MTX_WEBRTCADDITIONALHOSTS (the ICE host candidate MediaMTX advertises
for WebRTC/WHIP) was wired to PUBLIC_HOST, the Cloudflare-proxied
domain. The WHIP HTTP handshake (SDP offer/answer through nginx) still
succeeds through Cloudflare, so 'stream from this browser' looks like
it works — but the actual media is a raw UDP path (port 8189) that
Cloudflare never forwards regardless of port, same as the earlier RTMP
issue. The browser ends up trying to send video/audio to Cloudflare's
edge, which drops it, so nothing ever actually arrives.
Split into a dedicated MEDIAMTX_WEBRTC_HOST env var (raw origin IP in
production) instead of reusing PUBLIC_HOST, mirroring how
MEDIAMTX_RTMP_PUBLIC already does this for the same reason. Confirmed
via podman inspect that the previously-deployed container really was
resolving MTX_WEBRTCADDITIONALHOSTS to the Cloudflare-proxied hostname
before this fix.
ssmithx
2f3a489a8a