97d1ba97a9
STATUS/plan: phase 10 Gitea via Authentik verified
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 17:37:28 -05:00
2ab0a4e837
Docs: git-admins claim with Authentik group nesting
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 17:27:51 -05:00
7e935c31d1
Gitea access gated by Authentik group git-users; roles table example
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 17:10:09 -05:00
b661ee795b
Phase 10: Gitea OIDC login prerequisites in compose (external-only registration, auto-register, account linking); README steps
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 17:09:33 -05:00
6db786e00e
Phase 12 verified live; MediaMTX config changes documented as restart-only on this setup
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 16:54:08 -05:00
f1d19ba32d
Plan: off-site gap filling option (home NVENC / Spot GPU) and SYS-3 availability note
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 16:26:44 -05:00
3fcb8fbe99
Phase 12: frame-accurate timecode via an overscan band — vgstrip encoder/decoder, sweep writes tmcd + creation_time + sidecar, dumpd /time, Caddy /time routes, MediaMTX microsecond names, /dock/clock/ page, dock band setup via obs-websocket, Go Live band composite + toggle, portal crops the band
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 16:07:56 -05:00
89841c3d2a
Plan: phase 12 — permanent overscan band with a machine-readable server clock; drift-aware decode
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 16:00:03 -05:00
f1bd28f8d1
Plan: phase 12 redesigned as a 10 s machine-readable sync burst decoded by the sweep into the timecode track; nothing visible in finals
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:58:20 -05:00
4419cc9d67
Plan: dock manages the OBS clock overlay through obs-websocket
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:56:33 -05:00
57be5bba52
Plan: burned-in server clock on the Go Live (WebRTC) path via canvas compositing
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:56:00 -05:00
b782621368
Plan: phase 12 uses the server clock as the only time reference
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:53:40 -05:00
b750bdb71c
Plan: phase 12 — timecode track + burned-in clock for frame-accurate multicam
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:53:29 -05:00
a7ad3dc224
STATUS/plan: phases 5-7 and 11 live and verified; refreshed unfinished list
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:48:33 -05:00
dcc347e1ea
Phase 7+11: token-based publishing — MediaMTX authMethod http -> dumpd /mtx-auth (bridge-only port 8081); dumpd mints 12 h HMAC tokens for Discord-authenticated streamers; dock rewritten (no passwords, naming rules with live preview, prefix/suffix, manual-setup accordion with hidden token); portal uses tokens; configure.py drops streamers; MediaMTX hot-reload, Caddy reload — no stream interruption
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:22:15 -05:00
c4a79c3316
README/plan: note WebDAV is available via app passwords but deliberately not set up
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:01:14 -05:00
15402eeb82
Discord-only login: drop WebDAV/app-password path from docs and generated config comments
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 15:00:48 -05:00
50c037e514
Phase 5+6: main host behind Authentik — copyparty trusts X-Authentik-* headers with group permissions (editors, media-admins), dumpd authorizes from headers (admins/media-admins), /sync gated to media-admins, dock drops its dump password; configure.py loses editors/admin
...
WebDAV continues via Authentik app passwords (provider: Intercept header authentication).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 14:55:48 -05:00
f3388f52bc
Plan: media-admins group for full copyparty rights in phase 5
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 01:24:46 -05:00
f06ebc1ec1
Plan: phase 11 — MediaMTX auth via Authentik (JWT for the browser, app passwords for OBS, no stream keys)
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-31 00:58:50 -05:00
384a7ed552
Per-host group gating in Caddy from X-Authentik-Groups; Discord roles -> Authentik groups policy; domain-level forward auth documented
...
BOT_REQUIRE_GROUP / LIVE_REQUIRE_GROUP in .env drive a header_regexp matcher after forward_auth
(403 before the app). authentik/discord-roles-to-groups.py syncs Discord roles into groups at
every login so access follows Discord roles without manual edits.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-30 23:22:20 -05:00
82df0b1583
Live portal: Go Live — browser window capture published over WHIP as <user>/HelmetCam-<date>; dumpd /me/stream-key
...
Go Live closes viewer windows, fetches the Authentik-identified user's MediaMTX key from dumpd
(/etc/vanguard/streamers.json written by configure.py), opens Chrome's window-only picker with
audio, prefers H.264 so MediaMTX can record, caps at 12 Mbps / 1440p60, shows live stats, Stop.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-30 23:04:33 -05:00
c602a6ff52
Vanguard media stack: ingest, copyparty, Syncthing, normalize sweep, Authentik, Jellyfin + Vanguard Metadata plugin, MariaDB, Gitea, bot runtime
...
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-30 15:43:30 -05:00
