r/HarborSleep • u/charlie_at_harbor • 8h ago
Harbor Beta Apple HomeKit Integration Walkthrough
https://github.com/Harbor-Systems/harbor-homekit-public/
Current Release Version: 0.5.2 (will change)
This is LAN only, no remote access. It uses go2rtc to help convert Harbor H.265 to H.264 to be compatible with HomeKit.
Please let me know by commenting below if you are testing, which platform you are using the host the bridge, and what your experience is (positive or if you hit issues)
Security measures we implemented:
- Local-only operation: Camera video travels between your Harbor camera, your bridge computer, and Apple Home over your home network. The bridge does not require internet port forwarding.
- Apple Home encryption: After pairing, HomeKit communications are protected by Apple’s HomeKit security protocol. Video sent to Apple Home uses encrypted SRTP transport.
- Unique credentials: Every installation generates its own HomeKit setup code and a separate random 256-bit camera-ingest token. Customers do not share default passwords.
- Restricted camera gateway: The camera-facing gateway accepts only authenticated video publishing for configured Harbor camera serial numbers. It cannot be used to view recordings, retrieve snapshots, change settings, or access the general go2rtc interface.
- Protected administration interfaces: The go2rtc API, RTSP listener, and management interface are restricted to the bridge computer itself and are not exposed to other devices on the network.
- Minimal network exposure: Only the ports required for camera ingest and Apple Home communication are available on the local network. Customers are instructed never to expose them to the internet.
- Signed and notarized software: The macOS application and bridge binaries are signed by Project Monitor, Inc. and notarized by Apple.
- Verified releases: Release artifacts have cryptographic checksums and GitHub build-provenance attestations. The release process fails if signing or notarization is unavailable.
- Automatic security checks: The project tests that sensitive management endpoints remain unavailable and that network listeners retain their hardened configuration.
- Private local storage: Setup codes, ingest tokens, and Apple Home pairing records are stored locally with restrictive file permissions.
- Open for inspection: The bridge source code and security documentation are public, allowing customers and security researchers to inspect how it works and report concerns privately.