techy/Media-Server-Setup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Docs audit: phase-1 script prints domain-level forward-auth + roles sync; install.sh creates /srv/live; STATUS current

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Brandyn / Techy
2026-10-31 00:55:33 -05:00
parent 37b619055b
commit dff31b0b37
3 changed files with 32 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
addCommunityMediaServer.sh
View File

@@ -150,18 +150,26 @@ PHASE 3 — Jellyfin (direct play only on this CPU)
Custom CSS: paste jellyfin/branding.css
-> Save; reload https://$WATCH/
LIVE PORTAL (https://$LIVE/) — same Authentik forward-auth gate as the bot host:
Authentik -> Applications -> Create with provider -> Proxy Provider (forward auth, single application),
External host https://$LIVE -> add to the embedded outpost -> group policy.
Deploy the page: on the dev box `cd live && npm run build`, then ./deployLive.sh (scp dist -> /srv/live).
WebRTC viewers need UDP/TCP 8189 open (firewall rule included).
AUTHENTIK FORWARD-AUTH (gates https://$LIVE/ and https://$BOT/; later the main host) — once:
1. Applications -> Outposts -> edit "authentik Embedded Outpost" -> config: authentik_host: https://$AUTH
2. Applications -> Create with provider -> Application "Vanguard sites"; Proxy Provider, authorization
flow implicit-consent, mode "Forward auth (domain level)", authentication URL https://$AUTH,
cookie domain ${BASE} -> then edit the Embedded Outpost -> Applications: add it -> Update
3. Per-host access is enforced by Caddy from X-Authentik-Groups: .env BOT_REQUIRE_GROUP=bot-users
(default), LIVE_REQUIRE_GROUP= (empty = any logged-in member). ./configure.py apply regenerates.
4. Discord roles -> Authentik groups: Directory -> Groups: create bot-users (keep streamers/editors/admins);
Discord source -> Scopes: "guilds guilds.members.read"; Customization -> Policies -> Expression Policy
"discord-roles-to-groups" from authentik/discord-roles-to-groups.py (server id + role-id->group table);
bind to default-source-enrollment AND default-source-authentication (engine mode all).
5. Test: private window -> https://$LIVE/ -> Discord -> portal; https://$BOT/ -> 403 unless you hold the
bot role; https://$LIVE/me/stream-key shows your username.
BOT WEB UI (https://$BOT/) — Authentik forward-auth gate, create once:
Authentik -> Applications -> Create with provider -> Proxy Provider
mode "Forward auth (single application)", External host https://$BOT
-> Applications -> Outposts -> edit "authentik Embedded Outpost" -> add the new application -> Update
-> policy on the application: groups admins / editors / streamers as you see fit
Until this exists the site returns an error (never open). The bot receives X-Authentik-Username/-Groups/-Email.
LIVE PORTAL (https://$LIVE/)
Deploy the page from the dev box: ./deployLive.sh (builds live/ and copies dist/ to /srv/live).
WebRTC viewers and Go Live need UDP/TCP 8189 open (firewall rule included). Optional "is live" Discord
post: LIVE_WEBHOOK_URL in .env (asked by configure.py --full).
BOT WEB UI (https://$BOT/) — gated by the forward-auth above + group bot-users; the bot dev's brief is bot/AGENT.md.
GITEA (git.$GIT)
1. https://$GIT/ -> the first visit shows the install page: database is pre-filled from env; set the