feat: Implement Nginx for HLS stream serving with optimized caching and updated application performance settings.

Author: CodeByAmrit

app.js

@@ -39,16 +39,25 @@ app.locals.appVersion = process.env.APP_VERSION || `v${pkg.version}`;
 
 // =================== Security & Middleware ===================
 
+// Disable ETag to reduce server overhead
+app.set("etag", false);
+
+// Global connection optimization
+app.use((req, res, next) => {
+  res.setHeader("Connection", "keep-alive");
+  next();
+});
+
 // =================== Global Performance & Security ===================
 app.use(compression()); // Compress all responses
 
 // Optimize nonce generation: Only for HTML/EJS requests to reduce crypto overhead
 app.use((req, res, next) => {
-  const isHtml = req.accepts('html');
+  const isHtml = req.accepts("html");
   if (isHtml) {
     res.locals.nonce = crypto.randomBytes(16).toString("base64");
   } else {
-    res.locals.nonce = '';
+    res.locals.nonce = "";
   }
   next();
 });
@@ -70,15 +79,19 @@ const CACHE_DURATION = 30000; // 30 seconds
 app.use(async (req, res, next) => {
   try {
     // Only fetch for pages that might render the navbar
-    if (req.method === 'GET' && !req.path.startsWith('/api/') && !req.path.startsWith('/public/dvr/')) {
-       const now = Date.now();
-       if (!cachedActivities || (now - lastFetchTime > CACHE_DURATION)) {
-         cachedActivities = await getRecentActivities(5);
-         lastFetchTime = now;
-       }
-       res.locals.recentActivities = cachedActivities;
+    if (
+      req.method === "GET" &&
+      !req.path.startsWith("/api/") &&
+      !req.path.startsWith("/public/dvr/")
+    ) {
+      const now = Date.now();
+      if (!cachedActivities || now - lastFetchTime > CACHE_DURATION) {
+        cachedActivities = await getRecentActivities(5);
+        lastFetchTime = now;
+      }
+      res.locals.recentActivities = cachedActivities;
     }
-  } catch(err) {
+  } catch (err) {
     res.locals.recentActivities = [];
   }
   next();
@@ -90,7 +103,7 @@ const skipVideo = (req, res) => {
 
 app.use(
   morgan(
-    process.env.NODE_ENV === "production" ? "combined" : "dev", // Use faster 'combined' or 'tiny' in prod
+    process.env.NODE_ENV === "production" ? "tiny" : "dev", // Use faster 'tiny' in prod
     {
       skip: skipVideo,
       stream: {
@@ -116,7 +129,7 @@ app.use(
           "'self'",
           "https://cdn.jsdelivr.net",
           "https://cdnjs.cloudflare.com",
-          (req, res) => res.locals.nonce ? `'nonce-${res.locals.nonce}'` : '',
+          (req, res) => (res.locals.nonce ? `'nonce-${res.locals.nonce}'` : ""),
         ].filter(Boolean),
         "worker-src": ["'self'", "blob:"],
         "style-src": [
@@ -157,8 +170,8 @@ app.use(
   })
 );
 
-app.use(express.json({ limit: "10mb" }));
-app.use(express.urlencoded({ extended: true, limit: "10mb" }));
+app.use(express.json({ limit: "1mb" }));
+app.use(express.urlencoded({ extended: true, limit: "1mb" }));
 app.use(cookieParser());
 
 // CSRF Protection Initialization (Cookie-based)
@@ -213,29 +226,26 @@ app.use(
   "/hls",
   express.static(streamDir, {
     setHeaders: (res, filePath) => {
-      // Prevent caching of HLS files to avoid stale footage
-      res.setHeader("Cache-Control", "no-store, no-cache, must-revalidate, proxy-revalidate");
-      res.setHeader("Pragma", "no-cache");
-      res.setHeader("Expires", "0");
-      res.setHeader("Surrogate-Control", "no-store");
-
       if (filePath.endsWith(".m3u8")) {
+        res.setHeader("Cache-Control", "no-cache");
         res.setHeader("Content-Type", "application/vnd.apple.mpegurl");
       } else if (filePath.endsWith(".ts")) {
+        res.setHeader("Cache-Control", "public, max-age=60");
         res.setHeader("Content-Type", "video/mp2t");
       }
     },
   })
 );
 
-// =================== Disable HLS Cache ===================
+// =================== Optimal HLS Caching strategy ===================
 app.use(
   "/streams",
   (req, res, next) => {
-    res.setHeader("Cache-Control", "no-store, no-cache, must-revalidate, proxy-revalidate");
-    res.setHeader("Pragma", "no-cache");
-    res.setHeader("Expires", "0");
-    res.setHeader("Surrogate-Control", "no-store");
+    if (req.path.endsWith(".m3u8")) {
+      res.setHeader("Cache-Control", "no-cache");
+    } else if (req.path.endsWith(".ts")) {
+      res.setHeader("Cache-Control", "public, max-age=60");
+    }
     next();
   },
   express.static(path.join(__dirname, "public", "streams"))
@@ -245,8 +255,10 @@ app.use(
 app.use(publicRoutes);
 
 // 2. Specific Security Middleware for Admin/API
-// Apply CSRF protection to routes that render forms or handle POSTs
 app.use("/", (req, res, next) => {
+  if (["GET", "HEAD", "OPTIONS"].includes(req.method)) {
+    return next();
+  }
   // Skip CSRF for purely public streaming APIs if they are GET only
   if (req.path.startsWith("/api/public") && req.method === "GET") {
     return next();
@@ -275,7 +287,7 @@ app.use((req, res, next) => {
 
 // 3. Admin/Protected Routes
 // Note: Sensitive rate limiting is now applied inside userRouter specifically for login/password
-app.use("/", userRouter); 
+app.use("/", userRouter);
 app.use("/camera", checkAuth, cameraRoutes);
 app.use("/dvr", checkAuth, dvrRoutes);
 app.use(settingsRoutes);
@@ -298,7 +310,6 @@ app.post("/api/start-stream", async (req, res) => {
   }
 });
 
-
 app.post("/api/stop-stream", (req, res) => {
   const { rtspUrl } = req.body;
   if (!rtspUrl) return res.status(400).json({ error: "Missing RTSP URL" });
@@ -340,10 +351,6 @@ app.get("/api/public/camera/:id/hls", async (req, res) => {
   }
 });
 
-
-
-
-
 // =================== Start Server ===================
 const server = http.createServer(app);
 
@@ -364,7 +371,7 @@ const gracefulShutdown = () => {
     logger.info("HTTP server closed.");
     process.exit(0);
   });
-  
+
   // Force exit if server doesn't close in 5 seconds
   setTimeout(() => {
     logger.error("Could not close connections in time, forcefully shutting down");

docker-compose.yaml

@@ -26,6 +26,25 @@ services:
       - "traefik.http.routers.streamvision.tls.certresolver=letsencrypt"
       - "traefik.http.services.streamvision.loadbalancer.server.port=3000"
 
+  nginx_hls:
+    image: nginx:alpine
+    container_name: nginx_hls
+    restart: unless-stopped
+    volumes:
+      - ./streams:/usr/share/nginx/html/hls:ro
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.nginx-hls.rule=Host(`cctvcameralive.in`) && PathPrefix(`/hls`)"
+      - "traefik.http.routers.nginx-hls.priority=20"
+      - "traefik.http.routers.nginx-hls.entrypoints=websecure"
+      - "traefik.http.routers.nginx-hls.tls.certresolver=letsencrypt"
+      - "traefik.http.middlewares.hls-headers.headers.customResponseHeaders.Access-Control-Allow-Origin=*"
+      - "traefik.http.routers.nginx-hls.middlewares=hls-headers"
+      - "traefik.http.services.nginx-hls.loadbalancer.server.port=80"
+
 
 networks:
 

nginx.conf

@@ -0,0 +1,55 @@
+server {
+    listen 80;
+    server_name _;
+
+    # TCP / Connection optimization
+    keepalive_timeout 65;
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+
+    # GZIP compression for playlists
+    gzip on;
+    gzip_types application/vnd.apple.mpegurl;
+
+    # Directory mapping: ./streams mounted to /usr/share/nginx/html/hls
+    root /usr/share/nginx/html;
+
+    # Handle CORS for video chunks
+    add_header Access-Control-Allow-Origin *;
+
+    # Serve bulky .ts chunks directly from Nginx avoiding Node JS single thread
+    location ~ \.ts$ {
+        expires 60s;
+        add_header Cache-Control "public, max-age=60";
+        add_header Access-Control-Allow-Origin *;
+        types {
+            video/mp2t ts;
+        }
+        try_files $uri =404;
+    }
+
+    # Proxy lightweight .m3u8 playlists back to Express
+    # Ensures Express heartbeat middleware keeps streams alive
+    location ~ \.m3u8$ {
+        proxy_pass http://streamvision_app:3000;
+        
+        # Explicit cache and CORS headers for proxy
+        add_header Cache-Control "no-cache";
+        add_header Access-Control-Allow-Origin *;
+        
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Proxy anything else routed to this container back to Express just in case
+    location / {
+        proxy_pass http://streamvision_app:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}