Caddy: /me route matches the bare path too (gateway identity call fell through to copyparty)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

STATUS.md

@@ -27,8 +27,8 @@ Source of truth: this repo, `techy/Media-Server-Setup` on the stack's own Gitea
 |---|---|---|---|
 | Streamer | One-time: dock → Timecode band → "Add band + clock source" (OBS) or leave the Go Live checkbox on — gives editors frame-accurate timecode | OBS dock / Go Live | live |
 | Streamer | Type a title (live preview + naming rules), Go Live, Stop. "Dump tonight" if it was junk (3-day undo). Manual-setup accordion with endpoints and a hidden token | OBS browser dock `https://ovh1…/dock/` | Discord login in the dock; dock mints a 12 h token per Go Live — **no passwords, verified live** |
-| Gamer | Self-serve pairing at `/clips/` (paste Syncthing Device ID → folder + share created); then nothing, clips save where they always did | `https://ovh1…/clips/` + Syncthing | Discord — **pending deploy** |
+| Gamer | Self-serve pairing at `/clips/` (paste Syncthing Device ID → folder + share created); then nothing, clips save where they always did | `https://ovh1…/clips/` + Syncthing | Discord (any server member) |
-| Everyone | Landing page with role-aware links and instructions | `https://ovh1…/about/` | Discord — **pending deploy** |
+| Everyone | Landing page with role-aware links and instructions | `https://ovh1…/about/` | Discord |
 | Editor | Multicam: drop clips on a timeline, sync by the embedded timecode track (frame-accurate when the band was on), cross-check with voice audio; export at the game resolution to drop the band | Resolve / Premiere | — |
 | Editor | Browse by streamer/title, scrub in browser, download originals (zip/tar for folders), upload finals | copyparty `https://ovh1…/` | Discord (Authentik); rights by group `editors` / `media-admins` |
 | Anyone in the Discord server | Watch recordings and clips by streamer and season | Jellyfin `https://watch.…/` | Discord (Authentik) |
@@ -48,8 +48,8 @@ Source of truth: this repo, `techy/Media-Server-Setup` on the stack's own Gitea
 |---|---|---|
 | MediaMTX | RTMP/SRT ingest, records fMP4; publish auth delegated to dumpd (tokens via `/mtx-auth`) | live, token auth verified |
 | copyparty | browse/scrub/download/finals upload | behind Authentik, group permissions (`editors`, `media-admins`), Discord-only, no WebDAV | live |
-| dumpd + dock | dump, stream tokens, MediaMTX auth hook, `/time`, `/me` identity, `/me/clips` Syncthing self-service; OBS dock with timecode-band setup | identity from Authentik headers | live; `/me`, `/me/clips` **pending deploy** |
+| dumpd + dock | dump, stream tokens, MediaMTX auth hook, `/time`, `/me` identity, `/me/clips` Syncthing self-service; OBS dock with timecode-band setup | identity from Authentik headers | live |
-| `/about/` gateway, `/clips/` self-service | static pages behind the gate | — | **built, pending deploy** |
+| `/about/` gateway, `/clips/` self-service | static pages behind the gate | — | live (first real pairing pending) |
 | Timecode | `bin/vgstrip.py` decoder, `tmcd` + sidecar in the sweep, `/dock/clock/` strip page, Go Live band composite, portal crop | server clock is the reference | **live, verified** (OBS: frame-accurate, 0 gaps) |
 | Syncthing | clip intake, UI at `/sync/` | UI behind Authentik + `media-admins`, own GUI auth off | live |
 | normalize sweep | editing standard, one copy per clip | live |

configure.py

@@ -168,8 +168,9 @@ def write_caddy(domain, auth_host="", watch_host="", git_host="", bot_host="", l
 # vanguard:live
 {live_host} {{
 	encode zstd gzip
-{gate(env.get("LIVE_REQUIRE_GROUP", ""))}	handle /me/* {{
+{gate(env.get("LIVE_REQUIRE_GROUP", ""))}	@me path /me /me/*
-		reverse_proxy 127.0.0.1:8080          # dumpd: /me/stream-token for the logged-in streamer (Go Live)
+	handle @me {{
+		reverse_proxy 127.0.0.1:8080          # dumpd: identity + /me/stream-token for the logged-in streamer (Go Live)
 	}}
 	handle /time {{
 		reverse_proxy 127.0.0.1:8080          # server clock for the timecode strip
@@ -258,8 +259,9 @@ name:   {{http.request.header.X-Authentik-Name}}"
 	handle /dump* {{
 		reverse_proxy 127.0.0.1:8080
 	}}
-	handle /me/* {{
+	@me path /me /me/*
-		reverse_proxy 127.0.0.1:8080
+	handle @me {{
+		reverse_proxy 127.0.0.1:8080          # dumpd: identity, stream tokens, clips self-service
 	}}
 	handle /time {{
 		reverse_proxy 127.0.0.1:8080          # server clock for the timecode strip