From b2869c374068f1cf68e5af97278547fcbfbb8262 Mon Sep 17 00:00:00 2001
From: Brandyn / Techy <brandynabel@gmail.com>
Date: Sat, 31 Oct 2026 00:32:30 -0500
Subject: [PATCH] Generated configs out of the repo: *.example.* templates
 only; configure.py refuses to apply over CHANGEME placeholders

A deploy copied mediamtx.yml (template) over the server's generated file and the next apply
wiped all streamers. Generated files are now gitignored so scp -r cannot clobber them.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .gitignore                               |  5 +++++
 Caddyfile => Caddyfile.example           |  0
 README.md                                |  6 ++++++
 authentik/discord-roles-to-groups.py     | 11 ++++++-----
 configure.py                             |  6 ++++++
 copyparty.conf => copyparty.example.conf |  0
 dump-users.txt => dump-users.example.txt |  0
 mediamtx.yml => mediamtx.example.yml     |  0
 8 files changed, 23 insertions(+), 5 deletions(-)
 rename Caddyfile => Caddyfile.example (100%)
 rename copyparty.conf => copyparty.example.conf (100%)
 rename dump-users.txt => dump-users.example.txt (100%)
 rename mediamtx.yml => mediamtx.example.yml (100%)

diff --git a/.gitignore b/.gitignore
index d34d566..2ab5733 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,8 @@ __pycache__/
 bot/app/__pycache__/
 *.pyc
 streamers.json
+# generated by configure.py on the server — never commit or scp these
+mediamtx.yml
+copyparty.conf
+Caddyfile
+dump-users.txt
diff --git a/Caddyfile b/Caddyfile.example
similarity index 100%
rename from Caddyfile
rename to Caddyfile.example
diff --git a/README.md b/README.md
index b105ea2..3df43e3 100644
--- a/README.md
+++ b/README.md
@@ -35,6 +35,12 @@ works from ~/vanguard-stream without sudo.
 
 ## 3. Configure (domain, admin, streamers, editors)
 
+> `mediamtx.yml`, `copyparty.conf`, `Caddyfile`, `dump-users.txt` and `.env` are **generated on the server**
+> by `configure.py` and gitignored. The `*.example.*` files in the repo are reference only. **Never copy them
+> to the server**: doing so once replaced the live streamer passwords with `CHANGEME` and the next apply
+> wiped the streamers. To update the server, copy scripts (`configure.py`, `bin/`, `docker-compose.yml`, …)
+> and re-run `./configure.py`.
+
     cd ~/vanguard-stream
     ./configure.py --full      # first time: asks everything, then applies
     ./configure.py             # later: add/remove/reset streamers and editors, then apply
diff --git a/authentik/discord-roles-to-groups.py b/authentik/discord-roles-to-groups.py
index d203e6a..f7f95b4 100644
--- a/authentik/discord-roles-to-groups.py
+++ b/authentik/discord-roles-to-groups.py
@@ -6,12 +6,13 @@
 # The Authentik groups must already exist (Directory -> Groups). Role IDs: Discord Developer Mode ->
 #   Server Settings -> Roles -> right-click a role -> Copy Role ID.
 
-GUILD_ID = "000000000000000000"                         # <- your Discord server ID
+GUILD_ID = "1387203044084551690"                         # <- your Discord server ID
 ROLE_TO_GROUP = {                                       # <- Discord role id : Authentik group name
-    "111111111111111111": "bot-users",
-    "222222222222222222": "streamers",
-    "333333333333333333": "editors",
-    "444444444444444444": "admins",
+    "1387239222070612110": "bot-users",
+    "1515901670943490129": "bot-users",
+#    "222222222222222222": "streamers",
+#    "333333333333333333": "editors",
+#    "444444444444444444": "admins",
 }
 
 from authentik.core.models import Group
diff --git a/configure.py b/configure.py
index 85a7e5f..97a4ed2 100755
--- a/configure.py
+++ b/configure.py
@@ -8,6 +8,8 @@
                                       used by addCommunityMediaServer.sh)
 
 Reads  : Caddyfile (hostnames), mediamtx.yml (streamers), copyparty.conf (editors + admin), .env
+         (these are GENERATED on the server and gitignored; *.example.* in the repo are reference only —
+          never scp them over the live ones: that is how streamers got wiped once)
 Writes : Caddyfile, mediamtx.yml, copyparty.conf, dump-users.txt -> /etc/vanguard, .env (generated secrets +
          Discord bot token/guild), folders, restarts
 Set VG_DRY=1 to write files only (no sudo / docker / folders).
@@ -398,6 +400,10 @@ def run(cmd, **kw):
     return subprocess.call(cmd, **kw)
 
 def apply(domain, admin_pw, streamers, editors, auth_host="", watch_host="", discord_token=None, discord_guild=None, git_host="", bot_host="", live_host="", live_webhook=None):
+    if not streamers and Path("mediamtx.yml").exists() and "CHANGEME" in Path("mediamtx.yml").read_text():
+        print("\n!! mediamtx.yml contains CHANGEME placeholders — it looks like the repo template was copied over the")
+        print("   generated config. Applying now would leave NO streamers (OBS ingest and the dump button stop working).")
+        if not yes("   continue anyway?", False): print("aborted; add streamers first ([s] in the menu)"); sys.exit(1)
     print("\n== writing configs")
     write_env(watch_host, discord_token, discord_guild, git_host, bot_host, live_host, domain, live_webhook)
     write_caddy(domain, auth_host, watch_host, git_host, bot_host, live_host); write_mediamtx(streamers); write_copyparty(admin_pw, editors); write_dump_users(admin_pw, streamers); write_streamers_json(streamers)
diff --git a/copyparty.conf b/copyparty.example.conf
similarity index 100%
rename from copyparty.conf
rename to copyparty.example.conf
diff --git a/dump-users.txt b/dump-users.example.txt
similarity index 100%
rename from dump-users.txt
rename to dump-users.example.txt
diff --git a/mediamtx.yml b/mediamtx.example.yml
similarity index 100%
rename from mediamtx.yml
rename to mediamtx.example.yml