Tactical Media Broadcast Hub — initial release

Self-hosted multi-platform broadcast newsroom for activist collectives:
publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style
column wall with hostile-content-safe rendering, live control room with Auto
Director, bridged chat governance with polls and quorum, distributed sandboxed
transcode workers, encrypted content-addressed archive, monthly analytics.

MIT licensed. See README.md and docs/.

infra/docker-compose.yml

@@ -0,0 +1,108 @@
+name: tactical-media-broadcast-hub
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: superposter
+      POSTGRES_PASSWORD: superposter_dev
+      POSTGRES_DB: superposter
+    ports: ["5433:5432"]
+    volumes: [pgdata:/var/lib/postgresql/data]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U superposter"]
+      interval: 5s
+      retries: 10
+
+  redis:
+    image: redis:7-alpine
+    ports: ["6379:6379"]
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      retries: 10
+
+  temporal:
+    image: temporalio/auto-setup:1.24
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      DB: postgres12
+      DB_PORT: 5432
+      POSTGRES_USER: superposter
+      POSTGRES_PWD: superposter_dev
+      POSTGRES_SEEDS: postgres
+    ports: ["7233:7233"]
+
+  minio:
+    image: minio/minio:latest
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: superposter
+      MINIO_ROOT_PASSWORD: superposter_dev
+    ports: ["9000:9000", "9001:9001"]
+    volumes: [miniodata:/data]
+
+  otel-collector:
+    image: otel/opentelemetry-collector-contrib:latest
+    command: ["--config=/etc/otel-collector-config.yaml"]
+    volumes:
+      - ./otel/otel-collector-config.yaml:/etc/otel-collector-config.yaml:ro
+    ports: ["4317:4317", "4318:4318"]
+
+  prometheus:
+    image: prom/prometheus:latest
+    volumes:
+      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+    ports: ["9090:9090"]
+
+  grafana:
+    image: grafana/grafana:latest
+    environment:
+      GF_AUTH_ANONYMOUS_ENABLED: "true"
+      GF_AUTH_ANONYMOUS_ORG_ROLE: Admin
+    volumes:
+      - ./grafana/provisioning:/etc/grafana/provisioning:ro
+    ports: ["3001:3000"]
+
+  mock-rtmp-sink:
+    image: tiangolo/nginx-rtmp:latest
+    volumes:
+      - ./mock-rtmp/nginx-rtmp.conf:/etc/nginx/nginx.conf:ro
+    ports: ["1935:1935"]
+    profiles: ["dev"]
+
+  media-worker:
+    build:
+      context: ..
+      dockerfile: infra/media-worker.Dockerfile
+    environment:
+      PORT: "3100"
+      REDIS_HOST: redis
+      MEDIA_WORKER_ID: media-worker-dev
+      MEDIA_FENCE_PATH: /var/lib/media-worker/fence.json
+      POSTGRES_HOST: postgres
+      TEMPORAL_HOST: temporal:7233
+      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
+    ports: ["3100:3100"]
+    volumes:
+      - mediaworkerstate:/var/lib/media-worker
+    depends_on:
+      redis:
+        condition: service_healthy
+    profiles: ["dev"]
+
+  mock-live-source:
+    image: jrottenberg/ffmpeg:6-alpine
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - "ffmpeg -re -f lavfi -i testsrc2=size=640x360:rate=30 -f lavfi -i sine=frequency=440 -c:v libx264 -preset veryfast -tune zerolatency -c:a aac -f flv rtmp://mock-rtmp-sink/mock/A-live"
+    depends_on:
+      - mock-rtmp-sink
+    profiles: ["dev"]
+
+volumes:
+  pgdata:
+  miniodata:
+  mediaworkerstate: