Tactical Media Broadcast Hub — initial release

Self-hosted multi-platform broadcast newsroom for activist collectives:
publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style
column wall with hostile-content-safe rendering, live control room with Auto
Director, bridged chat governance with polls and quorum, distributed sandboxed
transcode workers, encrypted content-addressed archive, monthly analytics.

MIT licensed. See README.md and docs/.

infra/peertube-workers/win/register-from-ssh.py

@@ -0,0 +1,35 @@
+"""Pipe the existing registration secret directly between SSH sessions. No file/argv/log."""
+import argparse,json,re,shlex,subprocess,tempfile
+from pathlib import Path
+parser=argparse.ArgumentParser(description=__doc__)
+parser.add_argument('--worker',required=True,help='SSH target user@WSL-host')
+parser.add_argument('--name',required=True)
+parser.add_argument('--root',default=r'C:\pt-worker')
+parser.add_argument('--server',default='root@100.92.231.98')
+parser.add_argument('--server-key',default=str(Path.home()/'.ssh/id_rsa'))
+parser.add_argument('--worker-key',default=str(Path.home()/'.ssh/devserver'))
+args=parser.parse_args()
+assert re.fullmatch(r'[A-Za-z0-9_-]+',args.name),'Use a simple unique runner name'
+assert re.fullmatch(r'[A-Za-z]:\\[^\r\n]+',args.root),'Require local Windows drive root'
+SSH=['ssh','-o','BatchMode=yes','-o','StrictHostKeyChecking=yes']
+server=SSH+['-i',args.server_key,args.server]
+worker=SSH+['-i',args.worker_key,args.worker]
+query='SELECT "registrationToken" FROM "runnerRegistrationToken" WHERE id=1;'
+command="docker exec -i occ-tube-peertube-postgres-1 sh -c 'exec psql -X -v ON_ERROR_STOP=1 -U \"$POSTGRES_USER\" -d peertube -At'"
+# metadata check is independent of, and never prints, token material.
+p=subprocess.run(server+[command],input=f"SELECT (SELECT count(*) FROM \"runnerRegistrationToken\"),(SELECT count(*) FROM \"runner\" WHERE name='{args.name}');",text=True,capture_output=True,check=True)
+assert p.stdout.strip()=='1|0','Expected existing token and no duplicate runner'
+marker=Path(tempfile.gettempdir())/('pt-worker-'+args.name+'-enrollment.pending')
+assert not marker.exists(),'Previous result uncertain; inspect server before retrying'
+marker.write_text('Registration attempted; contains no secrets.\n')
+source=subprocess.Popen(server+[command],stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
+source.stdin.write(query.encode());source.stdin.close()
+node='/mnt/'+args.root[0].lower()+args.root[2:].replace('\\','/')+'/node/node.exe'
+remote=shlex.join([node,args.root+r'\bin\ipc-nvenc.cjs','register',args.root])
+receiver=subprocess.run(worker+[remote],stdin=source.stdout,capture_output=True)
+source.stdout.close();source.wait(timeout=20)
+if source.returncode or receiver.returncode:
+ raise SystemExit('Registration failed; secret-bearing outputs suppressed, inspect safe metadata before retry')
+assert json.loads(receiver.stdout)['success'] is True
+marker.unlink()
+print(json.dumps({'runner_name':args.name,'registration_success':True,'secret_transport':'SSH stdout->SSH stdin->official named-pipe IPC','secret_saved':False}))