From 25e9078d9b3d08b9f1783b783d749932cc69a738 Mon Sep 17 00:00:00 2001 From: Brandyn / Techy Date: Mon, 2 Nov 2026 21:58:34 -0600 Subject: [PATCH] Drop the last references to the bot's code living in this repo switchToClone no longer tries to carry bot/app across a clone, and the compose comment, STATUS row, README and the plan doc all describe the installed-release model instead. Co-Authored-By: Claude Opus 5 (1M context) --- CommunityDiscordMedia.md | 7 ++++--- README.md | 2 +- STATUS.md | 1 - docker-compose.yml | 2 +- switchToClone.sh | 4 ++-- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/CommunityDiscordMedia.md b/CommunityDiscordMedia.md index bfb2153..b57b55a 100644 --- a/CommunityDiscordMedia.md +++ b/CommunityDiscordMedia.md @@ -21,7 +21,7 @@ Bundle: `vanguard-stream/` in this repo; live copy at `~/vanguard-stream` on the | Authentik (Discord login, groups) at `auth.` | live | | Jellyfin at `watch.`, SSO via Authentik, direct play only | live | | Vanguard Metadata plugin v0.1 | installed, libraries being switched to Shows | -| MariaDB (bot database) + `discord-bot` Python container (`bot/app`) | **in bundle, not yet applied** | +| MariaDB (bot database) + `discord-bot` Python container (release installed in `/srv/bot/app`) | live; first release pending | | Gitea (`git.`, MariaDB, ssh 2222) + Actions runner | live (local admin account; Authentik OIDC → Phase 10) | ## Decisions already made @@ -223,7 +223,8 @@ Checklist: ### Discord bot (separate dev) — runtime provided by the stack - `mariadb` container, db `vanguardbot` / user `bot`, loopback only (ssh tunnel for dev access) -- `discord-bot` container: python 3.12 + ffmpeg + yt-dlp baseline; code bind-mounted from `bot/app/`; +- `discord-bot` container: python 3.12 + ffmpeg + curl, and no bot dependencies — its CI builds a release + bundle (code + `vendor/` wheels) that dumpd installs into `/srv/bot/app`, bind-mounted at `/app`; env gives token, guild, DB creds, rw `/media/clips`, `/data` scratch; restarts on exit - web UI at `bot.` behind Caddy + Authentik forward-auth (first use of the forward-auth pattern that Phase 5 applies to copyparty); the bot trusts `X-Authentik-*` headers and implements no login @@ -232,7 +233,7 @@ Checklist: - [ ] CNAME `bot` → main host; `configure.py --full` (asks the hostname, bot token + guild) → `docker compose up -d --build` - [ ] Authentik: domain-level Proxy Provider (covers live/bot/main); Caddy requires group `bot-users` on the bot host (`BOT_REQUIRE_GROUP`) - [ ] Discord roles → Authentik groups: `authentik/discord-roles-to-groups.py` on both source flows (scope `guilds.members.read`) -- [ ] dev drops `main.py` into `bot/app/` → `docker compose restart discord-bot` +- [x] the bot repo's CI builds a release bundle and a push to `main` installs it (signed, via dumpd `/deploy-bot`) ### Phase 9 — Gitea + Actions runner - `gitea` on MariaDB (db/user from `mariadb/init/10-gitea.sh` on first init, else `./createGiteaDb.sh`), diff --git a/README.md b/README.md index e32b47b..5da1397 100644 --- a/README.md +++ b/README.md @@ -523,7 +523,7 @@ Then switch the server folder to a clone (two steps): # Gitea → repo → Settings → Deploy Keys → add it, read-only ssh -t debian@HOST 'cd ~/vanguard-stream && ./switchToClone.sh clone && cd ~/vanguard-stream && ./configure.py --apply >/dev/null && sudo vanguard-deploy status' -`switchToClone.sh clone` keeps `.env`, the generated configs, the token secret, plugin zips and `bot/app`, and +`switchToClone.sh clone` keeps `.env`, the generated configs, the token secret and plugin zips, and leaves the old copy at `~/vanguard-stream.old` until you delete it. From here on a manual deploy is `sudo vanguard-deploy pull` on the server. diff --git a/STATUS.md b/STATUS.md index cb4d32f..b061b22 100644 --- a/STATUS.md +++ b/STATUS.md @@ -67,7 +67,6 @@ Source of truth: this repo, `techy/Media-Server-Setup` on the stack's own Gitea | MariaDB | databases for the bot and Gitea; public :3306, root local-only | live | | Gitea | git hosting on MariaDB, Actions enabled; holds this repo | live; Discord login via Authentik OIDC **verified**; access = `git-users`/`git-admins` groups; local admin as fallback | | act_runner | CI jobs in Docker | **not registered** | -| discord-bot | Python runtime, idles until `bot/app/main.py` exists | live, no code yet | | `bot.` host + Discord bot | the bot's API **and** its web pages on one port (`WEB_SERVE_UI`), behind Authentik forward-auth; Caddy requires `bot-users`, the bot re-checks `bot-users,admins` per request | a push to `main` deploys itself: CI builds a **release bundle** (app + `vendor/` dependencies) and posts it signed to dumpd `POST /deploy-bot` (bridge-only port, no Docker socket in CI) together with the bot's own secrets, which are managed in Gitea; dumpd verifies everything, writes the keys `BOT_ENV_KEYS` allows into `.env` and swaps the bundle into `/srv/bot/app` → `/app`; image installs no bot dependencies | **reviewed + wired 2026-11-02, first install pending** (needs the Authentik app for `bot.`, and `BOT_DEPLOY_SECRET` + `DISCORD_BOT_TOKEN` + `DISCORD_GUILD_ID` set in Gitea) | | Live portal (`live/`, `live.` host) | React + dockview multi-stream viewer + browser Go Live (WHIP); MediaMTX HLS/WebRTC/API on loopback; dumpd `/me/stream-key` | live; Go Live verified | diff --git a/docker-compose.yml b/docker-compose.yml index 9a7c8b1..0745c82 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -199,7 +199,7 @@ services: start_period: 30s restart: unless-stopped - # ---------------------------------------------------------------- Discord bot (python; code lives in ./bot/app) + # ------------------------------------------- Discord bot (python; its release is installed in /srv/bot/app) discord-bot: logging: *vglog labels: { vanguard.service: discord-bot, vanguard.category: bot } diff --git a/switchToClone.sh b/switchToClone.sh index ed43ec1..329b4f3 100755 --- a/switchToClone.sh +++ b/switchToClone.sh @@ -24,9 +24,9 @@ CFG git clone --quiet "$REPO_SSH" "$DIR" for f in .env Caddyfile mediamtx.yml copyparty.conf stream-token.secret deploy.env; do [[ -f $DIR.old/$f ]] && cp -a "$DIR.old/$f" "$DIR/$f"; done mkdir -p "$DIR/jellyfin-plugin-vanguard/dist"; cp -a "$DIR.old"/jellyfin-plugin-vanguard/dist/*.zip "$DIR/jellyfin-plugin-vanguard/dist/" 2>/dev/null || true - [[ -d $DIR.old/bot/app ]] && cp -a "$DIR.old/bot/app/." "$DIR/bot/app/" 2>/dev/null || true ( cd "$DIR" && sudo -n true 2>/dev/null && sudo install -m 0600 -o root -g root .env /dev/null >/dev/null 2>&1 || true ) - echo "cloned. kept: .env, generated configs, plugin zips, bot/app. Old copy at $DIR.old (delete when happy)." + echo "cloned. kept: .env, generated configs, plugin zips. Old copy at $DIR.old (delete when happy)." + echo " (the Discord bot is not in this repo: its release lives in /srv/bot/app and is untouched by this)" echo "next: cd $DIR && ./configure.py --apply (records nothing new; just confirms generation works from the clone)" echo " then: sudo vanguard-deploy status" ;; *) sed -n '2,5p' "$0"; exit 2 ;;