{ "schema": "eupdate-package-specification-v1", "author": "PB ", "project_id": "dbad8351151b6fd5", "software_id": "ecast-pipe-server", "software": "eCast pipe", "module": null, "release_id": "e621af3fed20eae46b46ad8d77c63f6e", "version": "0.2.1", "release_date": "2026-04-28", "published_at": "2026-09-08T19:10:18+00:00", "bytes": 127235, "sha256": "ae8868e0167ad258462195ada05226664204b8aee2d5fbd4237e82306b8e5e5d", "file_count": 56, "languages": { "JavaScript": { "bytes": 21967, "files": 1 }, "PHP": { "bytes": 21539, "files": 4 }, "Shell": { "bytes": 19102, "files": 3 }, "CSS": { "bytes": 5247, "files": 1 }, "HTML": { "bytes": 3784, "files": 1 } }, "installation_url": "https://update.estudium.eu/package.php?software_id=ecast-pipe-server&version=0.2.1", "update_url": "https://update.estudium.eu/package.php?software_id=ecast-pipe-server", "install_json": { "software": "eCast pipe", "software_id": "ecast-pipe-server", "version": "0.2.1", "release_date": "2026-04-28", "author": { "name": "PB", "email": "info@estudium.eu", "website": "https://www.estudium.eu" }, "project": { "website": "https://www.estudium.eu" }, "homepage": "https://www.estudium.eu", "description": { "cs": "Server pro příjem, distribuci, záznam a monitoring audio/video streamů s webovou správou. Obsahuje Icecast, MediaMTX, FFmpeg, Stream Analyzer a instalační průvodce CZ/EN.", "en": "Server for receiving, distributing, recording and monitoring audio/video streams with a web administration interface, Icecast, MediaMTX, FFmpeg, Stream Analyzer and a CZ/EN installation wizard." }, "package": { "type": "release" }, "compatibility": { "os_types": [ "linux" ], "distributions": [ { "id": "ubuntu", "name": "Ubuntu", "versions": [ "24.04", "26.04" ] } ], "distribution_ids": [ "ubuntu" ], "os_versions": [ "24.04", "26.04" ], "any_linux_distribution": false, "architectures": [ "amd64" ], "native_windows_supported": false, "native_macos_supported": false }, "installation": { "commands": { "linux": { "supported": true, "mode": "automatic", "command": "bash ./setup.sh" }, "windows": { "supported": false, "mode": "unsupported", "command": null }, "macos": { "supported": false, "mode": "unsupported", "command": null }, "other": { "command": null, "supported": false, "mode": "unsupported" }, "source": { "command": null, "supported": false, "mode": "unsupported" } }, "requires_root": true, "requires_internet": true, "interactive": true, "fresh_install_command": "sudo bash ./setup.sh --install", "update_command": "sudo bash ./setup.sh --update", "verify_command": "bash ./setup.sh --check" }, "documentation": { "readme": "README.md", "installation": "docs/INSTALL_EUPDATE.md", "changelog": "CHANGELOG.md" }, "archive_metadata": { "working_directory": "ecast-pipe-server", "publisher": "dcf6d41fbcdf0e16", "updated_at": "2026-09-08T19:10:18+00:00", "application_author": "PB " }, "checkin": { "enabled_by_default": true, "endpoint": "https://update.estudium.eu/check/", "schema": "ecast-checkin-v1", "software_id": "ecast-pipe-server", "authentication_header": "X-eCast-API-Key", "interval_seconds": 86400, "command": "sudo /usr/local/sbin/ecast-checkin --force" }, "requirements": { "init_system": "systemd", "minimum_ubuntu_version": "24.04", "architecture": "amd64", "recommended_cpu_cores": 2, "recommended_memory_mb": 2048, "recommended_free_disk_gb": 10, "packages_file": "packages.txt" }, "license": "MIT", "license_custom": "" }, "readme": "# eCast pipe 0.2.1 server MVP for Ubuntu 26.04 amd64\n\nProgram: eCast pipe 0.2.1\nAuthor: PB\nWeb: estudium.eu\nEmail: info@estudium.eu\n\nThis package is a first manual-install MVP for a Ferncast-like audio/video pipe server.\nIt is intentionally structured so it can later be converted into Ansible templates and handlers.\n\n## Features in this package\n\n- Ubuntu 26.04 amd64 target.\n- Nginx + PHP web admin.\n- Web admin uses Nginx HTTP Basic Auth with a first user created during install.\n- PAM is not used for the web admin. The installer asks for the first web username and password and stores it in `/etc/audiopipe/web.htpasswd`.\n- Audio distribution via Icecast mountpoints, for example `/radio1`, `/radio2`.\n- Video distribution via MediaMTX RTSP paths, for example `rtsp://server:8554/tv1`.\n- Per-channel optional input/source password.\n- Per-channel optional listener/viewer password.\n- One or more recording profiles per channel.\n- Recording profile options: output/source input, format, codecs, bitrates, segment length, retention days.\n- Backup recording profile for same-time previous-day fallback.\n- Audio silence detection through FFmpeg `silencedetect`.\n- Video black-frame detection through FFmpeg `blackdetect` plus simple FPS check.\n- fail2ban config.\n- nftables firewall example with ICMP limit and public ports.\n\n## Install\n\n```bash\nsudo unzip audiopipe-server-mvp-v7.zip -d /opt/src\ncd /opt/src/audiopipe-server\nsudo ./install.sh\n```\n\nThe installer uses this online APT install path:\n\n```bash\nsudo apt update\nsudo apt install -y --no-install-recommends nginx-full php-fpm php-cli php-mbstring php-xml php-curl icecast2 ffmpeg fail2ban nftables sudo curl ca-certificates jq uuid-runtime apache2-utils openssl python3 python3-yaml unzip chrony tzdata whiptail\n```\n\nThe installer writes a detailed log to:\n\n```text\n/var/log/esact/install-latest.log\n```\n\nIf installation fails, collect a debug bundle with:\n\n```bash\nsudo audiopipe-collect-debug\n```\n\nThe command prints the generated .tar.gz file path. Send that archive together with `/var/log/esact/install-latest.log`. Secrets in copied configs are redacted by the collector.\n\nIf you need an offline bundle, run this on a matching Ubuntu 26.04 amd64 machine first:\n\n```bash\nsudo ./bin/download-packages.sh\nzip -r audiopipe-server-offline.zip audiopipe-server\n```\n\nThen copy the offline zip to the target server and run `sudo ./install.sh`.\n\n## Important default accounts/groups\n\n- Web login: Nginx HTTP Basic Auth, first user created during install\n- Time zone: Europe/Prague; time synchronization: chrony, config `/etc/chrony/conf.d/audiopipe.conf`\n- Runtime user/group: `audiopipe:audiopipe`\n- MediaMTX user: `mediamtx`\n- Web server user: `www-data`, added to group `audiopipe` so it can update `/etc/audiopipe/config.json`.\n\nThe web UI no longer uses PAM. Log in with the web username and password created during installation.\n\n## Main paths\n\n- Main config: `/etc/audiopipe/config.json`\n- Web app: `/opt/audiopipe/php-app/public`\n- Rendered Icecast config: `/etc/icecast2/icecast.xml`\n- Rendered MediaMTX config: `/etc/mediamtx/mediamtx.yml`\n- Recordings: `/var/lib/audiopipe/recordings////.`\n- Logs: `/var/log/esact`\n- Runtime state: `/run/audiopipe`\n\n## Channel model\n\nEach channel has:\n\n- `recordings[]`: one or more recording profiles.\n- `backup`: defines which recording is used for fallback.\n- `input_auth`: optional password for source/publish input.\n- `delivery.listener_auth`: optional password for listeners/viewers.\n- `failure_detection`: silence/no-picture thresholds and switch/recovery timing.\n\nSee `docs/CHANNEL_SCHEMA.md` for details.\n\n## Apply config\n\nFrom the web UI click `Apply configuration`, or run:\n\n```bash\nsudo /usr/local/bin/audiopipe-apply\n```\n\nThis renders Icecast and MediaMTX configs and restarts/enables per-channel systemd services.\n\n## Services\n\nFor channel `radio1`:\n\n```bash\nsystemctl status audiopipe-channel@radio1\nsystemctl status audiopipe-recorder@radio1\nsystemctl status audiopipe-monitor@radio1\njournalctl -u audiopipe-channel@radio1 -f\n```\n\n## Firewall\n\nThe firewall file is copied to:\n\n```text\n/etc/nftables.conf.audiopipe\n```\n\nTo apply it during install:\n\n```bash\nsudo ECAST_APPLY_FIREWALL=1 ./install.sh\n```\n\nReview it before applying on a remote server. It allows TCP 22, 80, 443, 8000 and 8554.\n\n## Debug after failed install\n\nSend these files if something fails:\n\n```bash\nsudo cat /var/log/esact/install-latest.log > /tmp/audiopipe-install-latest.log\nsudo audiopipe-collect-debug\n```\n\nThe debug command prints a path like `/tmp/audiopipe-debug-YYYYMMDD-HHMMSS.tar.gz`.\n\n## Notes for production hardening\n\n- Replace the generated self-signed HTTPS certificate with a trusted certificate before exposing the web admin publicly.\n- Restrict SSH to trusted IPs or VPN if possible.\n- Move secrets from JSON into root-only secret files before final Ansible conversion.\n- Consider a queue/control daemon instead of direct sudo from PHP for larger deployments.\n\n## v4-v5 note: web authentication and time synchronization\n\n- v5 replaces PAM with Nginx HTTP Basic Auth because PAM was unreliable in this deployment.\n- The old `/etc/audiopipe/web-admin-groups` group gate is no longer used.\n- Chrony is installed, time zone is set to Europe/Prague, and time synchronization is configured. Check status with:\n\n```bash\ntimedatectl status\nchronyc tracking\nchronyc sources -v\n```\n\n## v3 note: sudoers recovery\n\nIf v2 failed on `/etc/sudoers.d/audiopipe-web` because of the wildcard in\n`audiopipe-channel@*.service`, use `docs/RECOVERY_FROM_V2.md` or install v3.\nv3 replaces that direct `systemctl` sudo rule with `/usr/local/sbin/audiopipe-restart-channel`.\n\n## v5 note: HTTPS, Prague time zone, and web authentication\n\n- The installer sets the server time zone to `Europe/Prague` and enables chrony.\n- The web admin is HTTPS-only. Port 80 redirects to HTTPS, except the local Icecast auth callback `/audiopipe-auth/icecast.php` from `127.0.0.1`.\n- The installer asks for the public HTTPS hostname and generates a self-signed certificate in `/etc/audiopipe/tls/`.\n- Browsers will show a warning until `/etc/audiopipe/tls/audiopipe.crt` and `/etc/audiopipe/tls/audiopipe.key` are replaced with a trusted certificate.\n- PAM is not used for the web admin anymore. The installer asks for the first web username and password and stores a bcrypt hash in `/etc/audiopipe/web.htpasswd`.\n- For unattended install, set `ECAST_PUBLIC_HOST`, `ECAST_WEB_USER`, and `ECAST_WEB_PASSWORD`.\n\nExample unattended install:\n\n```bash\nECAST_PUBLIC_HOST=web01.estudium.eu \\\nECAST_WEB_USER=admin \\\nECAST_WEB_PASSWORD='change-this-password' \\\nsudo ./install.sh\n```\n\n## v7 note: whiptail installer improvements\n\nv7 keeps the `dialog` installer and adds:\n\n- first screen language selection: `cz` or `en`,\n- UTF-8 whiptail rendering with `NCURSES_NO_UTF8_ACS` unset to avoid broken q/x/m box drawing on SSH/browser terminals,\n- compatibility table before installation: OS, architecture, kernel, CPU cores, RAM, free disk space, detected hostname and IP addresses,\n- hostname prompt; the installer applies it through `hostnamectl set-hostname`,\n- login + password + password confirmation on one screen,\n- optional insertion of an SSH public key into `/root/.ssh/authorized_keys`, prefilled with the provided `ssh-ed25519` key,\n- program branding: `eCast pipe` version `0.2.1`, author `PB`, web `estudium.eu`, email `info@estudium.eu`.\n\nFor SSH/non-interactive usage, environment-variable mode still works:\n\n```bash\nECAST_INSTALL_LANG=cz \\\nECAST_SYSTEM_HOSTNAME=web01.estudium.eu \\\nECAST_PUBLIC_HOST=web01.estudium.eu \\\nECAST_TIMEZONE=Europe/Prague \\\nECAST_ENABLE_CHRONY=1 \\\nECAST_WEB_USER=admin \\\nECAST_WEB_PASSWORD='change-this-password' \\\nECAST_SSH_PUBLIC_KEY='ssh-ed25519 AAAA... your-key-comment' \\\nECAST_APPLY_FIREWALL=0 \\\nsudo ./install.sh\n```\n\nTo force the non-TUI installer even from an interactive shell:\n\n```bash\nsudo ECAST_NO_TUI=1 ./install.sh\n```\n\n## v8 installer notes\n\nThe TUI installer uses UTF-8 box drawing by default for cleaner window borders. If an old SSH client shows broken borders, start it with:\n\n```bash\nECAST_ASCII_LINES=1 sudo ./install.sh\n```\n\nThe time zone selector includes large city presets such as Prague, New York, Los Angeles, London, Paris, Dubai, Tokyo, Singapore and Sydney, plus a custom IANA time zone option.\n\n\nWhiptail rendering now uses safe ASCII whiptail-drawn borders by default. The progress screen is a whiptail gauge, not a custom Unicode renderer.\n\n## Web UI layout v15\n\nThe PHP web UI is now split into local JSON data, static HTML/CSS/JS, and PHP API files:\n\n```text\nphp-app/\n api.php\n bootstrap.php\n icecast.php\n index.php\n data/\n user.json\n settings.json\n channels.json\n recordings.json\n runtime.json\n html/\n index.html\n style.css\n app.js\n logo.png\n```\n\nNginx serves only `php-app/html` as the public web root. PHP files stay one level above the public root and are exposed only through exact FastCGI locations. The UI contains these menu sections: Panel, Kanál / pipe, Recordings and Nastavení. Language switching is CZ/EN with automatic browser-language default.\n\n\n## v0.2 notes\n\n- Installer TUI uses `whiptail` instead of `dialog`.\n- Nginx is not fixed to one domain. It uses `server_name _` and accepts direct IP access or any domain that points to the server.\n- The web UI stores language strings in `/opt/audiopipe/php-app/html/cz.ini` and `/opt/audiopipe/php-app/html/en.ini`.\n- The PHP API has stricter JSON responses to make frontend errors easier to diagnose.\n- HTML, CSS, JS and PHP ownership/permissions are set explicitly during install.\n\n\n## v0.2.1 notes\n\n- Fixes web API routing: Nginx FastCGI routes for `/api.php`, `/index.php`, and `/audiopipe-auth/icecast.php` now use `fastcgi_params` instead of `snippets/fastcgi-php.conf`, avoiding the `try_files` 404 problem.\n- Whiptail progress now shows the current installation output line, including APT and service activity.\n- Compatibility check uses a compact double-line table to avoid wrapped columns.\n- Web UI language files are separate: `php-app/html/cz.ini` and `php-app/html/en.ini`. Installer reference language files are included as `installer/cz.ini` and `installer/en.ini`.", "download_url": "https://update.estudium.eu/download.php?project=dbad8351151b6fd5&release=e621af3fed20eae46b46ad8d77c63f6e", "package_target": "software", "requirements": [], "license": { "id": "MIT", "name": "MIT", "custom_text": "" }, "deployment": { "archive_root": "ecast-pipe-server", "web_root": "." }, "project_type": "application", "hosting": null }