer with VLC or something. You should be able to copy the link out of the M3U file and just play it directly.
When looking for a player, just ignore any that are specifically made for TVHeadend. These ALL use the HTSP port which will not work over a HTTP proxy. I've only had this all working an hour, so I can't say if I'll stick with it, but Dream player IPTV is working fine. (note: NOT Dream Player TVHeadend).

If I think of any other general pitfalls I fell through I'll post them here. I would write a full guide, but as I said, I fumbled through this so much I feel I'd get too much wrong.

Thanks for everyones help!