feat: engineering infrastructure, SIP gateway, DVR, and protocol enhancements

.github/workflows/ci.yml

@@ -0,0 +1,105 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v6
+        with:
+          version: latest
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install FFmpeg dev libraries
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            pkg-config libavcodec-dev libswresample-dev libavutil-dev
+
+      - name: Build
+        run: CGO_ENABLED=1 go build -tags audiocodec ./cmd/liveforge
+
+      - name: Test
+        run: CGO_ENABLED=1 go test -race -coverprofile=coverage.out -covermode=atomic ./...
+
+      - name: Upload coverage
+        if: github.event_name == 'pull_request'
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage
+          path: coverage.out
+
+  security:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install gosec
+        run: go install github.com/securego/gosec/v2/cmd/gosec@latest
+
+      - name: Run gosec
+        run: gosec -exclude-generated ./...
+
+  docker:
+    name: Docker Build
+    runs-on: ubuntu-latest
+    needs: [lint, test, security]
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Extract version
+        id: version
+        run: echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm64
+          build-args: VERSION=${{ steps.version.outputs.sha_short }}
+          tags: |
+            impingo/liveforge:latest
+            impingo/liveforge:${{ steps.version.outputs.sha_short }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/release.yml

@@ -0,0 +1,68 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Extract tag
+        id: tag
+        run: echo "version=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm64
+          build-args: VERSION=${{ steps.tag.outputs.version }}
+          tags: |
+            impingo/liveforge:${{ steps.tag.outputs.version }}
+            impingo/liveforge:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build release binaries
+        run: |
+          mkdir -p dist
+          for os_arch in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
+            os="${os_arch%/*}"
+            arch="${os_arch#*/}"
+            output="dist/liveforge-${os}-${arch}"
+            [ "$os" = "linux" ] && cgo=1 || cgo=0
+            CGO_ENABLED=$cgo GOOS=$os GOARCH=$arch \
+              go build -trimpath \
+              -ldflags "-s -w -X main.version=${{ steps.tag.outputs.version }}" \
+              -o "$output" ./cmd/liveforge
+          done
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          files: dist/*

.golangci.yml

@@ -0,0 +1,48 @@
+run:
+  timeout: 5m
+  go: "1.26"
+
+linters:
+  enable:
+    - errcheck
+    - govet
+    - staticcheck
+    - unused
+    - ineffassign
+    - gosimple
+    - typecheck
+    - bodyclose
+    - durationcheck
+    - errname
+    - errorlint
+    - exportloopref
+    - gosec
+    - makezero
+    - nilerr
+    - prealloc
+    - unconvert
+    - unparam
+    - wastedassign
+
+linters-settings:
+  govet:
+    enable-all: true
+    disable:
+      - fieldalignment
+  gosec:
+    excludes:
+      - G104  # unhandled errors (too noisy for streaming server)
+      - G304  # file path from variable (expected for config loading)
+  errcheck:
+    exclude-functions:
+      - (net.Conn).Close
+      - (io.Closer).Close
+      - (*os.File).Close
+
+issues:
+  exclude-dirs:
+    - vendor
+    - third_party
+    - tools
+  max-issues-per-linter: 50
+  max-same-issues: 5

cmd/liveforge/main.go

@@ -23,6 +23,8 @@ import (
 	gb28181mod "github.com/im-pingo/liveforge/module/gb28181"
 	metricsmod "github.com/im-pingo/liveforge/module/metrics"
 	sipmod "github.com/im-pingo/liveforge/module/sip"
+	sipgwmod "github.com/im-pingo/liveforge/module/sipgateway"
+	dvrmod "github.com/im-pingo/liveforge/module/dvr"
 	srtmod "github.com/im-pingo/liveforge/module/srt"
 	webrtcmod "github.com/im-pingo/liveforge/module/webrtc"
 )
@@ -92,6 +94,13 @@ func main() {
 		s.RegisterModule(gb28181mod.NewModule(sipModule.Service()))
 	}
 
+	if cfg.SIP.Gateway.Enabled {
+		if sipModule == nil {
+			log.Fatal("sip gateway requires sip to be enabled")
+		}
+		s.RegisterModule(sipgwmod.NewModule(sipModule.Service()))
+	}
+
 	// Notify must be registered before API so its WebSocket handler
 	// is available when the API module registers routes.
 	if cfg.Notify.HTTP.Enabled || cfg.Notify.WebSocket.Enabled {
@@ -112,6 +121,10 @@ func main() {
 		s.RegisterModule(record.NewModule())
 	}
 
+	if cfg.DVR.Enabled {
+		s.RegisterModule(dvrmod.NewModule())
+	}
+
 	if cfg.Metrics.Enabled {
 		s.RegisterModule(metricsmod.NewModule())
 	}
@@ -124,9 +137,24 @@ func main() {
 
 	// Block until signal
 	sigCh := make(chan os.Signal, 1)
-	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
-	sig := <-sigCh
-	slog.Info("shutting down", "signal", sig.String())
+	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP)
+	for {
+		sig := <-sigCh
+		if sig == syscall.SIGHUP {
+			slog.Info("received SIGHUP, reloading config", "path", *configPath)
+			newCfg, err := config.Load(*configPath)
+			if err != nil {
+				slog.Error("config reload failed", "error", err)
+				continue
+			}
+			logger.Init(newCfg.Server.LogLevel)
+			s.UpdateConfig(newCfg)
+			slog.Info("config reloaded successfully")
+			continue
+		}
+		slog.Info("shutting down", "signal", sig.String())
+		break
+	}
 
 	s.Shutdown()
 	slog.Info("server stopped")