Files

T

timothy 2d6f78e379 fix(617): make the cross-repo skills real symlinks and reconcile the ersatztv skill

`.claude/skills/jellyfin/` was a real directory holding a stale fork of the
canonical server-management copy, not the symlink CLAUDE.md described. It
documented `X-Emby-Token` as *the* auth pattern (v12 only accepts it via
`EnableLegacyAuthorization`, slated for removal in v13) and omitted the
`DELETE /Items/{id}` data-loss warning that has destroyed files three times.
Replaced with a relative symlink, matching the pattern server-management
already uses for beets/radarr/sonarr.

`.claude/skills/ersatztv/` had diverged in BOTH directions, so a replace in
either direction would have lost correct content. Contrary to the issue's
framing, server-management's copy was stale only in its `description:` — its
body already said "Full REST CRUD is available under /api/v1" and carried
~150 lines the ersatztv copy lacked (backup/deploy, test/prod topology,
streaming-mode analysis, VAAPI-vs-QSV, table schema notes, checklists). So
that file is the base, reconciled here as the canonical copy:

- fixed the dangerous `description:` claiming CRUD requires SQLite scripting
- ported ersatztv-only content: the silent root-owned api.key 401 trap, the
  lying OCI labels, the local-vs-UTC log timestamp trap, the endpoint-index
  pointer, `settings/ffmpeg` ordering, scoped test-image refresh
- added the #616 paging facts (0-based pageNum, per-endpoint pageSize cap,
  playout/reset takes a CHANNEL id) per the request on #617
- corrected prod auto-update: `auto_update: false`, manual DeployStack only,
  no 03:00 fallback (contradicted the fork's CLAUDE.md)
- corrected the ErsatzTV library ids: Music Videos is 16 and Standup 14, not
  8/9 — verified live via GET /api/v1/media-sources
- unpinned the stale v26.8.0 image reference (current release is v26.12.0)

fixes #617

2026-07-26 00:34:09 +02:00

12 KiB

Raw Blame History

ErsatzTV Fork

Custom IPTV channel server for Jellyfin. Forked from ErsatzTV/ErsatzTV after upstream archival (Feb 2026, v26.3.0). Our fork lives on Gitea.

Architecture

UI: ChicoryTV React SPA (web/, Vite, served at /app) over the REST API — the ONLY UI. The legacy Blazor Server UI (MudBlazor) was removed in #91 phase (b); root / and every legacy route now 302 to /app, either via an explicit redirect in ErsatzTV/LegacyUiRedirects.cs or the Startup catch-all fallback (any unmatched non-/api//artwork//docs//openapi path → /app). Historical parity work: media detail pages + image folder browser landed via #141 (PR #183); scheduling parity #144/#162, #141/#158/#161/#180, #145, #151/#152/#153/#155, and the media-source write API/SPA #202 are all DONE.
Pattern: CQRS via MediatR — queries/commands in ErsatzTV.Application/
Database: EF Core (SQLite default, MySQL optional) — context in ErsatzTV.Infrastructure/Data/TvContext.cs

Key Files

M3U generation: ErsatzTV.Core/Iptv/ChannelPlaylist.cs → ToM3U()
XMLTV generation: ErsatzTV.Application/Channels/Queries/GetChannelGuideHandler.cs
IPTV controller: ErsatzTV/Controllers/IptvController.cs — /iptv/* routes
Logo generation: ErsatzTV.Core/Images/ChannelLogoGenerator.cs
Channel entities: ErsatzTV.Core/Domain/Channel.cs
DB context: ErsatzTV.Infrastructure/Data/TvContext.cs

Deployment

Docker host: jazz (192.168.1.29), container ersatztv, port 8409. Media transcoders (Jellyfin, ersatztv, ersatztv-test) moved here from bumblebee on 2026-07-20 (server-management#633); bumblebee (192.168.1.99) still hosts the CI runners and the rest of the stacks. Name-reuse trap: jazz was an earlier name for the .99 host, so pre-2026-07-20 docs/commits saying "jazz" mean today's bumblebee — go by the IP, not the name.
Config volume: ~/downloadswarm/ersatztv/ on jazz → /config in container
SQLite DB: /config/ersatztv.sqlite3 (WAL mode, root-owned)
Images (our fork, built by .gitea/workflows/docker-build.yml → 192.168.1.95:3000/timothy/ersatztv): push to main → :latest + :<sha> (test image); push v* tag → :prod + :<version> + :<sha>. Prod's Komodo GitOps stack — named jazz-media (the compose project is still media-servers; a dead media-servers stack lingers on bumblebee) — follows floating :prod; after the immutable :<version> candidate passes the release scans, manually DeployStack jazz-media. There is no auto-update fallback (auto_update: false) — promotion is manual. Both paths run the fail-closed pre-deploy backup and prod-copy migration smoke before recreation. Test tracks :latest. Pipeline details: docs/ci-cd.md.

Development

# Docker build
docker build -f docker/Dockerfile -t ersatztv:dev .

Conventions

Read docs/contributing.md before non-trivial changes — it documents the established patterns (layering, CQRS handlers, LanguageExt, the ChicoryTV SPA, EF Core + dual-provider migrations, the FFmpeg pipeline, analyzers, testing) and the deviation policy: match the established style; diverge only with a concrete, stated reason.
Docs-first is a HARD RULE — read before you explore: before ANY API / SPA / E2E / parity / scheduling work, read the docs/README.md task-signal map and only the sections it points to for your task — not the whole corpus. Do NOT reverse-engineer conventions from source (Grep/Read) before reading these — they exist precisely so you don't. Only recon the task-specific delta the docs deliberately don't freeze (a merged endpoint's exact DTO, a Blazor page's field list). This applies to delegated subagents too: tell each agent which doc section to read; never let one re-derive conventions from code. Decision/convention lookups start at the active catalog, docs/decisions/README.md — resolve by topic/key, never by chasing a file path named in a historical comment (the breadcrumb rule; see docs/README.md → "Knowledge retrieval").

Docs-update is part of "done" — same PR, never a follow-up: any PR that changes a convention, adds/migrates/redirects a route, adds/changes a /api/* endpoint, or reverses a decision MUST update the relevant doc in that same PR:

Change	Update in the same PR
Migrate / add / redirect a route (new `web/src/screens/*.tsx`, `LegacyUiRedirects.cs`)	`docs/blazor-route-parity.md` + `docs/domain-model.md`
Add / change a `/api/*` endpoint	`docs/api-conventions.md` checklist, then regenerate `v1.json` + `endpoint-index.md` via `./scripts/update-openapi.sh`
Change a SPA screen convention	`docs/spa-conventions.md`
Establish / reverse a convention or decision	a new `docs/decisions/records/<area>/<topic>.md` (filename = key; lifecycle: add record, `git mv` predecessor to `archive/<area>/`) + regenerate the catalog + the affected doc
Add / remove / retitle a doc	`docs/README.md` index

The docs-reminder CI job flags a screen/route change that skips blazor-route-parity.md, but it's a non-blocking nudge — the rule is on you, not the check.

Follow existing MediatR CQRS pattern for new features
Domain logic in ErsatzTV.Core, infrastructure in ErsatzTV.Infrastructure
Keep UI thin: the SPA talks to /api/* only; controllers delegate to MediatR handlers. All UI is in the SPA (web/)
Test with NUnit + Shouldly + NSubstitute (the existing *.Tests projects); xUnit is not used here
Dependencies use Central Package Management: versions live in the repo-root Directory.Packages.props; csproj reference packages by name only. Add/upgrade by editing the central <PackageVersion> — never put Version= back on a <PackageReference> (trips NU1008). See docs/ci-cd.md → Dependency management.
DB migrations target BOTH providers: a TvContext model change needs a migration in ErsatzTV.Infrastructure.Sqlite and ErsatzTV.Infrastructure.MySql — run scripts/add-migration.sh <Name> (does both). CI's migrations job enforces model-drift + apply-to-fresh-DB per provider. See docs/ci-cd.md → Migration integrity.
Renovate is live (.gitea/workflows/renovate.yml, weekly + workflow_dispatch): opens dependency-update + OSV vuln-fix PRs and a Dependency Dashboard issue; patch bumps to test/dev-only packages auto-merge once Build & test passes (their review-verdict/h10 required check is auto-passed as a bot PR — unless they touch .claude//.gitea//.husky//scripts//docker/ci/, which need a real verdict), the rest are manual. Cross-repo rollout: server-management#484. See docs/ci-cd.md → Dependency management.
Versioning: release tags are vYY.<release-seq>.<patch> (year · sequential release-within-year · patch) — inherited from upstream, not year.month. v26.3.1 = our infra rebuild of upstream 26.3.0 (no app changes); v26.4.0 is reserved for the first release with app changes. Never [skip ci] a commit you'll tag (it suppresses the release build). Full policy: docs/ci-cd.md → Versioning & releases.
Backlog tracked via Gitea Issues

Task Completion Protocol

Every task that closes a Gitea issue MUST complete ALL of these before it is considered done. Use /done <issue> to run through this automatically.

Merge-consent is derived from state, not asserted (## Done-when convention — ersatztv#303 H6 + H10). Any issue whose PR will merge to main should carry a ## Done-when section in its issue body — a checklist of completion criteria (always include an "adversarial review passed" box; add per-issue criteria like tests-green, docs-updated, live-E2E). Two hooks derive merge-consent from it so a premature merge is blocked by construction, not by memory:

pretooluse-merge-consent.sh (Claude PreToolUse on the Gitea merge tool) — auto-grants a merge (emits permissionDecision: allow, so no redundant mechanical prompt fires) only when the PR's CI is green and every ## Done-when box on the linked issue (fixes #N) is ticked and a Review-verdict: comment references the PR's current head sha (H10); denies on an unticked box, red CI, or a stale/negative review verdict; asks (falls back to a human prompt) when it can't derive state (no linked issue, no ## Done-when section, no Review-verdict: comment yet, no creds, Gitea down). On the auto-grant (satisfied) path the derived state is the consent — do not also ask conversationally to merge; a separate human confirmation is warranted only when the gate asks (ersatztv#314). The H10 review-verdict convention: after an adversarial/Codex review of a PR (or its latest fix commit), run scripts/post-review-verdict.sh <pr> <MERGEABLE|APPROVED|BLOCKED|NOT-MERGEABLE> [note] — it posts both the Review-verdict: … @ <head-sha> comment and the sha-bound review-verdict/h10 commit status, proving the latest commit was reviewed rather than a stale earlier diff (ersatztv#242). Do not hand-write the comment: the status is the required check branch protection enforces, and a comment alone leaves it absent.
The gate is enforced server-side, per sha (ersatztv#622). review-verdict/h10 is a required status check on main. Because a commit status belongs to one sha, a commit pushed after an auto-merge is scheduled clears it and blocks the merge — closing the hole where merge_when_checks_succeed froze consent at scheduling time and Gitea later merged an unreviewed head. Renovate-authored and docs-only PRs are auto-passed by .gitea/workflows/review-verdict.yml, except when they touch .claude/, .gitea/, .husky/, scripts/ or docker/ci/. See docs/ci-cd.md → Review-verdict gate.
.husky/pre-push → prepush-donewhen.sh — a fail-open backstop that blocks a direct git push origin main whose commits fix #N an issue with unticked boxes.

Both need Gitea read creds in the env to enforce (ETV_GITEA_BASICAUTH=user:pass or ETV_GITEA_TOKEN; ETV_GITEA_URL overrides the base). Without them the merge hook asks and the push backstop is a no-op — the gate degrades to today's manual confirmation, never a silent pass. Docs-only PRs/pushes are exempt.

The 7 mandatory completion steps and the ## Closing record comment template live in the closing-an-issue skill (.claude/skills/closing-an-issue/SKILL.md) — invoke it (or /done) when finishing a task that closes an issue.

Project Boundaries

ersatztv OWNS: ErsatzTV fork code (C#/.NET), channel/collection/schedule management, M3U/XMLTV generation, and the ersatztv skill — whose canonical copy is .claude/skills/ersatztv/SKILL.md here; ~/server-management/.claude/skills/ersatztv is a symlink to it (ersatztv#617). Edit it in this repo; never fork a second copy.

ersatztv does NOT own:

Docker compose configs → server-management (~/downloadswarm/stacks/ersatztv/)
NFS mounts, Ansible, DNS, networking → server-management
Content sourcing (yt-dlp downloads, Sonarr/Radarr libraries) → media-management (planned)
Jellyfin skill → server-management. .claude/skills/jellyfin here is a relative symlink to ~/server-management/.claude/skills/jellyfin (ersatztv#617 — it had silently become a stale divergent copy). It therefore resolves only in a checkout at ~/ersatztv, not inside a git worktree; that is inherent to the cross-repo symlink pattern server-management already uses (beets, radarr, sonarr, …).

For infrastructure changes (Docker, NFS, ports, Authelia): open an issue in timothy/server-management.

For content/media sourcing questions (what goes into channels, yt-dlp pipelines): open an issue in timothy/media-management once it exists; for now, timothy/server-management.

For plan/audit reviews: open ~/adversarial-reviewer before significant architecture changes.

Full cross-project rules: ~/homelab-docs/Operations/Project Boundaries.md (https://docs.tblindustries.be). ErsatzTV docs: ~/homelab-docs/Docker/ErsatzTV.md + project-local docs/ (fork strategy, channels, M3U/XMLTV).

12 KiB Raw Blame History