techy/Media-Server-Setup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
69 Commits 1 Branch 0 Tags
4b2f3175adec4d4c83c049d6a5e1b2f5327819ea
Commit Graph

24 Commits

Author SHA1 Message Date
Brandyn / Techy
ef3a0a3fcd Caddy: /me route matches the bare path too (gateway identity call fell through to copyparty) 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 18:03:23 -05:00
Brandyn / Techy
48409b5dbf Self-service clip intake (/clips + dumpd /me/clips via Syncthing REST) and role-aware gateway page (/about + dumpd /me) 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 18:00:01 -05:00
Brandyn / Techy
7213460c10 Caddy: /logout on every gated host redirects to Authentik sign-out 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 17:53:02 -05:00
Brandyn / Techy
68c2866a28 Syncthing: GUI auth disabled behind the Authentik gate; docs 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 17:49:17 -05:00
Brandyn / Techy
6db786e00e Phase 12 verified live; MediaMTX config changes documented as restart-only on this setup 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 16:54:08 -05:00
Brandyn / Techy
3fcb8fbe99 Phase 12: frame-accurate timecode via an overscan band — vgstrip encoder/decoder, sweep writes tmcd + creation_time + sidecar, dumpd /time, Caddy /time routes, MediaMTX microsecond names, /dock/clock/ page, dock band setup via obs-websocket, Go Live band composite + toggle, portal crops the band 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 16:07:56 -05:00
Brandyn / Techy
5085f8ab55 Docs/apply note: MediaMTX does not hot-reload auth settings; restart between streams after auth changes 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 15:46:25 -05:00
Brandyn / Techy
2988e7a804 Caddy main host: route /me/* to dumpd (the dock's token request was falling through to copyparty -> 403) 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 15:44:09 -05:00
Brandyn / Techy
dcc347e1ea Phase 7+11: token-based publishing — MediaMTX authMethod http -> dumpd /mtx-auth (bridge-only port 8081); dumpd mints 12 h HMAC tokens for Discord-authenticated streamers; dock rewritten (no passwords, naming rules with live preview, prefix/suffix, manual-setup accordion with hidden token); portal uses tokens; configure.py drops streamers; MediaMTX hot-reload, Caddy reload — no stream interruption 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 15:22:15 -05:00
Brandyn / Techy
2a74cb7b40 Logout ends the Authentik session: copyparty idp-logout -> outpost sign_out; live portal Sign out link 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 15:11:53 -05:00
Brandyn / Techy
268a6a2f81 copyparty idp-h-key: Caddy injects a header with a secret name (COPYPARTY_IDP_KEY); IdP headers ignored without it 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 15:09:13 -05:00
Brandyn / Techy
b89afb50d2 Caddy: /whoami on the main host echoes the Authentik identity headers for debugging 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 15:08:16 -05:00
Brandyn / Techy
15402eeb82 Discord-only login: drop WebDAV/app-password path from docs and generated config comments 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 15:00:48 -05:00
Brandyn / Techy
50c037e514 Phase 5+6: main host behind Authentik — copyparty trusts X-Authentik-* headers with group permissions (editors, media-admins), dumpd authorizes from headers (admins/media-admins), /sync gated to media-admins, dock drops its dump password; configure.py loses editors/admin 
WebDAV continues via Authentik app passwords (provider: Intercept header authentication).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 14:55:48 -05:00
Brandyn / Techy
94db824243 configure.py: optional bare-domain Caddy block (redirect to the watch site by default) 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 01:12:22 -05:00
Brandyn / Techy
4b4c7eaedf Go Live: MediaMTX credentials via X-Stream-Auth -> Authorization on the Caddy->MediaMTX hop (WebRTC ignores query params); fix WHIP session DELETE path 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 00:56:56 -05:00
Brandyn / Techy
8333941e3d MediaMTX: disable MoQ (unused; noisy cert warnings on 1.21) 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 00:50:12 -05:00
Brandyn / Techy
357bb61b65 MediaMTX: write webrtcAdditionalHosts into the generated config (env-based value left it empty and MediaMTX refused to start) 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 00:48:27 -05:00
Brandyn / Techy
b2869c3740 Generated configs out of the repo: *.example.* templates only; configure.py refuses to apply over CHANGEME placeholders 
A deploy copied mediamtx.yml (template) over the server's generated file and the next apply
wiped all streamers. Generated files are now gitignored so scp -r cannot clobber them.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-31 00:32:30 -05:00
Brandyn / Techy
384a7ed552 Per-host group gating in Caddy from X-Authentik-Groups; Discord roles -> Authentik groups policy; domain-level forward auth documented 
BOT_REQUIRE_GROUP / LIVE_REQUIRE_GROUP in .env drive a header_regexp matcher after forward_auth
(403 before the app). authentik/discord-roles-to-groups.py syncs Discord roles into groups at
every login so access follows Discord roles without manual edits.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-30 23:22:20 -05:00
Brandyn / Techy
82df0b1583 Live portal: Go Live — browser window capture published over WHIP as <user>/HelmetCam-<date>; dumpd /me/stream-key 
Go Live closes viewer windows, fetches the Authentik-identified user's MediaMTX key from dumpd
(/etc/vanguard/streamers.json written by configure.py), opens Chrome's window-only picker with
audio, prefers H.264 so MediaMTX can record, caps at 12 Mbps / 1440p60, shows live stats, Stop.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-30 23:04:33 -05:00
Brandyn / Techy
463d9b2385 Live portal: React + dockview multi-stream viewer behind Authentik; MediaMTX HLS/WebRTC/API re-enabled; is-live Discord hook 
live/: every active stream opens as a dockable window (WHEP, HLS fallback), audio follows the
focused window, per-window mute/volume, pinning. Caddy live.HOST block with forward-auth proxies
/api /webrtc /hls to MediaMTX on loopback and serves /srv/live. WebRTC media on 8189 (firewall).
configure.py asks the live hostname and an optional Discord webhook; MediaMTX -ffmpeg image runs
the runOnReady hook. deployLive.sh builds and ships dist/.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-30 23:01:11 -05:00
Brandyn / Techy
3d42271ae2 Record streams into hidden .live/ and publish finished files via the sweep; plugin 0.1.2 feed wording 
Jellyfin indexed in-progress fragmented recordings (no duration -> seek jumped to next episode).
MediaMTX now writes under <Title>/.live/; the sweep remuxes finished files into the title folder
and removes the source. Feed says 'New recording' since it fires after publish.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-30 22:45:30 -05:00
Brandyn / Techy
c602a6ff52 Vanguard media stack: ingest, copyparty, Syncthing, normalize sweep, Authentik, Jellyfin + Vanguard Metadata plugin, MariaDB, Gitea, bot runtime 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 2026-10-30 15:43:30 -05:00