fix(self-host): harden the media server and shrink the embed

.env.self-hosting.example

@@ -0,0 +1,20 @@
+# Copy to .env next to docker-compose.yml and fill in every value.
+# Generate each secret with: openssl rand -hex 32
+# cap-web and the media server refuse to start when these are missing or left at a known placeholder.
+NEXTAUTH_SECRET=
+DATABASE_ENCRYPTION_KEY=
+MEDIA_SERVER_WEBHOOK_SECRET=
+
+# Optional: database and storage passwords (internal-only defaults are used when unset)
+MYSQL_PASSWORD=
+MYSQL_ROOT_PASSWORD=
+MINIO_ROOT_USER=cap-admin
+MINIO_ROOT_PASSWORD=
+
+# Public URLs
+CAP_URL=http://localhost:3000
+S3_PUBLIC_URL=http://localhost:9000
+
+# Optional: email. Without both values, login codes are printed to the cap-web logs.
+RESEND_API_KEY=
+RESEND_FROM_DOMAIN=

apps/media-server/bunfig.toml

@@ -0,0 +1,2 @@
+[test]
+preload = ["./src/__tests__/setup.ts"]

apps/media-server/src/__tests__/lib/audio-levels.integration.test.ts

@@ -20,6 +20,7 @@ import { withMediaTransfers } from "../../lib/media-transfer";
 import { processVideo } from "../../lib/media-video";
 import {
 	getActiveDirectVideoProcessCount,
+	getMaxConcurrentDirectVideoProcesses,
 	tryAcquireDirectVideoProcessSlot,
 } from "../../lib/video-capacity";
 
@@ -238,15 +239,19 @@ describe("local audio levels integration", () => {
 		expect(objects.publications()).toBe(0);
 	});
 	test("leaves an occupied conversion slot available to its current owner", async () => {
-		const slot = tryAcquireDirectVideoProcessSlot(() => true);
-		expect(slot).not.toBeNull();
+		// The default slot count follows the CPUs, so occupy every slot.
+		const max = getMaxConcurrentDirectVideoProcesses();
+		const slots = Array.from({ length: max }, () =>
+			tryAcquireDirectVideoProcessSlot(() => true),
+		);
+		expect(slots.every((slot) => slot !== null)).toBe(true);
 		try {
 			const objects = storage();
 			expect(await call()).toEqual({ status: "unchanged", reason: "capacity" });
 			expect(objects.preparations()).toBe(0);
-			expect(getActiveDirectVideoProcessCount()).toBe(1);
+			expect(getActiveDirectVideoProcessCount()).toBe(max);
 		} finally {
-			slot?.release();
+			for (const slot of slots) slot?.release();
 		}
 	});
 	test("cancels optional work on shutdown and releases its processing slot", async () => {

apps/media-server/src/__tests__/lib/job-manager.test.ts

@@ -156,8 +156,10 @@ describe("durable recording workers", () => {
 		const sending = sendWebhook(job);
 		updateJob(job.jobId, { phase: "complete", progress: 100 });
 		expect(sendWebhook(job)).toBe(sending);
+		// The URL policy check runs before fetch, so wait for the request to start.
+		while (!release) await Bun.sleep(1);
 		const started = performance.now();
-		release?.(new Response(null, { status: 503 }));
+		release(new Response(null, { status: 503 }));
 		await sending;
 		expect(performance.now() - started).toBeLessThan(400);
 		expect(maximumInFlight).toBe(1);

apps/media-server/src/__tests__/lib/media-audio.integration.test.ts

@@ -201,7 +201,7 @@ describe("mediaAudio integration tests", () => {
 			try {
 				await expect(
 					checkHasAudioTrack(`${server.url}video.mp4`),
-				).rejects.toThrow("FFprobe exited");
+				).rejects.toThrow("Failed to fetch media: 503");
 				await waitForAudioOperations(beforeCount);
 			} finally {
 				await server.stop(true);
@@ -233,6 +233,24 @@ describe("mediaAudio integration tests", () => {
 			await waitForAudioOperations(beforeCount);
 		});
 
+		test("releases the operation when a remote download fails", async () => {
+			const beforeCount = getActiveProcessCount();
+			const server = Bun.serve({
+				port: 0,
+				fetch: () => new Response("Missing", { status: 404 }),
+			});
+
+			try {
+				const { stream } = extractAudioStream(`${server.url}clip.mp4`);
+				await expect(readStream(stream)).rejects.toThrow(
+					"Failed to fetch media: 404",
+				);
+				await waitForAudioOperations(beforeCount);
+			} finally {
+				await server.stop(true);
+			}
+		});
+
 		test("cleans up when a real stream is cancelled", async () => {
 			const beforeCount = getActiveProcessCount();
 			const { stream } = extractAudioStream(TEST_VIDEO_WITH_AUDIO);

apps/media-server/src/__tests__/lib/media-routes-real-world.integration.test.ts

@@ -14,7 +14,6 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { readFile, writeFile } from "node:fs/promises";
 import os, { tmpdir } from "node:os";
 import { join } from "node:path";
-import { pathToFileURL } from "node:url";
 import type appType from "../../app";
 import * as audioLevels from "../../lib/audio-levels";
 import * as containerCpu from "../../lib/container-cpu";
@@ -66,10 +65,6 @@ let transientFixtureFailures = 0;
 let permanentFixtureFailures = 0;
 let slowFixtureCancellations = 0;
 
-function fileUrl(path: string) {
-	return pathToFileURL(path).toString();
-}
-
 function fixtureUrl(name = "test-with-audio.mp4") {
 	return `${baseUrl}/fixtures/${name}`;
 }
@@ -1000,12 +995,12 @@ describe("media routes real-world integration tests", () => {
 	test("checks real audio tracks through the route stack", async () => {
 		const withAudioResponse = await app.fetch(
 			mediaPostRequest("/audio/check", {
-				videoUrl: fileUrl(TEST_VIDEO_WITH_AUDIO),
+				videoUrl: fixtureUrl("test-with-audio.mp4"),
 			}),
 		);
 		const noAudioResponse = await app.fetch(
 			mediaPostRequest("/audio/check", {
-				videoUrl: fileUrl(TEST_VIDEO_NO_AUDIO),
+				videoUrl: fixtureUrl("test-no-audio.mp4"),
 			}),
 		);
 
@@ -1021,7 +1016,7 @@ describe("media routes real-world integration tests", () => {
 	test("extracts real audio through the non-streaming route", async () => {
 		const response = await app.fetch(
 			mediaPostRequest("/audio/extract", {
-				videoUrl: fileUrl(TEST_VIDEO_WITH_AUDIO),
+				videoUrl: fixtureUrl("test-with-audio.mp4"),
 				stream: false,
 			}),
 		);
@@ -1034,7 +1029,7 @@ describe("media routes real-world integration tests", () => {
 	test("probes and thumbnails a real video through the route stack", async () => {
 		const probeResponse = await app.fetch(
 			mediaPostRequest("/video/probe", {
-				videoUrl: fileUrl(TEST_VIDEO_WITH_AUDIO),
+				videoUrl: fixtureUrl("test-with-audio.mp4"),
 			}),
 		);
 		expect(probeResponse.status).toBe(200);
@@ -1046,7 +1041,7 @@ describe("media routes real-world integration tests", () => {
 
 		const thumbnailResponse = await app.fetch(
 			mediaPostRequest("/video/thumbnail", {
-				videoUrl: fileUrl(TEST_VIDEO_WITH_AUDIO),
+				videoUrl: fixtureUrl("test-with-audio.mp4"),
 				timestamp: 0.2,
 				width: 160,
 				height: 120,