Disable build provenance so per-arch tags can be merged into a manifest

Matches the pattern used by Dashboard and Zbrane-Reiner-Web -- release
branch pushes :latest, devel pushes :devel. Requires a REGISTRY_TOKEN
secret on this repo (Settings -> Actions -> Secrets), same as those two.

.gitea/workflows/ci.yml

@@ -0,0 +1,106 @@
+name: CI
+
+# Spustí se při pushi do devel/release a jde i ručně spustit z GUI.
+on:
+  push:
+    branches: [devel, release]
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: amd64
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Instalace Poetry
+        run: pip install poetry==2.4.1
+
+      - name: Instalace závislostí (vč. dev skupiny)
+        run: poetry install --no-interaction
+
+      - name: Ruff
+        run: poetry run ruff check .
+
+      - name: Mypy
+        run: poetry run mypy src
+
+      - name: Testy
+        run: poetry run pytest -q
+
+  # Každá architektura se staví NATIVNĚ na vlastním runneru (label = architektura):
+  #   amd64 -> srv2-amd64-runner (SRV2), arm64 -> srv1-arm64-runner (SRV1, RPi 4).
+  # Žádná emulace (QEMU). Každý běh pushne image s příponou architektury.
+  build:
+    needs: test
+    strategy:
+      matrix:
+        arch: [amd64, arm64]
+    runs-on: ${{ matrix.arch }}
+    steps:
+      - uses: actions/checkout@v4
+
+      # Docker jméno musí být malými písmeny (Honza/Restreamer -> honza/restreamer)
+      - name: Název image
+        run: |
+          echo "IMAGE=gitea.doubynet.eu/$(echo '${{ github.repository }}' \
+            | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
+
+      # release -> latest (produkce), devel -> devel (staging)
+      - name: Značka podle větve
+        run: |
+          if [ "${{ github.ref_name }}" = "release" ]; then
+            echo "MOVING_TAG=latest" >> "$GITHUB_ENV"
+          else
+            echo "MOVING_TAG=devel" >> "$GITHUB_ENV"
+          fi
+
+      - name: Přihlášení do Gitea registry
+        run: |
+          echo '${{ secrets.REGISTRY_TOKEN }}' \
+            | docker login gitea.doubynet.eu -u '${{ github.actor }}' --password-stdin
+
+      # --provenance=false: bez atestace je per-arch tag obyčejný obrázek. S ní by to byl
+      # index (obrázek + atestace) a `docker manifest create` index do indexu nespojí.
+      - name: Build image (${{ matrix.arch }})
+        run: |
+          docker build --provenance=false \
+            -t "$IMAGE:$MOVING_TAG-${{ matrix.arch }}" \
+            -t "$IMAGE:${{ github.sha }}-${{ matrix.arch }}" .
+
+      - name: Push image (${{ matrix.arch }})
+        run: |
+          docker push "$IMAGE:$MOVING_TAG-${{ matrix.arch }}"
+          docker push "$IMAGE:${{ github.sha }}-${{ matrix.arch }}"
+
+  # Spojí obě architektury pod jedno jméno tagu. `docker pull ...:devel` pak na
+  # amd64 i arm64 stroji sám vybere správnou variantu.
+  manifest:
+    needs: build
+    runs-on: amd64
+    steps:
+      - name: Název image a značka
+        run: |
+          echo "IMAGE=gitea.doubynet.eu/$(echo '${{ github.repository }}' \
+            | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
+          if [ "${{ github.ref_name }}" = "release" ]; then
+            echo "MOVING_TAG=latest" >> "$GITHUB_ENV"
+          else
+            echo "MOVING_TAG=devel" >> "$GITHUB_ENV"
+          fi
+
+      - name: Přihlášení do Gitea registry
+        run: |
+          echo '${{ secrets.REGISTRY_TOKEN }}' \
+            | docker login gitea.doubynet.eu -u '${{ github.actor }}' --password-stdin
+
+      - name: Multi-arch manifest (moving tag + commit SHA)
+        run: |
+          for TAG in "$MOVING_TAG" "${{ github.sha }}"; do
+            docker manifest create --amend "$IMAGE:$TAG" \
+              "$IMAGE:$TAG-amd64" "$IMAGE:$TAG-arm64"
+            docker manifest push "$IMAGE:$TAG"
+          done

CHANGELOG.md

@@ -12,5 +12,18 @@ All notable changes to this project are documented in this file.
   and per-channel MPEG-TS streams for Jellyfin Live TV.
 - Docker Compose deployment (`Dockerfile`, `docker-compose.yml`) and configuration templates
   (`channels.example.yaml`, `.env.example`).
+- Gitea Actions CI (`.gitea/workflows/ci.yml`): ruff, mypy and pytest, then native `amd64` and `arm64` image builds on
+  separate runners (no emulation), merged into one multi-arch tag (`:devel` from `devel`, `:latest` from `release`,
+  plus a commit-SHA tag). Per-architecture tags carry an `-amd64` / `-arm64` suffix.
 - Unit test suite covering config parsing, URL expiry parsing, ffmpeg argument building, playlist generation, and
   broadcast fan-out.
+
+### Fixed
+
+- `/stream/{channel_id}` now forces the connection closed after each response (`Connection: close`) instead of
+  allowing keep-alive. Jellyfin's M3U tuner client (`SharedHttpStream`) was reusing a pooled keep-alive connection
+  still mid-stream from an earlier request and reading raw MPEG-TS bytes as if they were a fresh HTTP response,
+  failing with "Received an invalid status line".
+- The yt-dlp resolver now correctly classifies which of the two `requested_formats` entries is audio when a live
+  stream is split into separate video-only and audio-only renditions; it previously relied on `acodec` being set,
+  which yt-dlp does not consistently do for audio-only formats, causing every resolve to fail.

PROJECT.md

@@ -14,6 +14,8 @@ Initial implementation in place:
   aiohttp server (`/playlist.m3u`, `/stream/{channel_id}`, `/healthz`), config loading.
 - `serve.py` — entry point.
 - `Dockerfile` / `docker-compose.yml` — containerized deployment.
+- `.gitea/workflows/ci.yml` — CI: tests, then native `amd64` + `arm64` builds (one runner per architecture) merged
+  into a single multi-arch image in the Gitea registry.
 - `channels.example.yaml`, `.env.example` — configuration templates.
 - Unit tests for the pure/testable pieces (config parsing, URL expiry parsing, ffmpeg argument building, playlist
   generation, broadcast fan-out).

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "restreamer"
-version = "0.1.0"
+version = "1.0.0"
 description = "Restreams YouTube livestreams as continuous local streams consumable by Jellyfin Live TV"
 authors = [
     {name = "Jan Doubravsky",email = "jan.doubravsky@gmail.com"}

src/restreamer/http_server.py

@@ -42,6 +42,10 @@ async def _handle_stream(request: web.Request) -> web.StreamResponse:
         raise web.HTTPNotFound(text=f"Unknown channel '{channel_id}'")
 
     response = web.StreamResponse(status=200, headers={"Content-Type": MPEGTS_CONTENT_TYPE})
+    # A live stream is never meant to be pooled and reused for a later request; some HTTP
+    # clients (e.g. Jellyfin's SharedHttpStream) get fed stale bytes from a dangling
+    # keep-alive connection if we let one linger here. Force a fresh connection every time.
+    response.force_close()
     await response.prepare(request)
 
     queue = broadcaster.subscribe()
@@ -51,7 +55,7 @@ async def _handle_stream(request: web.Request) -> web.StreamResponse:
             if chunk is None:
                 break
             await response.write(chunk)
-    except ConnectionResetError:
+    except (ConnectionResetError, ConnectionAbortedError):
         logger.debug("Client disconnected from channel '{}'", channel_id)
     finally:
         broadcaster.unsubscribe(queue)