Static allow/deny chain. IPs accept exact addresses or CIDR ranges;
Countries are ISO 3166-1 alpha-2 codes (need a GeoIP DB — see
SessionsConfig.GeoIPDBPath); UserAgents match case-insensitive substring;
AllowedDomains match the Referer host (exact or parent domain).
allow_user_agentsstring[]
allowed_domainsstring[]
codestring
Code is the unique key chosen by the operator.
deny_countriesstring[]
deny_ipsstring[]
deny_user_agentsstring[]
descriptionstring
namestring
Name and Description are operator-facing metadata.
require_tokenboolean
RequireToken makes a valid signed playback token mandatory. The server
only VERIFIES tokens; clients mint them with TokenSecret — see
internal/mediaauth.SignToken for the canonical token format.
token_secretstring
TokenSecret is this policy's HMAC-SHA256 verification key. Required when
RequireToken is true. Each policy owns its own secret so revoking one
policy's key never affects another.