Tactical Media Broadcast Hub — initial release

Self-hosted multi-platform broadcast newsroom for activist collectives:
publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style
column wall with hostile-content-safe rendering, live control room with Auto
Director, bridged chat governance with polls and quorum, distributed sandboxed
transcode workers, encrypted content-addressed archive, monthly analytics.

MIT licensed. See README.md and docs/.

infra/matrix/.env.example

@@ -0,0 +1,3 @@
+MATRIX_SERVER_NAME=chat.example.com
+MATRIX_ALLOW_REGISTRATION=false
+MATRIX_REGISTRATION_TOKEN=generate-a-long-random-token

infra/matrix/conduwuit.toml

@@ -0,0 +1,10 @@
+# Conduwuit config — see docs/matrix-setup.md before changing
+[global]
+server_name = "chat.example.com"        # MUST match MATRIX_SERVER_NAME — permanent
+port = 6167
+database_path = "/var/lib/conduwuit"
+allow_registration = false              # flip via env only during initial setup
+registration_token = "change-me"
+allow_federation = true
+allow_encryption = true
+rich_text = true                        # markdown/HTML in messages

infra/matrix/docker-compose.yml

@@ -0,0 +1,34 @@
+# Matrix homeserver (conduwuit) for Tactical Media Broadcast Hub team chat — runs on the app or media server.
+# Lightweight Rust server: single container, SQLite or RocksDB backend, no postgres required.
+# Docs: docs/matrix-setup.md (branding, bridges, Tactical Media Broadcast Hub integration)
+
+services:
+  conduwuit:
+    image: girlbossceo/conduwuit:latest
+    restart: unless-stopped
+    ports:
+      - "6167:6167"          # client/API + federation (put behind HTTPS reverse proxy)
+    volumes:
+      - conduwuit_data:/var/lib/conduwuit
+      - ./conduwuit.toml:/etc/conduwuit/conduwuit.toml:ro
+    environment:
+      CONDUWUIT_SERVER_NAME: ${MATRIX_SERVER_NAME}   # e.g. chat.example.com — CHANGES ARE PERMANENT
+      CONDUWUIT_DATABASE_PATH: /var/lib/conduwuit
+      CONDUWUIT_PORT: 6167
+      CONDUWUIT_ALLOW_REGISTRATION: ${MATRIX_ALLOW_REGISTRATION:-false}  # open only for the first admin, then lock
+      CONDUWUIT_REGISTRATION_TOKEN: ${MATRIX_REGISTRATION_TOKEN}         # invite-code style registration
+      CONDUWUIT_MAX_ROOM_MEMBERSHIP: 5000
+
+  # Telegram user-bridge (WP15: join/amplify from Telegram channels; DMs; two-way)
+  # Requires a one-time interactive login: docker compose run --rm mautrix-telegram
+  mautrix-telegram:
+    image: dock.mau.dev/mautrix/telegram:latest
+    restart: unless-stopped
+    volumes:
+      - mautrix_telegram_data:/data
+    depends_on:
+      - conduwuit
+
+volumes:
+  conduwuit_data:
+  mautrix_telegram_data: