mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 09:14:33 +00:00

History

CyberMind-FR c2990f4d98 feat(peertube,avatar): privilege-separated cookie install via root path-unit (closes #407 ) Replaces the sudo-from-dashboard approach (which required dropping NoNewPrivileges) with a CSPN-clean design: unprivileged dashboards spool the cookies, a root systemd .path watches + installs them. - secubox-peertube: ship peertube-cookie-install.{path,service} (root oneshot runs `peertubectl set-youtube-cookies` + rm's the spool); postinst enables the .path; /import/cookies now just writes the spool (no sudo) → "queued"; restore NoNewPrivileges=true; drop the sudoers file + sudo dep. - secubox-avatar: _apply_youtube writes the spool (no sudo) → "queued"; keeps NoNewPrivileges. poke success keys on cookies; po_token stays experimental.		2026-05-28 12:36:56 +02:00
..
api	feat(peertube,avatar): privilege-separated cookie install via root path-unit (closes #407 )	2026-05-28 12:36:56 +02:00
conf	feat(peertube): native-LXC deployment + dashboard correction + URL import (ref #388 , supersedes #390 )	2026-05-28 08:17:59 +02:00
debian	feat(peertube,avatar): privilege-separated cookie install via root path-unit (closes #407 )	2026-05-28 12:36:56 +02:00
lib/peertube	feat(peertube): native-LXC deployment + dashboard correction + URL import (ref #388 , supersedes #390 )	2026-05-28 08:17:59 +02:00
menu.d	feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306 ) (#307 )	2026-05-21 10:03:05 +02:00
nginx	feat(phase8): Complete all 21 Application modules	2026-04-04 10:04:25 +02:00
sbin	feat(peertube): peertubectl set-youtube-cookies for yt-dlp YouTube import (ref #388 )	2026-05-28 10:17:04 +02:00
www/peertube	feat(peertube): native-LXC deployment + dashboard correction + URL import (ref #388 , supersedes #390 )	2026-05-28 08:17:59 +02:00
README.md	feat(peertube): native-LXC deployment + dashboard correction + URL import (ref #388 , supersedes #390 )	2026-05-28 08:17:59 +02:00

README.md

📺 PeerTube

Federated video platform

Category: Media

Screenshot

Deployment: PeerTube runs natively inside a dedicated Debian LXC (its own peertube.service: Node 22 + PostgreSQL 15 + Redis + ffmpeg), not in Docker/Podman — an unprivileged LXC can't reliably bring up a podman CNI bridge on the Marvell arm64 boards. The host nginx vhost (:9080) proxies the public hostname to the LXC at 10.100.0.120:9000.

Features

Video hosting, channels, users, federation (ActivityPub)
Import from URL (YouTube/Vimeo/direct file) via PeerTube's native HTTP import (yt-dlp) — from the dashboard "Import" tab or PeerTube's own UI
Transcoding settings (HLS, WebTorrent), plugins, storage monitoring
Host dashboard at /peertube/ + /api/v1/peertube/*

Installation

sudo apt install secubox-peertube     # installs the host dashboard daemon
peertubectl install                   # provisions the LXC + native PeerTube
peertubectl status                    # LXC state + HTTP reachability

Then wire the public hostname: add the HAProxy SNI ACL (host_<host> → nginx_vhosts) and an ACME cert. The package ships the nginx vhost at /etc/nginx/sites-available/peertube.conf (symlinked into sites-enabled by postinst).

The first-boot admin password is captured to /etc/secubox/secrets/peertube-admin (rotate it via the web UI; if you do, update that file or the dashboard's write operations re-auth fails).

Configuration

/etc/secubox/peertube.toml — [lxc] (name/ip/path), [peertube] (http_port/admin/transcoding), [exposure] (public_hostname).

API Endpoints

GET /api/v1/peertube/status — real LXC state + HTTP reachability + version
GET /api/v1/peertube/health — health check
POST /api/v1/peertube/import — {target_url, channel_id?, name?, privacy}
GET /api/v1/peertube/imports — recent import jobs
POST /api/v1/peertube/container/{install,start,stop,restart} — LXC lifecycle