feat: video listener fix, AAC-in-TS for HLS, README overhaul

Raw /mount/video listeners now seek back to the most recent keyframe
and prepend the cached SPS/PPS Annex-B NALUs before any live bytes.
mpv / ffmpeg stop spamming "non-existing PPS 0 referenced" /
"reference picture missing during reorder" because the listener
joins on a clean IDR boundary instead of mid-GOP. Stream gains
VideoInfo() accessor so the server package can read the video
header state without touching the unexported stream mutex.

AAC audio in HLS:
  - New BuildADTSHeader helper in codec_aac.go.
  - RTMP ingest parses the AAC AudioSpecificConfig on the first
    sequence-header packet, extracts profile / sampleRateIdx /
    channelConfig, and wraps every raw AAC frame in ADTS before
    broadcast.
  - MuxAVSegment takes an audioStreamType param; writePMTAV emits
    stream_type 0x03 (MP3) or 0x0F (ADTS-AAC) accordingly.
  - HLSOutput picks the stream type from the audio track's content
    type so AAC sources carrying H.264 now produce a playable A/V
    HLS stream end-to-end.

README overhauled: tagline switches to "audio + video", the old
"What's new in v2.0 Beta" list is replaced by a v2.0.0-beta.5
section covering the video pipeline + the audio / auth / ops fixes
from the last few weeks, and a new "Streaming video from OBS"
section walks through the full OBS + HLS flow.

Author: DatanoiseTV

README.md

@@ -2,9 +2,9 @@
 
 ![TinyIce Logo](https://raw.githubusercontent.com/DatanoiseTV/tinyice/main/assets/logo.png?v=2)
 
-**One binary. Pure audio.**
+**One binary. Audio + video.**
 
-> High-performance Icecast-compatible streaming with WebRTC, AutoDJ, transcoding, and a world-class web interface. Deploy anywhere in seconds.
+> High-performance Icecast-compatible streaming server with RTMP/SRT/WebRTC ingest, AutoDJ, live audio transcoding, HLS audio/video output, and a built-in admin SPA. Deploy anywhere in seconds.
 
 ### Landing Page
 ![Landing Page](assets/screenshots/landing.png)
@@ -22,24 +22,91 @@
 [![Go Report Card](https://goreportcard.com/badge/github.com/DatanoiseTV/tinyice)](https://goreportcard.com/report/github.com/DatanoiseTV/tinyice)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 
-## What's New in v2.0 Beta
-
-- **Complete Admin UI Rewrite** — Modern single-page app built with Preact, real-time SSE updates, dark theme
-- **Bearer Token API Auth** — Create API access tokens for scripts and integrations, with expiry and usage tracking
-- **Full Branding System** — Custom site name, tagline, logo upload, accent color picker, Markdown landing page
-- **Interactive API Docs** — Built-in Swagger UI at `/api/docs` with complete OpenAPI 3.0 spec
-- **WebRTC Go Live** — Broadcast from your browser with audio device selection, spectrum analyzer, level meters with headroom (dB)
-- **AutoDJ Studio** — 3-column studio interface with library browser, transport controls, visualizer, playlist editor, and mount selector
-- **AutoDJ Editing** — Edit existing AutoDJ instances directly (name, mount, format, bitrate, etc.)
-- **Dashboard Improvements** — Split inbound/outbound bandwidth stats, real-time stream health
-- **Stream Management** — Configured-but-offline mounts now visible, proper create/delete/kick workflows
-- **Relay & Transcoder Management** — Full CRUD with live status indicators
-- **Markdown Landing Page** — Full GFM support via `marked` — headings, lists, code blocks, links, images
-- **Color Picker** — Visual accent color selection with 10 presets + native OS color picker + hex input
-- **Logo Upload** — PNG/JPG/SVG logo served at `/branding/logo`, shown in nav bar
-- **No CSRF for API** — JSON API requests no longer need CSRF tokens
-- **Makefile + go:generate** — `make build` rebuilds everything; frontend builds automatically via `go generate`
-- **Multi-auth** — Session cookies, Bearer tokens, Basic Auth, Passkeys (WebAuthn), OIDC/OAuth2
+## What's New in v2.0.0-beta.5 — Video
+
+This release turns TinyIce from an audio-only streaming server into an
+A/V one, and does a security / correctness pass on top.
+
+### Video streaming
+
+- **RTMP with H.264 video** — OBS / FFmpeg / any RTMP publisher can push
+  H.264 + MP3 or H.264 + AAC into a `/mount`. The RTMP app name is
+  honoured as the tinyice mount and the stream key as the source
+  password, matching the UX OBS expects.
+- **SRT video ingest** — MPEG-TS A/V publishers land in the same
+  `/mount` + `/mount/video` layout as RTMP.
+- **HLS audio + video output** — every mount exposes
+  `/mount/playlist.m3u8`; when a `/mount/video` sub-mount exists the
+  segments are muxed A/V. PCR is emitted; `TARGETDURATION` is tight;
+  `EXTINF` / PTS advance by the configured segment duration. MP3 and
+  AAC audio codecs are both supported (AAC is ADTS-wrapped and the
+  PMT `stream_type` switches to `0x0F`).
+- **Keyframe-aware raw video listeners** — a direct
+  `GET /mount/video` seeks back to the latest IDR and prepends the
+  cached SPS/PPS so `mpv http://host/mount/video` plays immediately.
+- **Browser player** — the in-page Player automatically switches from
+  `<audio>` to `<video>` when the mount has video. Safari / iOS play
+  HLS natively; Chromium / Firefox get `hls.js` dynamically loaded.
+
+### Audio correctness
+
+- Pure-Go multi-codec decode for the transcoder + AutoDJ — MP3, Ogg
+  Opus, Ogg Vorbis, FLAC, FLAC-in-Ogg, WAV (8/16/24/32-bit PCM + IEEE
+  float, mono/stereo).
+- Automatic resampler so **MP3 / Vorbis / FLAC / WAV → Opus** plays at
+  the right speed (the Opus encoder is locked at 48 kHz).
+- **MP3 bitrate** is actually honoured (the bundled `shine` encoder
+  has its bitrate index / slots-per-frame reached into explicitly).
+- **Ogg page rewriter per listener** — BOS / Tags / granule are
+  regenerated so late joiners don't see the minutes-long granule jump
+  that strict decoders fill with silence (the "robotic voice" bug).
+- **Icecast SOURCE** captures the initial Ogg BOS + setup pages so
+  new listeners get a playable start.
+
+### Operations & security
+
+- OIDC state is session-bound, nonce-validated, and rejects OIDC
+  accounts whose email isn't verified. GitHub `/user/emails` is
+  consulted; only primary+verified addresses log in.
+- Sessions have absolute and sliding expiry with a periodic reaper;
+  login rotates the cookie (no session fixation); deleted users have
+  their active sessions purged.
+- Login timing is constant — always runs bcrypt so unknown usernames
+  don't return faster than known ones.
+- `TrustedProxies` config + `X-Forwarded-For` handling so scan
+  detection / bans work behind nginx / Caddy / Traefik without
+  auto-whitelisting loopback.
+- Auto-updater verifies SHA-256 from `checksums.txt` before
+  overwriting the running binary.
+- RTMP shutdown closes live publisher connections so `Ctrl+C` quits
+  within seconds even mid-stream.
+- CSRF on every mutating admin form; super-admin gates on transcoder
+  + webhook CRUD; webhook / relay URLs reject loopback / RFC1918
+  targets (SSRF).
+- `SaveConfig` is serialised across goroutines so concurrent admin
+  writes can't shred the JSON.
+- Auto-remove dormant streams after 2 min of silence (was defined
+  but never enabled).
+- YP directory reporter emits proper `add` / `touch` / `remove`
+  lifecycle instead of repeated `add`s.
+
+### Admin UI
+
+- **Edit** for Streams, Transcoders, Relays, AutoDJ (in-place updates,
+  no more destroy-and-recreate on edit).
+- Transcoder editor surfaces Opus application / frame size / complexity
+  / VBR, plus a custom sample rate override.
+- Landing markdown is DOMPurified before it hits the DOM (was an
+  admin → visitor XSS).
+- Error toasts on every mutation path so 403 / 500 don't silently
+  disappear.
+- SSE reconnect no longer duplicates event delivery.
+
+### Build / packaging
+
+- Multi-stage `Dockerfile` (+ `.dockerignore`) for container deploys.
+- `make build` rebuilds frontend + binary; `go generate ./server/...`
+  pulls in hls.js + dompurify as lazy chunks.
 
 ## Why TinyIce?
 
@@ -60,15 +127,17 @@ Traditional streaming servers can be complex to configure and resource-heavy. Ti
 
 ### Streaming & Protocols
 -   **Icecast2 Compatible**: Works with standard source clients (BUTT, OBS, Mixxx, LadioCast) and players (VLC, web browsers).
+-   **RTMP Ingest**: OBS / ffmpeg / any RTMP publisher can push H.264 + MP3 or H.264 + AAC. OBS's Server-path = mount, Stream-key = password UX just works.
+-   **SRT Ingest**: Low-latency SRT with MPEG-TS demux for both audio and video.
 -   **WebRTC Source & Playback**: Ultra-low-latency browser-based broadcasting and listening via the Go Live page.
+-   **HLS A/V Output**: `/mount/playlist.m3u8` serves audio-only or audio+video segments depending on what the source pushes. PMT advertises MP3 or ADTS-AAC correctly; PCR is emitted; SPS/PPS are injected on every keyframe so late joiners can decode.
 -   **High-Performance Distribution**: Shared circular buffer architecture designed for 100,000+ concurrent listeners per stream.
 -   **Instant Start**: Listeners receive a 64KB audio burst upon connection, eliminating the "buffering" delay.
--   **Built-in Transcoding**: Pure Go transcoding (MP3/Opus) to provide multiple quality options from a single source. No FFmpeg required.
+-   **Multi-Codec Transcoding**: Pure-Go transcoder and AutoDJ accept MP3 / Ogg Opus / Ogg Vorbis / FLAC / FLAC-in-Ogg / WAV as input and re-encode to MP3 or Opus with automatic resampling. No FFmpeg required.
 -   **Edge Relaying**: Pull streams from upstream servers with automatic reconnection.
 -   **Smart Fallback & Auto-Recovery**: Automatically switch listeners to a backup stream if the primary drops.
 -   **Outbound ICY Metadata**: Injects song titles into the audio stream for traditional radio players.
 -   **Playlist Support**: `.m3u8`, `.m3u`, and `.pls` playlists for VLC, Winamp, mobile apps.
--   **HLS Output**: Automatic HLS segmentation for each mount point.
 
 ### AutoDJ
 -   **Multi-Instance Orchestration**: Multiple independent AutoDJs on different mounts from a single server.
@@ -172,6 +241,50 @@ Point your encoder (BUTT, OBS, Mixxx) to:
 
 Or use the **Go Live** page in the admin panel to broadcast directly from your browser via WebRTC.
 
+## Streaming video from OBS
+
+TinyIce accepts H.264 + AAC (or H.264 + MP3) over RTMP and produces
+HLS audio+video at `/<mount>/playlist.m3u8`.
+
+1. **Enable RTMP** in `tinyice.json`:
+
+   ```json
+   "ingest": {
+       "rtmp_enabled": true,
+       "rtmp_port": "1935"
+   }
+   ```
+
+2. **Create a mount** in the admin UI (Streams → Add Mount). Give it
+   a password — that password becomes your OBS Stream Key.
+
+3. **OBS → Settings → Stream** (Service: Custom):
+
+   - **Server**: `rtmp://<your-host>/<mount>` — e.g. `rtmp://radio.example.com/live`
+   - **Stream Key**: your mount's source password
+
+   (The classic layout `rtmp://<host>/` + Stream Key `mount?key=password`
+   also works.)
+
+4. **OBS → Settings → Output** — set Video Encoder to `x264` (or a
+   hardware H.264 encoder) and Audio Encoder to AAC (default) or
+   MP3. 2-second keyframe interval is a good default for HLS latency.
+
+5. **Click Start Streaming.** The server log will show
+   `RTMP: Publishing started mount=/live` followed by
+   `RTMP: Parsed AVC config` and `RTMP: Parsed AAC ASC`.
+
+6. **Watch it** three ways:
+
+   - **Built-in player**: `https://<your-host>/player/<mount>`. If the
+     source has video, the player renders an HTML5 `<video>`; Safari
+     plays HLS natively, other browsers get `hls.js` loaded on
+     demand.
+   - **Direct HLS**: `https://<your-host>/<mount>/playlist.m3u8` —
+     works in VLC, mpv, ffplay, and any HLS-capable client.
+   - **Raw video**: `http://<your-host>/<mount>/video` plays the
+     H.264 Annex-B bytes directly (useful for debugging with mpv).
+
 ## API Usage
 
 ### Authentication

relay/codec_aac.go

@@ -85,6 +85,34 @@ func ParseADTSFrames(data []byte) ([]ADTSFrame, []byte) {
 	return frames, remaining
 }
 
+// BuildADTSHeader builds a 7-byte ADTS header for a raw AAC frame of
+// `payloadLen` bytes. Used to wrap raw AAC frames coming out of RTMP
+// (which carries AAC without ADTS) so the MPEG-TS muxer can declare
+// stream_type=0x0F (ADTS-AAC) in the PMT and downstream decoders
+// (ffmpeg, Safari, hls.js) can parse the audio.
+//
+// profile          — AAC profile from the AudioSpecificConfig
+//                    (0=Main, 1=LC, 2=SSR, 3=LTP)
+// sampleRateIdx    — index into the AAC sample-rate table (0–12)
+// channelConfig    — AAC channel configuration (1=mono, 2=stereo, …)
+func BuildADTSHeader(profile, sampleRateIdx, channelConfig byte, payloadLen int) []byte {
+	frameLen := payloadLen + 7
+	h := make([]byte, 7)
+	h[0] = 0xFF
+	// 0b11110001 — sync continued, MPEG-4 version (ID=0), layer=00,
+	// protection_absent=1 (no CRC).
+	h[1] = 0xF1
+	h[2] = (profile << 6) | ((sampleRateIdx & 0x0F) << 2) | ((channelConfig >> 2) & 0x01)
+	h[3] = ((channelConfig & 0x03) << 6) | byte((frameLen>>11)&0x03)
+	h[4] = byte((frameLen >> 3) & 0xFF)
+	// bottom 3 bits of frame_length plus top 5 bits of buffer_fullness
+	// (0x7FF VBR sentinel → top five bits are all 1).
+	h[5] = byte(((frameLen & 0x07) << 5) | 0x1F)
+	// Low 6 bits of buffer_fullness (0x3F) + num_raw_data_blocks (00).
+	h[6] = 0xFC
+	return h
+}
+
 // BuildAudioSpecificConfig creates the 2-byte AudioSpecificConfig
 // used in MP4/fMP4 init segments for AAC-LC.
 func BuildAudioSpecificConfig(profile, sampleRateIdx, channelConfig byte) []byte {

relay/ingest_rtmp.go

@@ -171,6 +171,14 @@ type rtmpHandler struct {
 	sps         []byte  // cached SPS NALU
 	pps         []byte  // cached PPS NALU
 	naluLenSize int     // AVCC NALU length size (usually 4)
+
+	// AAC state parsed from the AudioSpecificConfig (first AAC
+	// SequenceHeader received). Used to wrap raw AAC frames in ADTS
+	// headers before broadcasting so downstream TS muxing / HLS works.
+	aacProfile       byte
+	aacSampleRateIdx byte
+	aacChannelConfig byte
+	aacConfigReady   bool
 }
 
 // OnServe is called when the connection is established.
@@ -287,10 +295,42 @@ func (h *rtmpHandler) OnAudio(timestamp uint32, payload io.Reader) error {
 			h.stream.ContentType = "audio/aac"
 			h.stream.mu.Unlock()
 		}
-		// Skip AAC sequence header (AudioSpecificConfig), only pass raw frames
 		if audioTag.AACPacketType == flvtag.AACPacketTypeSequenceHeader {
+			// Parse AudioSpecificConfig so we can ADTS-wrap later frames.
+			// ASC layout (ISO 14496-3):
+			//   5 bits objectType, 4 bits samplingFreqIdx,
+			//   4 bits channelConfiguration, 3 bits GASpecificConfig.
+			if len(data) >= 2 {
+				objType := (data[0] >> 3) & 0x1F
+				sri := ((data[0] & 0x07) << 1) | ((data[1] >> 7) & 0x01)
+				ch := (data[1] >> 3) & 0x0F
+				h.aacProfile = 0
+				if objType > 0 {
+					h.aacProfile = objType - 1 // ADTS profile = objectType - 1
+				}
+				h.aacSampleRateIdx = sri
+				h.aacChannelConfig = ch
+				h.aacConfigReady = true
+				logger.L.Infow("RTMP: Parsed AAC ASC",
+					"mount", h.mount,
+					"profile", h.aacProfile,
+					"sr_idx", h.aacSampleRateIdx,
+					"ch", h.aacChannelConfig,
+				)
+			}
 			return nil
 		}
+		// Raw AAC payload — prepend ADTS so the MPEG-TS muxer / HLS
+		// clients can actually decode it. Without this the bytes leave
+		// the server as "naked" AAC and any container-based consumer
+		// fails silently.
+		if h.aacConfigReady {
+			hdr := BuildADTSHeader(h.aacProfile, h.aacSampleRateIdx, h.aacChannelConfig, len(data))
+			wrapped := make([]byte, 0, len(hdr)+len(data))
+			wrapped = append(wrapped, hdr...)
+			wrapped = append(wrapped, data...)
+			data = wrapped
+		}
 	default:
 		// Unknown format, pass through
 	}
@@ -397,6 +437,23 @@ func (h *rtmpHandler) parseAVCConfig(data []byte) {
 		}
 	}
 
+	// Publish SPS+PPS as Annex-B on the video stream so a listener that
+	// subscribes via HTTP gets them prepended by the listener handler.
+	// Each NALU is preceded by the 4-byte 00 00 00 01 start code.
+	if h.videoStream != nil && (len(h.sps) > 0 || len(h.pps) > 0) {
+		sc := []byte{0x00, 0x00, 0x00, 0x01}
+		out := make([]byte, 0, len(h.sps)+len(h.pps)+8)
+		if len(h.sps) > 0 {
+			out = append(out, sc...)
+			out = append(out, h.sps...)
+		}
+		if len(h.pps) > 0 {
+			out = append(out, sc...)
+			out = append(out, h.pps...)
+		}
+		h.videoStream.StoreVideoHeaders(out)
+	}
+
 	logger.L.Infow("RTMP: Parsed AVC config",
 		"mount", h.mount,
 		"sps_len", len(h.sps),

relay/mux_mpegts.go

@@ -47,17 +47,30 @@ func (m *TSMuxer) MuxMP3Segment(mp3Data []byte, pts int64) []byte {
 	return buf.Bytes()
 }
 
+// Audio stream_type values used in the MPEG-TS PMT.
+const (
+	audioStreamTypeMP3 byte = 0x03
+	audioStreamTypeAAC byte = 0x0F // ADTS-wrapped AAC
+)
+
 // MuxAVSegment wraps audio and video data into a complete MPEG-TS segment.
-// audioData is MP3 audio, videoData is H.264 Annex B data.
-// audioPTS and videoPTS are presentation timestamps in 90kHz units.
-func (m *TSMuxer) MuxAVSegment(audioData []byte, videoData []byte, audioPTS, videoPTS int64) []byte {
+// audioData is MP3 or ADTS-AAC (pick via audioStreamType); videoData is
+// H.264 Annex-B. audioPTS and videoPTS are 90 kHz PTS values.
+//
+// The PES stream_id field stays mp3StreamID for MP3 and switches to
+// 0xC0 for AAC as well (both are "audio stream 1" in ISO 13818-1 terms;
+// the stream_type in the PMT is what actually distinguishes them).
+func (m *TSMuxer) MuxAVSegment(audioData []byte, videoData []byte, audioPTS, videoPTS int64, audioStreamType byte) []byte {
+	if audioStreamType == 0 {
+		audioStreamType = audioStreamTypeMP3
+	}
 	var buf bytes.Buffer
 
 	// Write PAT
 	m.writePAT(&buf)
 
-	// Write PMT (updated for A/V)
-	m.writePMTAV(&buf)
+	// Write PMT (updated for A/V, with the correct audio stream_type)
+	m.writePMTAV(&buf, audioStreamType)
 
 	// Write video PES first (usually larger, keyframe-aligned)
 	if len(videoData) > 0 {
@@ -72,7 +85,7 @@ func (m *TSMuxer) MuxAVSegment(audioData []byte, videoData []byte, audioPTS, vid
 	return buf.Bytes()
 }
 
-func (m *TSMuxer) writePMTAV(buf *bytes.Buffer) {
+func (m *TSMuxer) writePMTAV(buf *bytes.Buffer, audioStreamType byte) {
 	packet := make([]byte, tsPacketSize)
 
 	packet[0] = tsSyncByte
@@ -104,8 +117,8 @@ func (m *TSMuxer) writePMTAV(buf *bytes.Buffer) {
 	pmt[15] = 0xF0
 	pmt[16] = 0x00
 
-	// Audio stream: MP3
-	pmt[17] = 0x03 // stream_type = 0x03 (MP3)
+	// Audio stream: MP3 (0x03) or ADTS AAC (0x0F) — chosen by caller.
+	pmt[17] = audioStreamType
 	pmt[18] = 0xE0 | byte(audioPID>>8)
 	pmt[19] = byte(audioPID & 0xFF)
 	pmt[20] = 0xF0