Corregge il provisioning Hetzner: Faraday, cloud-init e default cpx12.

Sistemati path API /v1, AppArmor/auth MediaMTX sul nodo e defaults nbg1 così lo smoke Cloud è ripetibile.

Co-authored-by: Cursor <cursoragent@cursor.com>

infra/.env.production.example

@@ -108,10 +108,10 @@ SENTRY_TRACES_SAMPLE_RATE=0.1
 # --- Stream autoscale (Hetzner Cloud + DNS mltv-stream.net) ---
 # Token progetto matchlivetv-stream (Read & Write). Non committare il valore reale.
 HCLOUD_TOKEN=
-HCLOUD_LOCATION=fsn1
-HCLOUD_SERVER_TYPE=cpx21
+HCLOUD_LOCATION=nbg1
+HCLOUD_SERVER_TYPE=cpx12
 HCLOUD_IMAGE=debian-12
-HCLOUD_SSH_KEY=matchlivetv-stream
+HCLOUD_SSH_KEY=matchlivetv-stream-hetzner
 HCLOUD_NETWORK_ID=
 HCLOUD_USER_DATA_FILE=/opt/matchlivetv/infra/stream-node/cloud-init.yaml
 STREAM_DNS_ZONE=mltv-stream.net

infra/stream-node/cloud-init.yaml

@@ -1,41 +1,71 @@
 #cloud-config
-# Cloud-init minimale per nodo stream Hetzner (MediaMTX + ffmpeg).
-# Uso in .env produzione:
-#   HCLOUD_USER_DATA_FILE=/opt/matchlivetv/infra/stream-node/cloud-init.yaml
-#
-# Per boot più veloci: creare uno snapshot dopo il primo setup e usare HCLOUD_IMAGE=<snapshot>.
+# Nodo stream Hetzner: MediaMTX + ffmpeg.
+# HCLOUD_USER_DATA_FILE=.../infra/stream-node/cloud-init.yaml
 
 package_update: true
 packages:
   - docker.io
   - ffmpeg
   - curl
+  - apparmor
+
+write_files:
+  - path: /opt/stream-node/mediamtx.yml
+    permissions: "0644"
+    content: |
+      logLevel: info
+      # Allinea a infra/mediamtx.yml: API raggiungibile anche da IP non-localhost
+      # (in prod restringere via WireGuard / firewall Hetzner).
+      authInternalUsers:
+        - user: any
+          pass:
+          ips: []
+          permissions:
+            - action: api
+            - action: metrics
+            - action: publish
+            - action: read
+            - action: playback
+      api: yes
+      apiAddress: :9997
+      rtmp: yes
+      rtmpAddress: :1935
+      hls: yes
+      hlsAddress: :8888
+      paths:
+        all_others:
+  - path: /opt/stream-node/bootstrap.sh
+    permissions: "0755"
+    content: |
+      #!/bin/bash
+      set -euo pipefail
+      mkdir -p /recordings /slates
+      systemctl enable --now docker
+      # aspetta il socket docker
+      for i in $(seq 1 60); do
+        if docker info >/dev/null 2>&1; then break; fi
+        sleep 2
+      done
+      docker pull bluenviron/mediamtx:latest
+      docker rm -f mediamtx 2>/dev/null || true
+      # Debian cloud image: docker.io senza apparmor_parser → serve unconfined o pkg apparmor
+      docker run -d --name mediamtx --restart unless-stopped --network host \
+        --security-opt apparmor=unconfined \
+        -v /opt/stream-node/mediamtx.yml:/mediamtx.yml:ro \
+        -v /recordings:/recordings \
+        -v /slates:/slates:ro \
+        bluenviron/mediamtx:latest /mediamtx.yml
+      # smoke locale
+      for i in $(seq 1 30); do
+        if curl -fsS http://127.0.0.1:9997/v3/paths/list >/dev/null; then
+          echo "mediamtx ready" | tee /opt/stream-node/ready
+          exit 0
+        fi
+        sleep 2
+      done
+      echo "mediamtx NOT ready" | tee /opt/stream-node/ready
+      docker logs mediamtx || true
+      exit 1
+
 runcmd:
-  - systemctl enable --now docker
-  - mkdir -p /opt/stream-node /recordings /slates
-  - |
-    cat >/opt/stream-node/docker-compose.yml <<'EOF'
-    services:
-      mediamtx:
-        image: bluenviron/mediamtx:latest
-        network_mode: host
-        restart: unless-stopped
-        volumes:
-          - ./mediamtx.yml:/mediamtx.yml:ro
-          - /recordings:/recordings
-          - /slates:/slates:ro
-        command: /mediamtx.yml
-    EOF
-  - |
-    cat >/opt/stream-node/mediamtx.yml <<'EOF'
-    logLevel: info
-    api: yes
-    apiAddress: :9997
-    rtmp: yes
-    rtmpAddress: :1935
-    hls: yes
-    hlsAddress: :8888
-    paths:
-      all_others:
-    EOF
-  - cd /opt/stream-node && docker compose up -d
+  - [bash, /opt/stream-node/bootstrap.sh]