MediaMtx mpv streaming support and QoL functions

.goosehints

@@ -129,7 +129,14 @@ before improvising a new pattern.
   centralized services."
 - `registry.host` / `registry.user` are values in the root `values.yaml` —
   reference them, don't hardcode `forge.keane.sh`/`ian` in new charts.
-
+- For any service whose image you personally build/push (e.g. `zoitestream`,
+  `mcp-auth-proxy`, `repertory-api`) — as opposed to an official upstream
+  image — set `imagePullPolicy: Always` on that container. These use
+  floating `:latest` tags with no digest pinning, and this is a single-node
+  cluster where Kubernetes will otherwise happily reuse a stale cached
+  image after you push a new one, requiring a manual `kubectl delete pod`
+  to force a repull. `imagePullPolicy: Always` makes every pod
+  restart/reschedule actually check the registry.
 ## Databases
 
 - One shared Postgres in the `data` group/namespace (`postgres`), used by

Makefile

@@ -1,4 +1,4 @@
-.PHONY: init plan apply destroy clean kubeconfig talosconfig argocd-password bootstrap decrypt post-apply build-mcp-auth-proxy
+.PHONY: init plan apply destroy clean kubeconfig talosconfig argocd-password bootstrap decrypt post-apply build-mcp-auth-proxy stream-url
 
 SECRET ?= dumpnet
 FORGEJO_REGISTRY ?= forge.keane.sh
@@ -79,6 +79,16 @@ argocd-password:
 	  --query SecretString --output text | python3 -c \
 	  "import sys,json; print(json.load(sys.stdin)['cluster']['argocd_admin_password'])"
 
+# Build the current RTMP publish URL from the dumpnet secret (mediamtx.*)
+# — handy for testing without going through the IRC bot, since the
+# zoitestream API is cluster-internal only.
+stream-url:
+	@aws secretsmanager get-secret-value --secret-id $(SECRET) \
+	  --query SecretString --output text | python3 -c \
+	  "import sys, json; \
+	  d = json.load(sys.stdin)['mediamtx']; \
+	  print(f\"rtmp://stream.dumpnet.chat:1935/live?user=streamer&pass={d['publish_password']}\")"
+
 # Decrypt sensitive files to /tmp for one-off talosctl use
 # Files are never decrypted in the repo directory
 decrypt:

charts/mediamtx/templates/mediamtx.yaml

@@ -99,6 +99,20 @@ spec:
     - port: 80
       targetPort: 5000
 ---
+# HLS Service — MediaMTX's HTTP HLS server, for browser playback and
+# direct mpv/ffmpeg consumption of the raw .m3u8 playlist.
+apiVersion: v1
+kind: Service
+metadata:
+  name: mediamtx-hls
+  namespace: mediamtx
+spec:
+  selector:
+    app: mediamtx
+  ports:
+    - port: 8888
+      targetPort: 8888
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -116,10 +130,38 @@ spec:
     - host: stream.{{ .Values.domain }}
       http:
         paths:
-          - path: /
+          - path: /api
             pathType: Prefix
             backend:
               service:
                 name: zoitestream
                 port:
                   number: 80
+          - path: /hooks
+            pathType: Prefix
+            backend:
+              service:
+                name: zoitestream
+                port:
+                  number: 80
+          - path: /health
+            pathType: Exact
+            backend:
+              service:
+                name: zoitestream
+                port:
+                  number: 80
+          - path: /
+            pathType: Exact
+            backend:
+              service:
+                name: zoitestream
+                port:
+                  number: 80
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: mediamtx-hls
+                port:
+                  number: 8888