Vanguard media stack: ingest, copyparty, Syncthing, normalize sweep, Authentik, Jellyfin + Vanguard Metadata plugin, MariaDB, Gitea, bot runtime

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

mediamtx.yml

@@ -0,0 +1,45 @@
+# MediaMTX — ingest only. No playback endpoints exposed.
+logLevel: info
+
+rtsp: no
+webrtc: no
+hls: no
+api: no
+metrics: no
+pprof: no
+
+rtmp: yes
+rtmpAddress: :1935
+
+srt: yes
+srtAddress: :8890
+
+# ---- auth -------------------------------------------------------------
+# Each streamer may publish only under their own prefix.
+# RTMP key:  techy/Title?user=techy&pass=CHANGEME
+# SRT:       srt://HOST:8890?streamid=publish:techy/Title:techy:CHANGEME
+authMethod: internal
+authInternalUsers:
+  - user: techy
+    pass: CHANGEME_TECHY
+    permissions:
+      - action: publish
+        path: ~^techy/[A-Za-z0-9_.-]+$
+  - user: diceofire
+    pass: CHANGEME_DICE
+    permissions:
+      - action: publish
+        path: ~^diceofire/[A-Za-z0-9_.-]+$
+
+# ---- recording --------------------------------------------------------
+pathDefaults:
+  record: yes
+  recordPath: /recordings/%path/%Y-%m-%d_%H-%M-%S
+  recordFormat: fmp4
+  recordPartDuration: 1s
+  recordSegmentDuration: 12h      # one file per stream unless it runs >12h
+  recordDeleteAfter: 0s           # never auto-delete; the archive job handles it
+
+paths:
+  # any name under a streamer's prefix; inherits pathDefaults
+  ~^(techy|diceofire)/[A-Za-z0-9_.-]+$: {}