Tactical Media Broadcast Hub — initial release

Self-hosted multi-platform broadcast newsroom for activist collectives:
publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style
column wall with hostile-content-safe rendering, live control room with Auto
Director, bridged chat governance with polls and quorum, distributed sandboxed
transcode workers, encrypted content-addressed archive, monthly analytics.

MIT licensed. See README.md and docs/.

infra/occupymedia/docker-compose.yml

@@ -0,0 +1,185 @@
+# Production deployment — occupymedia.cc
+# One box, everything behind the Cloudflare tunnel (no inbound ports).
+# See DEPLOY.md. Ports bind to 127.0.0.1 ONLY — the tunnel reaches them on localhost.
+
+name: occupymedia
+
+services:
+  # ---------- core ----------
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-occupymedia}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
+      POSTGRES_DB: ${POSTGRES_DB:-occupymedia}
+    volumes: [pgdata:/var/lib/postgresql/data]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-occupymedia}"]
+      interval: 5s
+      retries: 10
+    restart: unless-stopped
+
+  redis:
+    image: redis:7-alpine
+    command: ["redis-server", "--appendonly", "yes"]
+    volumes: [redisdata:/data]
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      retries: 10
+    restart: unless-stopped
+
+  temporal:
+    image: temporalio/auto-setup:1.24
+    depends_on:
+      postgres: { condition: service_healthy }
+    environment:
+      DB: postgres12
+      DB_PORT: 5432
+      POSTGRES_USER: ${POSTGRES_USER:-occupymedia}
+      POSTGRES_PWD: ${POSTGRES_PASSWORD:?}
+      POSTGRES_SEEDS: postgres
+    restart: unless-stopped
+
+  # ---------- app (built from the repo; see Dockerfile) ----------
+  api:
+    build:
+      context: ../..
+      dockerfile: infra/occupymedia/Dockerfile
+      args: { APP: api }
+    environment: &appenv
+      PORT: "3000"
+      DATABASE_URL: postgres://${POSTGRES_USER:-occupymedia}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-occupymedia}
+      REDIS_HOST: redis
+      TEMPORAL_HOST: temporal:7233
+      S3_ENDPOINT: https://${CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com
+      S3_REGION: auto
+      S3_ACCESS_KEY: ${R2_ACCESS_KEY:?}
+      S3_SECRET_KEY: ${R2_SECRET_KEY:?}
+      S3_BUCKET: occupymedia-media-encrypted
+      S3_KEK: ${S3_KEK:?generate once, never rotate casually — it wraps every stored blob}
+      WEB_ORIGIN: https://app.occupymedia.cc
+      API_PUBLIC_URL: https://api.occupymedia.cc
+    ports: ["127.0.0.1:3000:3000"]
+    depends_on:
+      postgres: { condition: service_healthy }
+      redis: { condition: service_healthy }
+    restart: unless-stopped
+
+  scheduler:
+    build:
+      context: ../..
+      dockerfile: infra/occupymedia/Dockerfile
+      args: { APP: scheduler }
+    environment:
+      <<: *appenv
+      PORT: "3010"
+    depends_on:
+      postgres: { condition: service_healthy }
+      redis: { condition: service_healthy }
+      temporal: { condition: service_started }
+    restart: unless-stopped
+
+  web:
+    build:
+      context: ../..
+      dockerfile: infra/occupymedia/Dockerfile
+      args:
+        APP: web
+        NEXT_PUBLIC_API_URL: https://api.occupymedia.cc
+    environment:
+      <<: *appenv
+      PORT: "3001"
+    ports: ["127.0.0.1:3001:3001"]
+    depends_on: [api]
+    restart: unless-stopped
+
+  media-worker:
+    build:
+      context: ../..
+      dockerfile: infra/media-worker.Dockerfile
+    environment:
+      <<: *appenv
+      PORT: "3100"
+      MEDIA_WORKER_ID: worker-1
+      MEDIA_FENCE_PATH: /var/lib/media-worker/fence.json
+      POSTGRES_HOST: postgres
+      REDIS_HOST: redis
+      PEERTUBE_PUSH_URL: rtmp://peertube:1935/live   # internal; live ingest only
+    volumes: [mediaworkerstate:/var/lib/media-worker]
+    depends_on:
+      redis: { condition: service_healthy }
+    restart: unless-stopped
+
+  # ---------- front door ----------
+  cloudflared:
+    image: cloudflare/cloudflared:latest
+    command: ["tunnel", "--no-autoupdate", "run"]
+    environment:
+      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN:?}
+    depends_on: [api, web, peertube, conduwuit]
+    restart: unless-stopped
+
+  # ---------- video plane ----------
+  peertube:
+    image: chocobozzz/peertube:production-bookworm
+    env_file: peertube.env
+    ports: ["127.0.0.1:9000:9000"]
+    volumes:
+      - peertube_config:/app/config
+      - peertube_assets:/app/storage/client-overrides
+    depends_on:
+      peertube-postgres: { condition: service_healthy }
+      peertube-redis: { condition: service_started }
+      postfix: { condition: service_started }
+    restart: unless-stopped
+
+  peertube-postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: peertube
+      POSTGRES_PASSWORD: ${PEERTUBE_DB_PASSWORD:?set in peertube.env}
+      POSTGRES_DB: peertube
+    volumes: [peertube_pgdata:/var/lib/postgresql/data]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U peertube"]
+      interval: 5s
+      retries: 10
+    restart: unless-stopped
+
+  peertube-redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+
+  postfix:
+    image: mwader/postfix-relay
+    environment:
+      - POSTFIX_myhostname=tube.occupymedia.cc
+    restart: unless-stopped
+
+  # ---------- chat plane ----------
+  conduwuit:
+    image: girlbossceo/conduwuit:latest
+    volumes:
+      - conduwuit_data:/var/lib/conduwuit
+      - ./conduwuit.toml:/etc/conduwuit/conduwuit.toml:ro
+    ports: ["127.0.0.1:8448:6167"]
+    restart: unless-stopped
+
+  # Telegram bridge — first run is interactive: docker compose run --rm mautrix-telegram
+  mautrix-telegram:
+    image: dock.mau.dev/mautrix/telegram:latest
+    volumes: [mautrix_telegram_data:/data]
+    depends_on: [conduwuit]
+    profiles: ["bridges"]
+    restart: unless-stopped
+
+volumes:
+  pgdata:
+  redisdata:
+  mediaworkerstate:
+  peertube_pgdata:
+  peertube_config:
+  peertube_assets:
+  conduwuit_data:
+  mautrix_telegram_data: