MediaMTX: write webrtcAdditionalHosts into the generated config (env-based value left it empty and MediaMTX refused to start)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.gitignore

@@ -5,3 +5,8 @@ __pycache__/
 bot/app/__pycache__/
 *.pyc
 streamers.json
+# generated by configure.py on the server — never commit or scp these
+mediamtx.yml
+copyparty.conf
+Caddyfile
+dump-users.txt

README.md

@@ -35,6 +35,12 @@ works from ~/vanguard-stream without sudo.
 
 ## 3. Configure (domain, admin, streamers, editors)
 
+> `mediamtx.yml`, `copyparty.conf`, `Caddyfile`, `dump-users.txt` and `.env` are **generated on the server**
+> by `configure.py` and gitignored. The `*.example.*` files in the repo are reference only. **Never copy them
+> to the server**: doing so once replaced the live streamer passwords with `CHANGEME` and the next apply
+> wiped the streamers. To update the server, copy scripts (`configure.py`, `bin/`, `docker-compose.yml`, …)
+> and re-run `./configure.py`.
+
     cd ~/vanguard-stream
     ./configure.py --full      # first time: asks everything, then applies
     ./configure.py             # later: add/remove/reset streamers and editors, then apply

authentik/discord-roles-to-groups.py

@@ -6,12 +6,13 @@
 # The Authentik groups must already exist (Directory -> Groups). Role IDs: Discord Developer Mode ->
 #   Server Settings -> Roles -> right-click a role -> Copy Role ID.
 
-GUILD_ID = "000000000000000000"                         # <- your Discord server ID
+GUILD_ID = "1387203044084551690"                         # <- your Discord server ID
 ROLE_TO_GROUP = {                                       # <- Discord role id : Authentik group name
-    "111111111111111111": "bot-users",
+    "1387239222070612110": "bot-users",
-    "222222222222222222": "streamers",
+    "1515901670943490129": "bot-users",
-    "333333333333333333": "editors",
+#    "222222222222222222": "streamers",
-    "444444444444444444": "admins",
+#    "333333333333333333": "editors",
+#    "444444444444444444": "admins",
 }
 
 from authentik.core.models import Group

configure.py

@@ -8,6 +8,8 @@
                                       used by addCommunityMediaServer.sh)
 
 Reads  : Caddyfile (hostnames), mediamtx.yml (streamers), copyparty.conf (editors + admin), .env
+         (these are GENERATED on the server and gitignored; *.example.* in the repo are reference only —
+          never scp them over the live ones: that is how streamers got wiped once)
 Writes : Caddyfile, mediamtx.yml, copyparty.conf, dump-users.txt -> /etc/vanguard, .env (generated secrets +
          Discord bot token/guild), folders, restarts
 Set VG_DRY=1 to write files only (no sudo / docker / folders).
@@ -265,7 +267,7 @@ def write_env(watch_host, discord_token=None, discord_guild=None, git_host="", b
     Path(".env").write_text("".join(f"{k}={v}\n" for k, v in env.items()))
     os.chmod(".env", 0o600)
 
-def write_mediamtx(streamers):
+def write_mediamtx(streamers, public_host=""):
     users = "".join(f"""  - user: {u}
     pass: {p}
     permissions:
@@ -292,7 +294,7 @@ webrtcAddress: :8889
 webrtcLocalUDPAddress: :8189
 webrtcLocalTCPAddress: :8189
 webrtcIPsFromInterfaces: no
-# webrtcAdditionalHosts is set via env MTX_WEBRTCADDITIONALHOSTS (= the public hostname) in docker-compose.yml
+webrtcAdditionalHosts: [{public_host or "127.0.0.1"}]     # public hostname browsers can reach for ICE (written by configure.py)
 
 rtmp: yes
 rtmpAddress: :1935
@@ -398,9 +400,13 @@ def run(cmd, **kw):
     return subprocess.call(cmd, **kw)
 
 def apply(domain, admin_pw, streamers, editors, auth_host="", watch_host="", discord_token=None, discord_guild=None, git_host="", bot_host="", live_host="", live_webhook=None):
+    if not streamers and Path("mediamtx.yml").exists() and "CHANGEME" in Path("mediamtx.yml").read_text():
+        print("\n!! mediamtx.yml contains CHANGEME placeholders — it looks like the repo template was copied over the")
+        print("   generated config. Applying now would leave NO streamers (OBS ingest and the dump button stop working).")
+        if not yes("   continue anyway?", False): print("aborted; add streamers first ([s] in the menu)"); sys.exit(1)
     print("\n== writing configs")
     write_env(watch_host, discord_token, discord_guild, git_host, bot_host, live_host, domain, live_webhook)
-    write_caddy(domain, auth_host, watch_host, git_host, bot_host, live_host); write_mediamtx(streamers); write_copyparty(admin_pw, editors); write_dump_users(admin_pw, streamers); write_streamers_json(streamers)
+    write_caddy(domain, auth_host, watch_host, git_host, bot_host, live_host); write_mediamtx(streamers, domain); write_copyparty(admin_pw, editors); write_dump_users(admin_pw, streamers); write_streamers_json(streamers)
     run(["sudo", "install", "-d", "-o", os.environ.get("SUDO_USER") or os.environ.get("USER") or "debian", "/srv/live"])
     print("== app data folders")
     run(["sudo", "install", "-d", "-o", "1000", "-g", "1000", "/srv/appdata/jellyfin/config", "/srv/appdata/jellyfin/cache",

mediamtx.example.yml

@@ -17,7 +17,7 @@ webrtcAddress: :8889
 webrtcLocalUDPAddress: :8189
 webrtcLocalTCPAddress: :8189
 webrtcIPsFromInterfaces: no
-# webrtcAdditionalHosts is set via env MTX_WEBRTCADDITIONALHOSTS (= the public hostname) in docker-compose.yml
+webrtcAdditionalHosts: [media.example.com]     # public hostname browsers can reach for ICE (configure.py fills this)
 
 rtmp: yes
 rtmpAddress: :1935