bunch of shit

docker-compose.yml

@@ -15,15 +15,13 @@ services:
       TZ: America/New_York          # recording filenames are stamped in the container's clock; must match the host
       LIVE_WEBHOOK_URL: ${LIVE_WEBHOOK_URL:-}
       LIVE_HOST: ${LIVE_HOST:-live.example.com}
-    ports:
-      - "1935:1935"              # RTMP ingest
-      - "8890:8890/udp"          # SRT ingest
-      - "8189:8189/udp"          # WebRTC media (viewers + Go Live)
-      - "8189:8189/tcp"          # WebRTC ICE-TCP fallback
-      - "127.0.0.1:8888:8888"    # HLS      -> Caddy live.HOST/hls/*
-      - "127.0.0.1:8889:8889"    # WebRTC   -> Caddy live.HOST/webrtc/*
-      - "127.0.0.1:9997:9997"    # API      -> Caddy live.HOST/api/*
-      - "127.0.0.1:9998:9998"    # Prometheus metrics (per-stream bitrate, readers, drops) -> scraper on the host
+    # Host network, as MediaMTX recommends for WebRTC. On the bridge, every WebRTC media packet on 8189/udp
+    # was relayed by Docker's userland proxy (docker-proxy), which lost ~0.4% of them at a thousand packets a
+    # second; each loss corrupted an access unit, the recorder reopened its file, and one evening produced 471
+    # fragments. Publishers also all appeared as the bridge gateway (172.18.0.1). Now MediaMTX binds the host
+    # directly: ingest ports (1935, 8890/udp, 8189) are open in the nftables INPUT chain, and everything Caddy
+    # or Metricbeat talks to is bound to 127.0.0.1 in mediamtx.yml. No ports: block, nothing to publish.
+    network_mode: host
     volumes:
       - ./mediamtx.yml:/mediamtx.yml:ro
       - ./bin/mtx-on-ready.sh:/vanguard/on-ready.sh:ro   # is-live notice + WebRTC audio mirror (runOnReady)
@@ -72,7 +70,7 @@ services:
       - ./dock:/srv/dock:ro
       - ./clips:/srv/clips:ro               # clip-intake self-service page
       - ./about:/srv/about:ro               # gateway page (/about)
-      - ./stuck:/srv/stuck:ro               # stuck-recording triage page (main host /stuck)
+      - ./streaming:/srv/streaming:ro       # Live + Stuck tabs (diag host /streaming)
       - /srv/live:/srv/live:ro              # live portal static build (deployLive.sh)
       - caddy_data:/data
       - caddy_config:/config