6128a4ef3a
README: nested groups need a second scope mapping (managed profile mapping is direct-only and sticky on proxy providers)
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-11-01 01:26:14 -06:00
18f4e07de8
Split hosts: media (gateway at /), files, clips, sync; live gains /dock, /dock/clock, /dump, /me, /time
...
configure.py: three new host roles (files/sync/clips) in --full, --hosts, .env, Caddy generator;
main host serves about/ at the root (/about* redirects); /time only where it is fetched same-origin.
about/index.html links across hosts; addCommunityMediaServer.sh asks for the new names; Caddyfile.example
regenerated; README/FRESH-INSTALL/HOSTNAME-CHANGE (procedure C)/STATUS updated.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-11-01 01:38:35 -05:00
c1a46d66dc
HOSTNAME-CHANGE.md: hostname inventory, subdomain rename and base-domain move procedures; linked from README
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-11-01 01:23:33 -05:00
861a88fc7e
FRESH-INSTALL.md: ordered walkthrough from empty box to working pipeline, manual steps included; linked from README
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-11-01 01:19:06 -05:00
49d33e8210
README: rollout block matches the current one (compose included, visible apply output)
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-11-01 01:16:42 -05:00
abb7186bd0
Rebuild gaps closed: Authentik bootstrap creds, Gitea install lock + admin user from .env, Syncthing GUI-auth-off fixup, plugin ensured on apply, portal built by install.sh; README rebuild section with the honest manual remainder
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-11-01 01:14:46 -05:00
33482bfff3
README: push-to-deploy rollout commands, clone switch, webhook test, enabling steps
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-11-01 01:09:42 -05:00
66f05cf9a7
Push-to-deploy (OFF by default): vanguard-deploy applies only changed parts with a live-stream guard for MediaMTX, rollback, pending timer; dumpd /deploy webhook gated by DEPLOY_AUTO; configure --apply; switchToClone.sh; draft CI workflow; committed plugin zip
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-11-01 01:08:43 -05:00
07ffae0746
Soft per-user clip quotas: dumpd pauses/resumes Syncthing folders by folder size (CLIPS_QUOTA_GB, per-user overrides file); clips page shows usage
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 18:30:22 -05:00
48409b5dbf
Self-service clip intake (/clips + dumpd /me/clips via Syncthing REST) and role-aware gateway page (/about + dumpd /me)
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 18:00:01 -05:00
367d41fe18
addClipUser.sh + README: onboarding a gamer's clips via Syncthing
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 17:54:49 -05:00
7213460c10
Caddy: /logout on every gated host redirects to Authentik sign-out
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 17:53:02 -05:00
68c2866a28
Syncthing: GUI auth disabled behind the Authentik gate; docs
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 17:49:17 -05:00
52c065b753
roles policy: only revoke memberships it granted itself (manual adds survive); track in user attributes
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 17:34:43 -05:00
2ab0a4e837
Docs: git-admins claim with Authentik group nesting
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 17:27:51 -05:00
7e935c31d1
Gitea access gated by Authentik group git-users; roles table example
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 17:10:09 -05:00
b661ee795b
Phase 10: Gitea OIDC login prerequisites in compose (external-only registration, auto-register, account linking); README steps
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 17:09:33 -05:00
6db786e00e
Phase 12 verified live; MediaMTX config changes documented as restart-only on this setup
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 16:54:08 -05:00
f1d19ba32d
Plan: off-site gap filling option (home NVENC / Spot GPU) and SYS-3 availability note
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 16:26:44 -05:00
9dc81ae5aa
README/STATUS: gap filling availability and the on/off commands
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 16:25:08 -05:00
473247e710
Sweep: opt-in gap filling for streams (FILL_GAPS_MS) — CFR re-encode with duplicated frames, raw kept in .src/, timecode carried; default off
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 16:19:25 -05:00
f36487d4b5
Timecode: nominal fps + proper drop-frame detection, shell-safe plan output; streams never VFR-re-encoded; gap list in the sidecar; docs
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 16:17:26 -05:00
3fcb8fbe99
Phase 12: frame-accurate timecode via an overscan band — vgstrip encoder/decoder, sweep writes tmcd + creation_time + sidecar, dumpd /time, Caddy /time routes, MediaMTX microsecond names, /dock/clock/ page, dock band setup via obs-websocket, Go Live band composite + toggle, portal crops the band
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 16:07:56 -05:00
5085f8ab55
Docs/apply note: MediaMTX does not hot-reload auth settings; restart between streams after auth changes
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:46:25 -05:00
65aa8b0894
Docs: provider invalidation flow so every logout forces a full Discord re-login
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:38:01 -05:00
dcc347e1ea
Phase 7+11: token-based publishing — MediaMTX authMethod http -> dumpd /mtx-auth (bridge-only port 8081); dumpd mints 12 h HMAC tokens for Discord-authenticated streamers; dock rewritten (no passwords, naming rules with live preview, prefix/suffix, manual-setup accordion with hidden token); portal uses tokens; configure.py drops streamers; MediaMTX hot-reload, Caddy reload — no stream interruption
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:22:15 -05:00
2a74cb7b40
Logout ends the Authentik session: copyparty idp-logout -> outpost sign_out; live portal Sign out link
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:11:53 -05:00
268a6a2f81
copyparty idp-h-key: Caddy injects a header with a secret name (COPYPARTY_IDP_KEY); IdP headers ignored without it
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:09:13 -05:00
b89afb50d2
Caddy: /whoami on the main host echoes the Authentik identity headers for debugging
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:08:16 -05:00
c4a79c3316
README/plan: note WebDAV is available via app passwords but deliberately not set up
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:01:14 -05:00
15402eeb82
Discord-only login: drop WebDAV/app-password path from docs and generated config comments
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:00:48 -05:00
50c037e514
Phase 5+6: main host behind Authentik — copyparty trusts X-Authentik-* headers with group permissions (editors, media-admins), dumpd authorizes from headers (admins/media-admins), /sync gated to media-admins, dock drops its dump password; configure.py loses editors/admin
...
WebDAV continues via Authentik app passwords (provider: Intercept header authentication).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 14:55:48 -05:00
e02accb855
Streams published flat as <user>/<Title>__<ts>.mp4 so each recording is its own Jellyfin episode; plugin 0.1.3 parses the title from the name
...
Jellyfin merges several videos in one non-season folder into a single episode with versions,
which collapsed a night of helmet cams into one entry. Recording still lands in <Title>/.live/.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 03:42:53 -05:00
f737fc6289
Go Live: state the Windows-only window-audio limitation in the UI and docs
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 01:47:45 -05:00
b634413773
Go Live: request window-scoped audio (windowAudio: window, Chrome 141+); keep the picker window-only
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 01:44:45 -05:00
b2869c3740
Generated configs out of the repo: *.example.* templates only; configure.py refuses to apply over CHANGEME placeholders
...
A deploy copied mediamtx.yml (template) over the server's generated file and the next apply
wiped all streamers. Generated files are now gitignored so scp -r cannot clobber them.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 00:32:30 -05:00
384a7ed552
Per-host group gating in Caddy from X-Authentik-Groups; Discord roles -> Authentik groups policy; domain-level forward auth documented
...
BOT_REQUIRE_GROUP / LIVE_REQUIRE_GROUP in .env drive a header_regexp matcher after forward_auth
(403 before the app). authentik/discord-roles-to-groups.py syncs Discord roles into groups at
every login so access follows Discord roles without manual edits.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-30 23:22:20 -05:00
bee53f2718
README: domain-level forward auth as the recommended Authentik setup
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-30 23:19:45 -05:00
4b4053a407
README: Authentik forward-auth setup for live/bot hosts
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-30 23:12:56 -05:00
82df0b1583
Live portal: Go Live — browser window capture published over WHIP as <user>/HelmetCam-<date>; dumpd /me/stream-key
...
Go Live closes viewer windows, fetches the Authentik-identified user's MediaMTX key from dumpd
(/etc/vanguard/streamers.json written by configure.py), opens Chrome's window-only picker with
audio, prefers H.264 so MediaMTX can record, caps at 12 Mbps / 1440p60, shows live stats, Stop.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-30 23:04:33 -05:00
463d9b2385
Live portal: React + dockview multi-stream viewer behind Authentik; MediaMTX HLS/WebRTC/API re-enabled; is-live Discord hook
...
live/: every active stream opens as a dockable window (WHEP, HLS fallback), audio follows the
focused window, per-window mute/volume, pinning. Caddy live.HOST block with forward-auth proxies
/api /webrtc /hls to MediaMTX on loopback and serves /srv/live. WebRTC media on 8189 (firewall).
configure.py asks the live hostname and an optional Discord webhook; MediaMTX -ffmpeg image runs
the runOnReady hook. deployLive.sh builds and ships dist/.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-30 23:01:11 -05:00
3d42271ae2
Record streams into hidden .live/ and publish finished files via the sweep; plugin 0.1.2 feed wording
...
Jellyfin indexed in-progress fragmented recordings (no duration -> seek jumped to next episode).
MediaMTX now writes under <Title>/.live/; the sweep remuxes finished files into the title folder
and removes the source. Feed says 'New recording' since it fires after publish.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-30 22:45:30 -05:00
c602a6ff52
Vanguard media stack: ingest, copyparty, Syncthing, normalize sweep, Authentik, Jellyfin + Vanguard Metadata plugin, MariaDB, Gitea, bot runtime
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-30 15:43:30 -05:00
