m3u8-embedder - manual deploy bundle
====================================

What this does
--------------
Builds and starts the app in Docker on this machine, on the same port as the old
version: 2738, published on all network interfaces. Caddy keeps forwarding to
<this machine's LAN IP>:2738 as before. Embed tokens and uploaded posters are kept.

Before you start
----------------
1. Docker must run on this machine, either way:
   a) Rancher Desktop on Windows: Preferences > Container Engine = dockerd (moby).
      For access from other machines (Caddy), also enable administrative access
      (Preferences > Application) so ports bind to all interfaces.
   b) WSL with Docker Engine + docker compose installed inside the distro.
2. If the OLD version still runs outside Docker (prod.ps1 / prod.sh window), stop it
   (Ctrl+C in its window). An old Docker version is found and replaced automatically.

Deploy
------
1. Copy the zip to the machine and unzip it anywhere (for example C:\deploy\).
   Tip: right-click the zip > Properties > Unblock, before unzipping.
2. Run ONE of:
   - Windows (Rancher Desktop):  double-click deploy.cmd
   - WSL:                        cd /mnt/c/deploy/m3u8-embedder-<version> && bash deploy.sh
3. First run only: the script creates app\hls-player\.env from app.env.template,
   opens it, and stops. Set ADMIN_PASSWORD to a NEW value (12+ characters; the old
   one leaked and is refused), check the other values, save, run step 2 again.
   Later deploys reuse the saved config automatically.
4. Sign in at /admin with the new password. A successful login ends every other
   admin session, so anyone still signed in with the old password is logged out.

Coming from an old install that ran WITHOUT Docker (prod.ps1)? Run once:
   powershell -ExecutionPolicy Bypass -File deploy.ps1 -ImportFrom C:\path\to\old\install
   bash deploy.sh --import-from /mnt/c/path/to/old/install
This copies its hls-player\.env, backend\data\embed-tokens.json and backend\uploads\.

What the script does, in order
------------------------------
checks Docker -> prepares and validates .env -> finds the running/old version ->
keeps the current image as "previous" -> builds the new image -> backs up the data
volumes -> (optional import) -> fixes volume ownership -> starts -> waits for the
health check -> tests http://127.0.0.1:2738/health and the LAN address.

Undo
----
Windows: double-click rollback.cmd      WSL: bash deploy.sh --rollback
This switches back to the image that ran before the last deploy. Data is untouched.

Where things are kept (survive deleting the unzipped folder)
------------------------------------------------------------
Windows: %LOCALAPPDATA%\m3u8-embedder\   WSL: ~/.m3u8-embedder/
  app.env     the config used by the last deploy
  backups\    <project>_app-data-<time>.tgz and <project>_app-uploads-<time>.tgz
  logs\       one log per run

Restore a data backup (only if needed). Works the same in PowerShell, cmd and bash:
  docker compose -p <project> stop
  mkdir restore
  tar -xzf <backup>.tgz -C restore
  docker create --name m3u8-restore --user root -v <project>_app-data:/v m3u8-embedder:latest
  docker cp restore/. m3u8-restore:/v/
  docker rm m3u8-restore
  then run deploy.cmd (or bash deploy.sh) again; it fixes file ownership and restarts.
  (For posters use the app-uploads backup and <project>_app-uploads instead.)

Options
-------
-Project NAME / --project NAME   force the docker compose project name
-Yes / --yes                     answer yes to every question
ALLOW_WEAK_ADMIN_PASSWORD=1      environment variable to skip the 12-character rule
M3U8_HOME=<folder>               keep config, logs and backups somewhere else
