Generated configs out of the repo: *.example.* templates only; configure.py refuses to apply over CHANGEME placeholders

A deploy copied mediamtx.yml (template) over the server's generated file and the next apply
wiped all streamers. Generated files are now gitignored so scp -r cannot clobber them.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.gitignore

@@ -5,3 +5,8 @@ __pycache__/
 bot/app/__pycache__/
 *.pyc
 streamers.json
+# generated by configure.py on the server — never commit or scp these
+mediamtx.yml
+copyparty.conf
+Caddyfile
+dump-users.txt

README.md

@@ -35,6 +35,12 @@ works from ~/vanguard-stream without sudo.
 
 ## 3. Configure (domain, admin, streamers, editors)
 
+> `mediamtx.yml`, `copyparty.conf`, `Caddyfile`, `dump-users.txt` and `.env` are **generated on the server**
+> by `configure.py` and gitignored. The `*.example.*` files in the repo are reference only. **Never copy them
+> to the server**: doing so once replaced the live streamer passwords with `CHANGEME` and the next apply
+> wiped the streamers. To update the server, copy scripts (`configure.py`, `bin/`, `docker-compose.yml`, …)
+> and re-run `./configure.py`.
+
     cd ~/vanguard-stream
     ./configure.py --full      # first time: asks everything, then applies
     ./configure.py             # later: add/remove/reset streamers and editors, then apply

authentik/discord-roles-to-groups.py

@@ -6,12 +6,13 @@
 # The Authentik groups must already exist (Directory -> Groups). Role IDs: Discord Developer Mode ->
 #   Server Settings -> Roles -> right-click a role -> Copy Role ID.
 
-GUILD_ID = "000000000000000000"                         # <- your Discord server ID
+GUILD_ID = "1387203044084551690"                         # <- your Discord server ID
 ROLE_TO_GROUP = {                                       # <- Discord role id : Authentik group name
-    "111111111111111111": "bot-users",
-    "222222222222222222": "streamers",
-    "333333333333333333": "editors",
-    "444444444444444444": "admins",
+    "1387239222070612110": "bot-users",
+    "1515901670943490129": "bot-users",
+#    "222222222222222222": "streamers",
+#    "333333333333333333": "editors",
+#    "444444444444444444": "admins",
 }
 
 from authentik.core.models import Group

configure.py

@@ -8,6 +8,8 @@
                                       used by addCommunityMediaServer.sh)
 
 Reads  : Caddyfile (hostnames), mediamtx.yml (streamers), copyparty.conf (editors + admin), .env
+         (these are GENERATED on the server and gitignored; *.example.* in the repo are reference only —
+          never scp them over the live ones: that is how streamers got wiped once)
 Writes : Caddyfile, mediamtx.yml, copyparty.conf, dump-users.txt -> /etc/vanguard, .env (generated secrets +
          Discord bot token/guild), folders, restarts
 Set VG_DRY=1 to write files only (no sudo / docker / folders).
@@ -398,6 +400,10 @@ def run(cmd, **kw):
     return subprocess.call(cmd, **kw)
 
 def apply(domain, admin_pw, streamers, editors, auth_host="", watch_host="", discord_token=None, discord_guild=None, git_host="", bot_host="", live_host="", live_webhook=None):
+    if not streamers and Path("mediamtx.yml").exists() and "CHANGEME" in Path("mediamtx.yml").read_text():
+        print("\n!! mediamtx.yml contains CHANGEME placeholders — it looks like the repo template was copied over the")
+        print("   generated config. Applying now would leave NO streamers (OBS ingest and the dump button stop working).")
+        if not yes("   continue anyway?", False): print("aborted; add streamers first ([s] in the menu)"); sys.exit(1)
     print("\n== writing configs")
     write_env(watch_host, discord_token, discord_guild, git_host, bot_host, live_host, domain, live_webhook)
     write_caddy(domain, auth_host, watch_host, git_host, bot_host, live_host); write_mediamtx(streamers); write_copyparty(admin_pw, editors); write_dump_users(admin_pw, streamers); write_streamers_json(streamers)