1573bf8954
- services/framecache/: new standalone container
- slot.h/slot.c: shm ring buffer (120 frames, FC_MAGIC header, atomic
write_cursor, POSIX semaphore per slot)
- registry.h/registry.c: in-memory slot registry + /dev/shm/framecache/
registry.json persistence
- framecache.c: HTTP API server (libmicrohttpd, port 7435)
POST /slots, GET /slots, GET /slots/:id, DELETE /slots/:id, GET /health
- fc_client.h/fc_client.c: consumer library — fc_consumer_open/read/close
with per-consumer cursor, timeout via sem_timedwait, automatic skip+count
when consumer falls behind writer by > ring_depth frames
- fc_test_consumer.c: dev utility to attach to any slot and print fps/stats
- CMakeLists.txt: framecache server + fc_client static lib + test consumer
- Dockerfile: builder + slim runtime stages
- docker-compose.worker.yml: add framecache service (profile: capture,
ipc: host, shm_size from FC_SHM_SIZE_GB env var, healthcheck)
- .env.example: document FC_SHM_SIZE_GB with per-node guidance
85 lines
3.7 KiB
Text
85 lines
3.7 KiB
Text
# Database Configuration
|
|
POSTGRES_DB=wilddragon
|
|
POSTGRES_USER=wilddragon
|
|
POSTGRES_PASSWORD=changeme
|
|
|
|
# Database Connection
|
|
DATABASE_URL=postgres://wilddragon:changeme@db:5432/wilddragon
|
|
|
|
# Redis Configuration
|
|
REDIS_URL=redis://queue:6379
|
|
|
|
# S3 Configuration
|
|
S3_ENDPOINT=https://broadcastmgmt.cloud
|
|
S3_BUCKET=wild-dragon
|
|
S3_ACCESS_KEY=changeme
|
|
S3_SECRET_KEY=changeme
|
|
S3_REGION=us-east-1
|
|
|
|
# Session Configuration
|
|
SESSION_SECRET=changeme
|
|
|
|
# MAM API Configuration
|
|
MAM_API_URL=http://mam-api:3000
|
|
|
|
# Node Agent Authentication
|
|
# Bearer token for node-agent to authenticate with mam-api /driver/* endpoints.
|
|
# Generate with: openssl rand -hex 32
|
|
NODE_AGENT_TOKEN=changeme
|
|
|
|
# Auth — default to ON in production. Setting to 'false' is a dev-only escape
|
|
# hatch that disables all auth checks and attaches a synthetic 'dev' user to
|
|
# every request. Never run with AUTH_ENABLED=false on a network you don't control.
|
|
#
|
|
# RBAC v2 note: with AUTH_ENABLED=true, per-project access is enforced. Service
|
|
# API tokens (capture sidecar, Premiere panel, integrations) must belong to a
|
|
# user with the access they need — an 'admin' user (full access), or a user with
|
|
# the right project grants. A non-admin service token with no grants will get
|
|
# 403 on asset registration (ingest) and streaming. In dev mode the synthetic
|
|
# user is admin, so this only matters once auth is on.
|
|
AUTH_ENABLED=true
|
|
|
|
# CORS allowlist — comma-separated origins that may carry credentials to the API.
|
|
# Same-origin requests via the nginx reverse proxy do not need to be listed here.
|
|
# Leave empty to allow any origin (DEV ONLY).
|
|
ALLOWED_ORIGINS=
|
|
|
|
# Reverse-proxy trust — set 'true' when the API sits behind nginx terminating HTTPS,
|
|
# so secure-cookie + X-Forwarded-Proto behave correctly. ALSO required for accurate
|
|
# per-IP login rate-limiting (otherwise req.ip is always the nginx IP).
|
|
TRUST_PROXY=false
|
|
|
|
# Google OAuth (OIDC) sign-in — OPTIONAL. Leave the client id/secret blank to
|
|
# disable; the "Sign in with Google" button and the /auth/google routes only
|
|
# activate when all three of CLIENT_ID, CLIENT_SECRET, and REDIRECT_URL are set.
|
|
# Create an OAuth 2.0 Client (type: Web application) in Google Cloud Console and
|
|
# add OAUTH_REDIRECT_URL to its authorized redirect URIs.
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|
|
# Must exactly match a redirect URI on the OAuth client, e.g.
|
|
# https://dragonflight.live/api/v1/auth/google/callback
|
|
OAUTH_REDIRECT_URL=
|
|
# Restrict sign-in to one Google Workspace domain (recommended). First login from
|
|
# an allowed-domain account auto-provisions a NEW 'viewer' account (matched only
|
|
# by Google's stable subject id, never by email — so a Google login can never
|
|
# seize a pre-existing local account). An admin then grants project access.
|
|
# Leave blank to allow any verified Google account to self-provision (NOT advised).
|
|
GOOGLE_ALLOWED_DOMAIN=
|
|
# Note: if a Google-linked account also has TOTP enabled, sign-in still requires
|
|
# the authenticator code (Google is treated as the first factor). Accounts without
|
|
# TOTP complete sign-in in one Google step.
|
|
|
|
# Framecache — shared memory ring buffer for SDI + network ingest fan-out.
|
|
# Size in GB. Tune per node based on available RAM and number of SDI inputs.
|
|
# Each 1080p59.94 source uses ~494MB (120-frame ring at 4.1MB/frame).
|
|
# Baratheon (251GB RAM): 60
|
|
# zampp1 (93GB RAM): 40
|
|
# zampp2 (18GB RAM): 8 (increase node RAM before deploying capture)
|
|
FC_SHM_SIZE_GB=40
|
|
|
|
# Playout / Master Control (MCR)
|
|
# Image tag the mam-api spawns when a channel starts. Build with:
|
|
# docker compose --profile build-only build playout
|
|
PLAYOUT_IMAGE=wild-dragon-playout:latest
|
|
# Base AMCP port — each channel binds to BASE + channel_id (in CasparCG terms).
|
|
PLAYOUT_AMCP_BASE_PORT=5250
|