chore: bump version to 1.0.12

.gitea/workflows/cd.yml

@@ -33,15 +33,42 @@ jobs:
       - name: Prepare environment
         run: |
           cat > .env << 'EOF'
+          # Database & Redis
           DATABASE_URL="${{ secrets.DATABASE_URL }}"
           REDIS_URL=redis://redis:6379/0
+
+          # Playout
           PLAYLIST_PATH=/app/playlist/playlist.txt
           HLS_SEGMENT_DURATION=6
           HLS_WINDOW_SIZE=24
           LOG_LEVEL=info
+
+          # Cloudflare R2 (required for HLS segment sync)
+          R2_ACCESS_KEY_ID="${{ secrets.R2_ACCESS_KEY_ID }}"
+          R2_SECRET_ACCESS_KEY="${{ secrets.R2_SECRET_ACCESS_KEY }}"
+          R2_BUCKET_NAME="${{ secrets.R2_BUCKET_NAME }}"
+          R2_ENDPOINT="${{ secrets.R2_ENDPOINT }}"
+          R2_REGION=auto
+
+          # Cloudflare
+          CLOUDFLARE_API_TOKEN="${{ secrets.CLOUDFLARE_API_TOKEN }}"
+          CLOUDFLARE_ACCOUNT_ID="${{ secrets.CLOUDFLARE_ACCOUNT_ID }}"
+          MEDIA_DOMAIN=${{ secrets.MEDIA_DOMAIN }}
+
+          # Frontend public URLs
+          VITE_PUBLIC_APP_URL=${{ secrets.VITE_PUBLIC_APP_URL }}
+          VITE_PUBLIC_WS_URL=${{ secrets.VITE_PUBLIC_WS_URL }}
+          VITE_PUBLIC_HLS_URL=${{ secrets.VITE_PUBLIC_HLS_URL }}
+          VITE_PUBLIC_ADMIN_DEFAULT_MODERATOR=${{ secrets.VITE_PUBLIC_ADMIN_DEFAULT_MODERATOR }}
+          VITE_PUBLIC_ADMIN_DEFAULT_ROOM=${{ secrets.VITE_PUBLIC_ADMIN_DEFAULT_ROOM }}
+          VITE_PUBLIC_ADMIN_MODERATION_LOG_LIMIT=50
+
+          # Admin auth
           ADMIN_USERNAME="${{ secrets.ADMIN_USERNAME }}"
           ADMIN_PASSWORD="${{ secrets.ADMIN_PASSWORD }}"
           ADMIN_SESSION_TTL_HOURS=12
+
+          # Nginx
           NGINX_PORT=80
           EOF
 

.github/AGENTS.md

@@ -23,7 +23,6 @@ These files must be kept current with every change. Do not let them drift.
 | `.github/instructions/BACKLOG.md` | Deferred, manual, and operational tasks       | Sync whenever TODO items complete or new gaps are identified       |
 | `.github/instructions/DONE.md`    | Archive of completed TODO sections            | Move completed sections here from TODO.md                          |
 | `.github/MEMORY.md`               | Session memory — what was done, when, and why | Append dated entry after each meaningful batch of changes          |
-| `docs/DEVELOPMENT.md`             | Remaining task checklist organized by topic   | Sync checkboxes with TODO.md after each implementation session     |
 | `CHANGELOG.md`                    | User-facing release notes                     | Add entry when a phase or significant feature completes            |
 | `docs/STREAMING.md`               | Streaming pipeline contract                   | Update when playout, HLS, or caching behavior changes              |
 | `docs/DEPLOYMENT.md`              | Deploy and infrastructure procedures          | Update when pipeline, topology, or provisioning changes            |

.github/MEMORY.md

@@ -122,3 +122,15 @@
   - Frontend: 45 tests pass (2 files), test:coverage meets thresholds (22.92% / 18.44% / 19.01% / 25.42%)
 - Edge cache validation script `scripts/validate-edge-cache.sh` exists.
 - Remaining: CORS on media.linearvoid.tv (Cloudflare R2 bucket CORS config, not a code change). Phases 5-7 are manual/infrastructure only (Cloudflare dashboard, Hetzner provisioning, live benchmarks).
+
+## 2026-08-11
+
+- Consolidated all development tasks from `DEVELOPMENT.md` and `.github/instructions/TODO.md` into `.github/instructions/BACKLOG.md` as the single source of truth. `DEVELOPMENT.md` now obsolete and removed. `TODO.md` references `BACKLOG.md` and `DONE.md`.
+- Fixed R2 endpoint validation in playout service (`backend/playout/src/playlist.go`):
+  - Added `isR2Configured()` checking all four required env vars (`R2_ENDPOINT`, `R2_ACCESS_KEY_ID`, `R2_SECRET_ACCESS_KEY`, `R2_BUCKET_NAME`).
+  - `initR2Client()` now returns a clear error if R2 is not configured instead of creating an S3 client with an empty endpoint.
+  - Segment watcher (`watchAndPublishSegments`), `syncLatestToR2()`, and `publishManifest()` are now guarded by `r2Client != nil` — no error spam when R2 is unavailable.
+  - Playout gracefully degrades: local HLS via nginx works without R2.
+- Updated `.gitea/workflows/cd.yml` "Prepare environment" step to include all R2* variables sourced from Gitea secrets (`R2_ACCESS_KEY_ID`, `R2_SECRET_ACCESS_KEY`, `R2_BUCKET_NAME`, `R2_ENDPOINT`, `R2_ADMIN*\*`), Cloudflare variables (`CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`), and frontend public URL variables.
+- Updated `docs/DEPLOYMENT.md` "Environment File" section: replaced vague "Cloudflare/R2 variables" bullet with explicit variable lists and added a new "Gitea Secrets" table documenting all 15 required secrets.
+- All playout tests pass (20 tests), `go vet` clean.

.github/instructions/BACKLOG.md

@@ -1,6 +1,15 @@
 # BACKLOG
 
-> Consolidated from `BACKLOG.md`, `DEVELOPMENT.md`, and `TODO.md` on 2026-08-11.
+## Remaining from 2026-08-11 (summary)
+
+- **Test Fixtures**: media + playlist fixtures created; ffmpeg generation commands documented in test headers
+- **User Frontend Tests**: video player, chat integration, responsive, accessibility, coverage
+- **Admin Frontend Tests**: playlist UI, moderation UI, metrics dashboards, coverage
+- **Cloudflare R2 Integration Test**: upload + cache header validation done (SyncToR2 with CacheControl + ContentType); edge cache hit/miss validation remains manual
+- **Cloudflare Config**: Cloudflare Pages deploy workflow and setup docs created; manual dashboard setup (Tiered Cache, WAF, rate limiting, HTTPS/HSTS) remains pending; Pages project must be created in dashboard first.
+- **External Services**: UptimeRobot monitors + alerts
+- **Production Deployment**: Hetzner provisioning, CD pipeline, DNS cutover, smoke test
+- **Scaling & Performance**: TTFB baseline and live benchmark runs still pending; loadtest scaffolding now includes Artillery/k6 helpers with auto summaries plus worksheet field mapping; chat p95, Redis saturation, and cache-hit threshold alerting are implemented
 
 ## Cloudflare Configuration
 

.github/instructions/TODO.md

@@ -1,45 +1,52 @@
 # TODO
 
-> Completed tasks moved to `.github/instructions/DONE.md`. Full remaining task list in `DEVELOPMENT.md`.
+> Completed tasks moved to [DONE](./DONE.md). Full remaining task list in [BACKLOG](./BACKLOG.md).
 
-## Detailed Implementation Plan
+## Plan
+
+### Phase 1: unblock playout test fixtures and lock down the source-media contract
 
-- [x] Phase 1: unblock playout test fixtures and lock down the source-media contract
 - [x] Create small compliant fixture media in `backend/playout/testdata/` for the validator and playout tests
 - [x] Create invalid fixture media for codec, framerate, and audio rejection paths
 - [x] Create playlist fixtures for empty, comment-only, mixed-validity, and valid playlists
 - [x] Document the ffmpeg fixture-generation commands in the relevant test headers
 
-- [x] Phase 2: finish frontend coverage for the live viewer experience
+### Phase 2: finish frontend coverage for the live viewer experience
+
 - [x] Add tests for HLS player startup, manifest resolution, and cross-origin/local fallback behavior
 - [x] Add tests for chat send/receive, presence updates, private DM flow, and reconnect behavior
 - [x] Add responsive-layout and accessibility checks for the viewer shell and chat sidebar
 - [x] Add coverage reporting and enforce a minimum threshold in CI
 
-- [x] Phase 3: finish admin frontend coverage
+### Phase 3: finish frontend coverage for the admin experience
+
 - [x] Add tests for playlist management, moderation flows, and dashboard rendering
 - [x] Add tests for API integration points with mocked backend responses
 - [x] Add responsive-layout and accessibility checks for admin screens
 - [x] Add coverage reporting and enforce a minimum threshold in CI
 
-- [x] Phase 4: validate the R2 and edge-delivery path
+### Phase 4: validate the R2 and edge-delivery path
+
 - [x] Add an integration test for upload and retrieval of HLS objects through the R2 path
 - [x] Verify segment and manifest cache headers, including immutable media and live manifest freshness
 - [x] Validate edge cache hit/miss behavior with repeat requests
 - [x] Document any required stubs or mocks so the test can run in CI (putObject mock pattern documented in test)
 
-- [ ] Phase 5: complete manual Cloudflare and external-service setup
+### Phase 5: complete manual Cloudflare and external-service setup
+
 - [ ] Apply Cloudflare Pages, Tiered Cache, WAF, rate limiting, and HTTPS/HSTS settings in the dashboard
 - [ ] Create or verify UptimeRobot monitors for health and HLS manifest availability
 - [ ] Capture evidence in `docs/operations/cloudflare-uptimerobot-checklist.md`
 
-- [ ] Phase 6: rehearse production deployment end to end
+### Phase 6: rehearse production deployment end to end
+
 - [ ] Provision the Hetzner host and prepare the Docker/runtime baseline
 - [ ] Configure production secrets, remote deployment, and DNS cutover
 - [ ] Run health, HLS, chat, and admin smoke tests against production-like infrastructure
 - [ ] Verify backup creation, restore, and integrity checks on the production host
 
-- [ ] Phase 7: baseline scaling and performance
+### Phase 7: baseline scaling and performance
+
 - [ ] Measure manifest TTFB and cache-hit distribution from multiple US regions
 - [x] Prepare WebSocket load-test scaffolding and summary artifacts (`ws-chat.yml`, `run-loadtests.ps1`, `summarize-artillery.ps1`)
 - [ ] Execute WebSocket throughput and chat-latency benchmarks under growing connection counts
@@ -50,27 +57,15 @@
 
 ## Status Update (2026-08-10)
 
-- Phase 1 (test fixtures) complete.
+- [x] Phase 1 (test fixtures) complete.
-- Phase 2 (viewer frontend): player startup, URL resolution, chat send/receive, reconnect, presence, DM flow, message rendering all covered (27 tests).
+- [x] Phase 2 (viewer frontend): player startup, URL resolution, chat send/receive, reconnect, presence, DM flow, message rendering all covered (27 tests).
-- Phase 3 (admin frontend): dashboard rendering, API integration, playlist management all covered (31 tests total).
+- [x] Phase 3 (admin frontend): dashboard rendering, API integration, playlist management all covered (31 tests total).
-- Phase 4 (R2 validation) partially complete: SyncToR2 cache headers + integration tests done; edge cache hit/miss remains manual.
+- [x] Phase 4 (R2 validation) partially complete: SyncToR2 cache headers + integration tests done; edge cache hit/miss remains manual.
-- Phase 5 (Cloudflare): Pages deploy workflow (`.gitea/workflows/pages-deploy.yml`) created; Pages/Workers setup docs written; manual dashboard tasks remain.
+- [ ] Phase 5 (Cloudflare): Pages deploy workflow (`.gitea/workflows/pages-deploy.yml`) created; Pages/Workers setup docs written; manual dashboard tasks remain.
-- Phase 7: Loadtest scaffolding complete; `run-loadtests.ps1` auto-generates ws-chat-summary.txt and admin-api-endpoint-summary.txt; live benchmark execution pending.
+- [ ] Phase 6 (production deployment) pending: Hetzner provisioning, secrets, DNS cutover, smoke tests, backup/restore.
+- [ ] Phase 7: Loadtest scaffolding complete; `run-loadtests.ps1` auto-generates ws-chat-summary.txt and admin-api-endpoint-summary.txt; live benchmark execution pending.
 - Version tagged 1.0.11; go vet clean.
 
-## Remaining (summary)
-
-- **Test Fixtures**: media + playlist fixtures created; ffmpeg generation commands documented in test headers
-- **User Frontend Tests**: video player, chat integration, responsive, accessibility, coverage
-- **Admin Frontend Tests**: playlist UI, moderation UI, metrics dashboards, coverage
-- **Cloudflare R2 Integration Test**: upload + cache header validation done (SyncToR2 with CacheControl + ContentType); edge cache hit/miss validation remains manual
-- **Cloudflare Config**: Cloudflare Pages deploy workflow and setup docs created; manual dashboard setup (Tiered Cache, WAF, rate limiting, HTTPS/HSTS) remains pending; Pages project must be created in dashboard first.
-- **External Services**: UptimeRobot monitors + alerts
-- **Production Deployment**: Hetzner provisioning, CD pipeline, DNS cutover, smoke test
-- **Scaling & Performance**: TTFB baseline and live benchmark runs still pending; loadtest scaffolding now includes Artillery/k6 helpers with auto summaries plus worksheet field mapping; chat p95, Redis saturation, and cache-hit threshold alerting are implemented
-
-See `DEVELOPMENT.md` for detailed checklist.
-
 ## Streaming Pipeline Gaps (2026-08-10 audit → 2026-08-10 implemented)
 
 STREAMING.md contract vs playlist.go/main.ts implementation. See Backlog for full details.

CHANGELOG.md

@@ -2,6 +2,20 @@
 
 <!-- markdownlint-disable MD024 -->
 
+## [Unreleased]
+
+## [1.0.12] - 2026-08-11
+
+### Changed
+
+- **Task tracking consolidated**: Removed `DEVELOPMENT.md` and moved all development tasks to `.github/instructions/BACKLOG.md` as the single source of truth. `TODO.md` updated to reference `BACKLOG.md` and `DONE.md`.
+
+### Fixed
+
+- **Playout R2 endpoint validation**: `initR2Client()` now validates all required R2 environment variables (`R2_ENDPOINT`, `R2_ACCESS_KEY_ID`, `R2_SECRET_ACCESS_KEY`, `R2_BUCKET_NAME`) before creating the S3 client. Previously, an empty `R2_ENDPOINT` caused cryptic `Custom endpoint '' was not a valid URI` errors on every segment upload attempt. Playout now gracefully degrades when R2 is not configured — local HLS via nginx continues to work.
+- **CD workflow missing R2 secrets**: `.gitea/workflows/cd.yml` "Prepare environment" step now injects all R2_ variables (`R2_ACCESS_KEY_ID`, `R2_SECRET_ACCESS_KEY`, `R2_BUCKET_NAME`, `R2_ENDPOINT`, plus admin variants) from Gitea secrets. Previously the generated `.env` was missing R2 entirely, causing the playout container to start with an empty endpoint.
+- **Deployment docs**: `docs/DEPLOYMENT.md` now includes explicit R2 and Cloudflare variable lists plus a "Gitea Secrets" table documenting all 15 required secrets.
+
 ## [1.0.11] - 2026-08-10
 
 ### Added

LICENSE

@@ -0,0 +1,7 @@
+Copyright © 2026 linearvoid.tv (Corey Pellizzi, Georg Sinn)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

README.md

@@ -5,9 +5,9 @@
 **Repository**: [git.allucanget.biz/zwitschi/linearvoid](https://git.allucanget.biz/zwitschi/linearvoid)
 
 [![Build Status](https://git.allucanget.biz/zwitschi/linearvoid/actions/workflows/ci.yml/badge.svg)](https://git.allucanget.biz/zwitschi/linearvoid/actions)
-[![License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![Gitea](https://img.shields.io/badge/Gitea-1.27.1-blue)](https://git.allucanget.biz)
-[![Version](https://img.shields.io/badge/version-1.0.11-blue)](https://git.allucanget.biz/zwitschi/linearvoid/releases)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Version](https://img.shields.io/badge/version-1.0.12-blue)](https://git.allucanget.biz/zwitschi/linearvoid/releases)
 [![Release Notes](https://img.shields.io/badge/release-notes-green)](CHANGELOG.md)
 
 ## Architecture

docs/DEPLOYMENT.md

@@ -131,22 +131,48 @@ No code changes needed in the pipeline. See `DEPLOYMENT.md` Production Deploymen
 
 ## Environment File
 
-Use .env with at least:
+Use `.env` with at least:
 
-- CI_REGISTRY_URL
+- `DATABASE_URL` — PostgreSQL connection string
-- CI_REGISTRY_NAMESPACE
+- `REDIS_URL` — Redis connection string
-- CHAT_PORT
+- `ADMIN_USERNAME` / `ADMIN_PASSWORD` — admin dashboard credentials
-- NGINX_PORT
+- `ADMIN_SESSION_TTL_HOURS` — session expiry (default 12)
-- DATABASE_URL (if overridden)
+- `VITE_PUBLIC_APP_URL` / `VITE_PUBLIC_WS_URL` / `VITE_PUBLIC_HLS_URL` — frontend URLs
-- REDIS_URL (if overridden)
-- ADMIN_USERNAME
-- ADMIN_PASSWORD
-- VITE_PUBLIC_APP_URL
-- VITE_PUBLIC_WS_URL
-- VITE_PUBLIC_HLS_URL
-- Cloudflare/R2 variables when media sync is enabled
 
-See .env.example and SETUP.md for full variable reference.
+**Cloudflare R2 (required for HLS segment sync to edge):**
+
+- `R2_ACCESS_KEY_ID` / `R2_SECRET_ACCESS_KEY` — R2 write credentials
+- `R2_BUCKET_NAME` — bucket name (e.g. `linearvoid-media`)
+- `R2_ENDPOINT` — S3-compatible endpoint URL
+- `R2_REGION` — set to `auto`
+
+**Cloudflare (optional, for Workers/Pages):**
+
+- `CLOUDFLARE_API_TOKEN` / `CLOUDFLARE_ACCOUNT_ID`
+- `MEDIA_DOMAIN` — split media domain (e.g. `media.linearvoid.tv`)
+
+See `.env.example` and `SETUP.md` for full variable reference.
+
+### Gitea Secrets
+
+The CD workflow (`cd.yml`) injects sensitive values from Gitea secrets into the `.env` file at deploy time. The following secrets must be configured in the Gitea repository:
+
+| Secret Name               | Description                          |
+| ------------------------- | ------------------------------------ |
+| `DATABASE_URL`            | PostgreSQL connection string         |
+| `ADMIN_USERNAME`          | Admin dashboard username             |
+| `ADMIN_PASSWORD`          | Admin dashboard password             |
+| `R2_ACCESS_KEY_ID`        | Cloudflare R2 access key             |
+| `R2_SECRET_ACCESS_KEY`    | Cloudflare R2 secret key             |
+| `R2_BUCKET_NAME`          | R2 bucket name                       |
+| `R2_ENDPOINT`             | R2 S3-compatible endpoint URL        |
+| `R2_ADMIN_ACCESS_KEY_ID`  | R2 admin access key (optional)       |
+| `R2_ADMIN_SECRET_ACCESS_KEY` | R2 admin secret key (optional)    |
+| `R2_ADMIN_ENDPOINT`       | R2 admin endpoint (optional)         |
+| `CLOUDFLARE_API_TOKEN`    | Cloudflare API token (optional)      |
+| `CLOUDFLARE_ACCOUNT_ID`   | Cloudflare account ID (optional)     |
+| `CI_REGISTRY_USER`        | Gitea container registry username    |
+| `CI_REGISTRY_TOKEN`       | Gitea container registry token       |
 
 ## Pull-and-Run Deployment
 

docs/DEVELOPMENT.md

@@ -1,5 +0,0 @@
-# DEVELOPMENT.md
-
-> **All task lists have been consolidated into [`.github/instructions/BACKLOG.md`](../.github/instructions/BACKLOG.md).**
->
-> This file is kept as a reference for development setup instructions. See [`SETUP.md`](SETUP.md) for environment setup.

docs/README.md

@@ -6,6 +6,15 @@ This folder contains the documentation for the Linear Void project. The document
 
 - [Architecture](architecture/README.md) - High-level system architecture and component interactions.
 
+## Infrastructure
+
+- Cloudflare
+  - [Cache Rules](./infrastructure/cloudflare/cache-rules.md) - Cache rules for Cloudflare Workers and Pages.
+  - [Account Troubleshooting](./infrastructure/cloudflare/cloudflare-account-troubleshooting.md) - Troubleshooting Cloudflare account issues.
+- Monitoring
+  - [Prometheus CURL](./infrastructure/monitoring/prometheus_curl.md) - Prometheus metrics endpoint testing with curl.
+  - [Prometheus CURL Windows](./infrastructure/monitoring/prometheus_curl_win.md) - Prometheus metrics endpoint testing with curl on Windows.
+
 ## API
 
 - [API](API.md) - Implemented WebSocket and REST API reference.
@@ -30,12 +39,18 @@ This folder contains the documentation for the Linear Void project. The document
 
 - [Streaming](STREAMING.md) - Streaming architecture, playout, and delivery details.
 
-## Development
-
-- [Development](DEVELOPMENT.md) - Remaining tasks and test fixtures for development.
-
 ## Additional Resources
 
 - [Marketing](marketing/README.md) - Marketing materials and resources.
 - [Operations](operations/README.md) - Operational procedures and checklists.
 - [Incident Runbook](incident-runbook.md) - Incident response and disaster recovery procedures.
+
+## Other Documents
+
+- [CHANGELOG](../CHANGELOG.md) - Release notes and version history.
+- [CONTRIBUTING](../CONTRIBUTING.md) - Contribution guidelines and code of conduct.
+- [TODO](../.github/instructions/TODO.md) - Active implementation plan with checkboxes.
+- [Backlog](../.github/instructions/BACKLOG.md) - Consolidated list of all development tasks.
+- [Agents](../.github/AGENTS.md) - Instructions for agents and task management.
+- [Memory](../.github/MEMORY.md) - Session memory and development progress tracking.
+- [README](../README.md) - Project overview and high-level information.

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "frontend",
   "private": true,
-  "version": "1.0.11",
+  "version": "1.0.12",
   "type": "module",
   "engines": {
     "node": ">=22.0.0"