add app for each plugin

2026-09-13 19:47:17 +02:00
parent 39f82e1f96
commit cb067ee50f
84 changed files with 7072 additions and 3 deletions
@@ -0,0 +1,179 @@
+name: metafeederyoutube
+
+# =============================================================================
+# MetaFeeder · YouTube — the DELEGATED playback tier for MetaMesh.
+#
+# ⚠ No bytes are ever fetched, transported or seeded by this feeder. It resolves
+# a reference — an 11-character video id — and playback happens on YouTube. That
+# is the whole design, and it is why the feeder is cheap and why a dead upstream
+# instance is a retry rather than a broken stream.
+#
+# Video ids are read through a POOL of public Piped instances, tried in order.
+# Measured during the source study: of four instances, one 502'd, two
+# 301-redirected away and one answered. The pool is the mitigation; do not pin
+# it to a single hostname.
+#
+# It needs, over the shared `pcs` network:
+#   - the **MetaGateway** app — which must list this feeder's URL
+#     (`http://metafeederyoutube-feeder:8080`) in its feeders config so it gets discovered.
+#     Discovery is startup-only, so restart the gateway afterwards.
+#
+# Everything is scoped under the `metafeederyoutube-*` prefix + the per-stack `metafeederyoutube` network +
+# /DATA/AppData/metafeederyoutube/ data root, so it installs beside the other Meta* apps with
+# zero collisions.
+# =============================================================================
+
+services:
+  # ---------------------------------------------------------------------------
+  # metafeederyoutube-feeder — the feeder itself. The gateway reaches it directly on
+  # `pcs` for discovery/query/compute; the human sees it through the AppShield
+  # gate below.
+  # ---------------------------------------------------------------------------
+  metafeederyoutube-feeder:
+    image: ghcr.io/worph/meta-feeder-youtube:1.1.1
+    cpu_shares: 30
+    container_name: metafeederyoutube-feeder
+        # Delegated tier: it moves an 11-character video id, never bytes.
+        # Swap disabled (memswap_limit == mem_limit) → OOM instead of thrash.
+    mem_limit: 256m
+    memswap_limit: 256m
+    hostname: metafeederyoutube-feeder
+    restart: unless-stopped
+    user: "0:0"
+    expose:
+      - 8080
+    environment:
+      RUST_LOG: "info,meta_feeder=info,youtube_feeder=info"
+      META_FEEDER_STATE_DIR: "/data/meta-feeder"
+      TZ: "$TZ"
+    volumes:
+      # Persist feeder config.json + redb cache so it survives recreate.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederyoutube/state:/data/meta-feeder:rw
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:8080/health"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+      start_period: 5s
+    networks:
+      - metafeederyoutube
+      - pcs
+
+  # ---------------------------------------------------------------------------
+  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
+  # container_name == subdomain prefix (the auth-registrar derives the client_id
+  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
+  # ---------------------------------------------------------------------------
+  metafeederyoutube:
+    image: ghcr.io/yundera/appshield:2.0.9
+    cpu_shares: 80
+    container_name: metafeederyoutube
+    hostname: metafeederyoutube
+    restart: unless-stopped
+    user: "0:0"
+    expose:
+      - 80
+    environment:
+      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
+      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      BACKEND_HOST: "metafeederyoutube-feeder"
+      BACKEND_PORT: "8080"
+      LISTEN_PORT: "80"
+    labels:
+      caddy_0: metafeederyoutube-${APP_DOMAIN}
+      caddy_0.import: gateway_tls
+      caddy_0.reverse_proxy: "{{upstreams 80}}"
+      caddy_1: metafeederyoutube-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1.import: gateway_tls
+      caddy_1.reverse_proxy: "{{upstreams 80}}"
+      caddy_2: metafeederyoutube-${APP_PUBLIC_IP_DASH}.sslip.io
+      caddy_2.reverse_proxy: "{{upstreams 80}}"
+    depends_on:
+      - metafeederyoutube-feeder
+    networks:
+      - metafeederyoutube
+      - pcs
+
+networks:
+  metafeederyoutube:
+    name: metafeederyoutube
+    driver: bridge
+  pcs:
+    name: ${APP_NET:-pcs}
+    external: true
+
+x-casaos:
+  architectures:
+    - amd64
+    - arm64
+  author: Worph Team
+  category: Media
+  developer: Aptero Team
+  main: metafeederyoutube
+  webui_port: 80
+  index: /config
+
+  description:
+    en_us: |
+      **YouTube as a delegated playback tier for MetaMesh.**
+
+      MetaFeeder · YouTube resolves a *reference*, not a file: playback happens on
+      YouTube and **no bytes are ever transported or seeded**. That makes it the
+      cheapest way to make a catalogue playable — and the one tier that adds
+      nothing to the swarm.
+
+      Video ids are read through a pool of public **Piped** instances, rotating
+      past a dead one. Keyless, nothing to configure.
+      **Pairs with MetaFeeder · MusicBrainz**, which names the recording a
+      candidate has to match (±10 s runtime) before it is accepted.
+      **Requires:** **MetaGateway** — its meta-core stores the resolved records and
+      announces them to the swarm. The gateway must list this feeder in its config.
+    fr_fr: |
+      **YouTube comme couche de lecture déléguée pour MetaMesh.**
+
+      MetaFeeder · YouTube résout une *référence*, pas un fichier : la lecture a
+      lieu sur YouTube et **aucun octet n'est transporté ni partagé**. Les
+      identifiants vidéo sont lus via un pool d'instances **Piped** publiques.
+      Sans clé. **Va avec MetaFeeder · MusicBrainz**. **Nécessite** l'app
+      **MetaGateway**.
+  tagline:
+    en_us: YouTube references for MetaMesh — delegated playback, no bytes seeded
+    fr_fr: Références YouTube pour MetaMesh — lecture déléguée, aucun octet partagé
+
+  title:
+    en_us: MetaFeeder · YouTube
+
+  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederYouTube/icon.png
+  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederYouTube/thumbnail.png
+
+  store_app_id: metafeederyoutube
+  is_uncontrolled: false
+
+  tips:
+    before_install:
+      en_us: |
+        **Install order:** install **MetaGateway** first (its meta-core stores and
+        announces what this feeder finds).
+
+        **After installing this app:** in **MetaGateway**, add this feeder from the
+        dashboard's *Add a feeder* box — name `youtube-feeder`, URL `http://metafeederyoutube-feeder:8080`.
+        The gateway restarts itself: feeder discovery is startup-only.
+        No API key. For music, also install **MetaFeeder · MusicBrainz** — it
+        names the recording a YouTube candidate must match before it is accepted.
+        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+
+# Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
+# schema_version 2 is required for `folders`: an older Maison refuses the app
+# outright rather than starting it without its directories.
+x-compose-app:
+  schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metafeederyoutube/state
+      user: $PUID
+      group: $PGID
+  # Same string as the caddy_0 label, so the tile link and the route agree.
+  webui-host: metafeederyoutube-${domain}
+  webui-path: "/config"
@@ -0,0 +1,35 @@
+# MetaFeeder · YouTube — Rationale
+
+## What deviation / exception is being requested
+
+`metafeederyoutube-feeder` runs `user: 0:0`.
+
+## Why it is necessary
+
+Carried over unchanged from the MetaFeeder listings this app is a sibling of, so the
+feeder behaves exactly as they do. The MetaFeeder images write their state and redb
+cache as the container user and some reach MetaCore's root-owned tree; a uid-1000
+process is refused.
+
+## Security mitigations in place
+
+- Public ingress terminates at the AppShield sidecar (`ghcr.io/yundera/appshield:2.0.9`),
+  which gates every path behind the PCS's Authelia SSO over OIDC. The feeder carries no
+  Caddy labels and publishes no host port, so it is reachable only from the `pcs` Docker
+  network.
+- The container mounts **no user directories** — not `/DATA/Documents`, `/DATA/Downloads`,
+  `/DATA/Media` or `/DATA/Gallery`. Its only bind is its own state under
+  `/DATA/AppData/metafeederyoutube/`, declared in `x-compose-app.folders` and owned `$PUID:$PGID`.
+- `cpu_shares` and a hard `mem_limit` (swap disabled) set on every service; image tags
+  pinned; no `:latest`.
+
+## Alternatives considered and rejected
+
+- **Run as `$PUID:$PGID`.** Not validated for this image; the sibling MetaFeeder apps all
+  run `0:0`, and changing the runtime user here would make this listing the odd one out
+  for no measured benefit.
+
+## Data protection
+
+The feeder holds no user media. Its entire state lives under `/DATA/AppData/metafeederyoutube/`, which
+is the unit Maison archives on uninstall and restores from backup.