Merge pull request #1211 from Dispatcharr/watch-live-recordings

Enhance DVR functionality with HLS support and improved queue management

CHANGELOG.md

@@ -7,8 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- **Authorization on DVR recording playback endpoints**. `RecordingViewSet.file` and `RecordingViewSet.hls` now require an authenticated session and enforce a per-user channel-access check before serving any bytes. Admins (`user_level >= 10`) are always allowed; standard users are allowed only when the recording's source channel is visible under their channel-profile assignments and within their `user_level`, mirroring the same logic used by `stream_xc` for live channels. Unauthenticated requests now receive `403 Forbidden` instead of being served. The pre-existing `network_access_allowed(request, "STREAMS")` perimeter check is retained as a separate, prior gate so external IPs can be blocked from streaming entirely even with a valid token.
+
 ### Fixed
 
+- **Empty show/season folders left behind after deleting a recording**. Deleting a recording removes the MKV (or HLS working directory if still in progress) but previously left the parent show / season directories on disk even when they no longer contained any other recordings. After file cleanup, `RecordingViewSet.destroy` now walks up from the deleted file's parent directory and removes any now-empty directories, stopping at the `/data/recordings` library root so the root itself is never touched.
+- **Premature DVR concat on graceful Celery worker shutdown**. A `worker_shutting_down` signal handler in `apps/channels/tasks.py` now sets a module-level `_DVR_SHUTTING_DOWN` flag. The `run_recording` loop checks this flag after FFmpeg exits and, if the recording's `end_time` has not yet passed, skips concatenation and persists `status="interrupted"` with `interrupted_reason="server_shutdown"`. The HLS working directory is preserved across the restart so the recovery path on the next worker startup can resume segment numbering from where it left off rather than truncating the show.
 - **Channel start/stop notifications missing name**: the "channel started" toast never showed up and the "channel stopped" toast showed the raw UUID instead of the channel name. `channel_name` is now written into the Redis metadata hash at init time and included in every stats payload pushed over WebSocket; the frontend notification functions read `ch.channel_name` from the stats payload directly, falling back to the store lookup and then a formatted placeholder. Both notifications now display the correct channel name.
 - **Channel form reset on group creation**: creating a new channel group from within the channel create/edit form no longer wipes all filled-in form fields. The newly created group is also automatically selected in the channel group field after it is saved. (Fixes #545)
 - **EPG channel name truncation**: EPG sources that include long `<display-name>` values (e.g. event-based channels with descriptions appended to the name) would crash the channel-parse task with a `value too long for type character varying(255)` PostgreSQL error and silently discard the entire batch. The `EPGData.name`, `Stream.name`, and `Channel.name` fields have been widened to 512 characters, and names exceeding this limit are now truncated with a warning log rather than aborting the import. (Fixes #1134)
@@ -16,6 +22,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **In-progress recording playback from the DVR page**. The Watch button on a recording card is now enabled while the recording is still in progress, and the in-app floating player can play the live HLS playlist with full timeshift / scrub-back to the start of the recording.
+  - The frontend now bundles `hls.js` and routes any `.m3u8` URL through it (Chrome, Edge, Firefox, and other Chromium-based browsers). Native HLS via `<video src=>` is reserved for Safari, where it Just Works for the same playlist.
+  - hls.js requests are authenticated via `xhrSetup`, attaching the same `Authorization: Bearer <accessToken>` header the live mpegts.js player already uses, so the new per-user authorization check on the recording endpoints (see Security) is satisfied for every playlist refresh and segment fetch.
+- **Watch DVR recordings live while they are still recording**: `run_recording` has been refactored from a single TS file capture to an FFmpeg HLS segmentation pipeline. While recording is in progress, the `file_url` exposed on the recording points to a new `/api/channels/recordings/{id}/hls/index.m3u8` endpoint instead of the eventual MKV path, so any HLS-capable client (the built-in web player, VLC, infuse, channels DVR clients, etc.) can join the stream at any time and watch from the live edge. When the recording ends, the segments are concatenated into the final MKV, `file_url` is updated to point to the existing `/file/` endpoint, and the HLS working directory is cleaned up. Hitting `/file/` while a recording is still in progress now redirects to the HLS playlist rather than 404, and hitting `/hls/index.m3u8` after the recording has finalized redirects to `/file/`, so URLs cached by clients in either form continue to work across the transition.
+- New HLS playback endpoint (`RecordingViewSet.hls`) serves `.m3u8` and `.ts` files out of the recording's working directory with path traversal protection (`os.path.realpath` containment check). Playlist files are rewritten on the fly so each segment line becomes an absolute URL routed back through this endpoint, preserving authentication and path isolation. Both this and the existing `/file/` endpoint are gated by the `STREAMS` network policy and a per-user authorization check (see Security).
+- Explicit `path('recordings/<int:pk>/hls/<path:seg_path>', ...)` route registered in `apps/channels/api_urls.py` _before_ `router.urls`. DRF's `DefaultRouter` appends a mandatory trailing slash to every URL it generates, but HLS players request segments by their natural filenames (`seg_00001.ts`) without a trailing slash, so the explicit route is required for the player to ever reach the view.
+- `DISPATCHARR_WEB_HOST` environment variable for modular deployments. The Celery container needs to reach the uWSGI / web container to fetch HLS segments while recording (FFmpeg pulls from the public stream URL, the same way any other client does). `get_dvr_stream_base_url()` resolves the base URL deterministically: AIO / dev / debug containers reach uWSGI on `127.0.0.1:$DISPATCHARR_PORT` since Celery and uWSGI share the container, while modular deployments use `http://$DISPATCHARR_WEB_HOST:$DISPATCHARR_PORT` and default `DISPATCHARR_WEB_HOST` to `web` (the compose service name). Documented as a commented-out override in `docker/docker-compose.yml`.
+- HLS viewer heartbeat. Every `.ts` request refreshes a Redis key `dvr:hls_viewer:{id}` with a 20 second TTL. After concat succeeds, the recording task waits for that key to expire naturally before deleting the HLS working directory, so an actively-watching client is never cut off mid-segment when the recording ends. Cleanup happens within 20 seconds of the last client stopping, with a 4 hour safety cap as a guard against a stuck Redis state.
 - **VOD start/stop notifications**: the frontend now shows a toast notification when a VOD stream starts or stops. `vod_started` and `vod_stopped` WebSocket events are fired from the backend when a new provider connection is opened or the last active stream on a session ends. The 1-second delayed-cleanup window is used as a settle period before firing `vod_stopped`, so seek reconnects that re-establish `active_streams` within that window suppress the notification. A `vod_stats` WebSocket push is sent alongside every event to keep the Stats page connection table in sync in real time. `vod_start` and `vod_stop` system events are also written to the system event log for each transition, and are now selectable as integration trigger events (webhook/script) in the Connect page.
 - **Channel Profiles column in Users table**: users can now see all channel profiles assigned to each user directly in the Users table. Added tooltips for profile names to handle overflow, adjusted column sizing to prevent overflow between columns, and improved the table layout for better readability. (Closes #819) — Thanks [@damien-alt-sudo](https://github.com/damien-alt-sudo)
 - **Plugin warning & disclaimer components**: extracted shared plugin warning UI into a new `PluginWarnings.jsx` component and normalized warning/disclaimer usage across all plugin action modals. New reusable components: `PluginSecurityWarning` (untrusted code), `PluginSupportDisclaimer` (community support scope), `PluginDowngradeWarning` (version downgrade), `PluginInfoNote` (informational), and `PluginRestartWarning` (backend restart on import). Updated `Plugins.jsx`, `AvailablePluginCard.jsx`, and `PluginCard.jsx` to use the shared components. — Thanks [@sethwv](https://github.com/sethwv)
@@ -42,9 +56,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Eliminated per-tick DB queries from the channel stats system. Previously `get_basic_channel_info()` in `channel_status.py` issued a `Stream.objects.filter()` and an `M3UAccountProfile.objects.filter()` on every stats tick for each active channel to resolve display names. Channel name and stream name are now written into the Redis metadata hash at channel-init time (via `initialize_channel`) and read back directly during stats collection, zero DB queries per tick. `m3u_profile_name` is now resolved on the frontend from the already-loaded playlists store rather than being pushed from the backend.
 - Eliminated a redundant `Channel` DB lookup inside `ChannelService.initialize_channel()`. `views.py` already fetches the `Channel` object via `get_stream_object()` before calling `initialize_channel()`; `channel.name` is now passed as an optional `channel_name` parameter, so the service uses the caller-supplied value and only falls back to a DB query when the name is not provided (e.g. stream-preview paths). A matching `stream_name` parameter was added for the same reason; the `stream_name` DB query is skipped entirely on normal channel start since a channel name is always available.
 - Eliminated a redundant `Stream` DB lookup on stream switches. `get_stream_info_for_switch()` already fetches the `Stream` object to build the URL; it now includes `stream_name` in its return dict. `change_stream_url()` captures that value and passes it through to `_update_channel_metadata()`, which skips its own `Stream.objects.filter()` when the name is already known.
+- **Dedicated thread-pool Celery worker for DVR recordings**. `run_recording` is long-running and almost entirely I/O-bound: it loops in short ticks polling FFmpeg, the DB, and Redis for the full duration of the recording. Running it on the default prefork worker pool (`--autoscale=6,1`) meant at most 6 concurrent recordings, and only if no other background work was running. M3U refreshes, EPG parsing, channel matching, comskip, etc. all competed for the same 6 slots, so if every worker was busy when a recording's start time arrived, the task would queue in Redis and FFmpeg would not start until a worker freed up, causing the user to miss the beginning of the show.
+  - A second Celery worker is now started alongside the default one, configured with `--pool=threads --concurrency=20` and bound to a dedicated `dvr` queue. Threads fit this workload because every blocking call in `run_recording` releases the GIL (sleep, subprocess wait, file / DB / Redis I/O) and FFmpeg itself runs in a separate OS process. A `task_routes` entry in `dispatcharr/celery.py` routes `apps.channels.tasks.run_recording` to the `dvr` queue regardless of how it is dispatched (Celery Beat `PeriodicTask`, `.delay()`, etc.). The default prefork worker now subscribes only to the `celery` queue (`-Q celery -n default@%h --autoscale=6,1`), so recordings can no longer starve background tasks and background tasks can no longer delay recordings.
+
+  - Net result: up to 20 concurrent recordings, zero startup delay regardless of EPG / M3U refresh activity, and a memory cost of roughly 80 to 120 MB for the second always-on worker process. Each additional concurrent recording costs nearly nothing on top because all 20 threads share that single process. Applied to AIO (`docker/uwsgi.ini`), dev (`docker/uwsgi.dev.ini`), debug (`docker/uwsgi.debug.ini`), and the modular celery container (`docker/entrypoint.celery.sh`).
 
 ### Changed
 
+- DVR recording pipeline rewritten around FFmpeg + HLS. The previous implementation wrote a single growing `.ts` file via the proxy and remuxed it to `.mkv` at the end; the new implementation runs FFmpeg with `-f hls`, regenerates monotonic PTS to handle erratic IPTV source timestamps, shifts output timestamps so they start at 0 (fixing negative-PTS streams that prevented HLS segment boundary detection), and concatenates the resulting segments into the final MKV at the end of the recording. Server-restart resume now continues segment numbering from the previous session rather than overwriting earlier segments.
+- Stall detection added to the recording loop. Once the first segment confirms the stream is flowing, the loop watches both segment count and segment file mtime. If neither advances for the configured stall window (e.g. when an upstream proxy ghost-kills the client), FFmpeg is signaled and the recording ends cleanly rather than hanging until `end_time`. Recording duration is honored via SIGINT so FFmpeg writes `#EXT-X-ENDLIST` cleanly into the final playlist.
+- `end_time` extension is now picked up by the running recording without restarting FFmpeg. The DB poll loop simply updates the in-memory deadline.
+- Recording cancellation cleanup updated for the new layout. `RecordingViewSet.destroy()` now removes the HLS working directory via a `_safe_rmtree` helper (with the same `allowed_roots` containment check used for the existing `_safe_remove`) instead of trying to delete the obsolete `_temp_file_path`.
+- HLS working directory lifecycle in `custom_properties` is now two-phase. After concat succeeds, only `file_url` and `output_file_url` are updated so new client requests are redirected to the final MKV via `/file/`; `_hls_dir` is intentionally preserved through the viewer-wait grace period so in-flight `.ts` requests keep resolving. `_hls_dir` is cleared from `custom_properties` only after `shutil.rmtree` actually removes the directory.
 - **Column resizing in `CustomTable`**: column widths are now propagated to body cells via CSS custom properties (`--header-{id}-size`) injected on the table wrapper, rather than reading `column.getSize()` directly in each cell's React style. This decouples body-cell widths from React renders so that memoized rows (which skip re-renders for performance) still reflect resize changes instantly via CSS cascade.
 - Decoupled row expansion from row selection in `CustomTable`, expanding a channel row no longer also selects it. Added an `onRowExpansionChange` callback to `useTable` so callers can react to expansion changes independently of selection state.
 - Fixed a stale-closure bug in memoized channel row checkboxes, `selectedTableIdsRef` now ensures the checkbox `onChange` handler and `handleShiftSelect` always read the current selection set rather than the stale set captured at render time. Without this, clicking any checkbox after the first would silently deselect previously checked rows.

apps/channels/api_urls.py

@@ -49,6 +49,11 @@ urlpatterns = [
     path('series-rules/bulk-remove/', BulkRemoveSeriesRecordingsAPIView.as_view(), name='bulk_remove_series_recordings'),
     path('series-rules/<path:tvg_id>/', DeleteSeriesRuleAPIView.as_view(), name='delete_series_rule'),
     path('recordings/bulk-delete-upcoming/', BulkDeleteUpcomingRecordingsAPIView.as_view(), name='bulk_delete_upcoming_recordings'),
+    path(
+        'recordings/<int:pk>/hls/<path:seg_path>',
+        RecordingViewSet.as_view({'get': 'hls'}),
+        name='recording-hls',
+    ),
     path('dvr/comskip-config/', ComskipConfigAPIView.as_view(), name='comskip_config'),
 ]
 

apps/channels/api_views.py

@@ -62,13 +62,14 @@ from rest_framework.filters import SearchFilter, OrderingFilter
 from apps.epg.models import EPGData
 from apps.vod.models import Movie, Series
 from django.db.models import Q
-from django.http import HttpResponse, StreamingHttpResponse, FileResponse, Http404
+from django.http import HttpResponse, StreamingHttpResponse, FileResponse, Http404, JsonResponse, HttpResponseRedirect
 from django.utils import timezone
 import mimetypes
 from django.conf import settings
 
 from rest_framework.pagination import PageNumberPagination
 
+from dispatcharr.utils import network_access_allowed
 
 
 logger = logging.getLogger(__name__)
@@ -2444,13 +2445,58 @@ class RecordingViewSet(viewsets.ModelViewSet):
 
     def get_permissions(self):
         # Allow unauthenticated playback of recording files (like other streaming endpoints)
-        if self.action == 'file':
+        if self.action in ('file', 'hls'):
             return [AllowAny()]
         try:
             return [perm() for perm in permission_classes_by_action[self.action]]
         except KeyError:
             return [Authenticated()]
 
+    def _user_can_play_recording(self, request, recording):
+        """Authorization gate for recording playback (file/hls actions).
+
+        Mirrors how live stream endpoints authorize non-admin users, but
+        unlike the XC-style endpoints these URLs carry no credentials of
+        their own, so we require an authenticated session/JWT:
+          * Unauthenticated requests → denied.
+          * Admins (user_level >= 10) → allowed.
+          * Authenticated non-admins → allowed only if the recording's
+            source channel is visible under their channel-profile
+            assignments and within their user_level.
+
+        The network_access_allowed(request, "STREAMS") check applied
+        before this is a network-perimeter gate (e.g. block external IPs
+        from streaming at all); it is not a substitute for per-user
+        authorization.
+        """
+        user = getattr(request, "user", None)
+        if not user or not getattr(user, "is_authenticated", False):
+            return False
+        if getattr(user, "user_level", 0) >= 10:
+            return True
+
+        channel = getattr(recording, "channel", None)
+        if channel is None:
+            # Recording with no source channel, only admins can play.
+            return False
+
+        try:
+            user_profile_count = user.channel_profiles.count()
+        except Exception:
+            user_profile_count = 0
+
+        filters = {
+            "id": channel.id,
+            "user_level__lte": user.user_level,
+        }
+        if user_profile_count > 0:
+            filters["channelprofilemembership__enabled"] = True
+            filters["channelprofilemembership__channel_profile__in"] = (
+                user.channel_profiles.all()
+            )
+            return Channel.objects.filter(**filters).distinct().exists()
+        return Channel.objects.filter(**filters).exists()
+
     @action(detail=True, methods=["post"], url_path="comskip")
     def comskip(self, request, pk=None):
         """Trigger comskip processing for this recording."""
@@ -2464,14 +2510,32 @@ class RecordingViewSet(viewsets.ModelViewSet):
 
     @action(detail=True, methods=["get"], url_path="file")
     def file(self, request, pk=None):
-        """Stream a recorded file with HTTP Range support for seeking."""
+        """Stream a completed recording file with HTTP Range support for seeking.
+
+        For in-progress recordings, file_url in custom_properties points to
+        /hls/index.m3u8.  If a client hits this endpoint while the recording
+        is still running (or the MKV is not yet produced), it is redirected to
+        the HLS playlist endpoint.
+        """
+        if not network_access_allowed(request, "STREAMS"):
+            return JsonResponse({"error": "Forbidden"}, status=403)
         recording = get_object_or_404(Recording, pk=pk)
+        if not self._user_can_play_recording(request, recording):
+            return JsonResponse({"error": "Forbidden"}, status=403)
         cp = recording.custom_properties or {}
         file_path = cp.get("file_path")
         file_name = cp.get("file_name") or "recording"
 
-        if not file_path or not os.path.exists(file_path):
-            raise Http404("Recording file not found")
+        if not file_path or not os.path.exists(file_path) or os.path.getsize(file_path) == 0:
+            # Redirect to HLS if recording is still in progress
+            hls_dir = cp.get("_hls_dir")
+            if hls_dir and os.path.isdir(hls_dir):
+                hls_url = request.build_absolute_uri(
+                    f"/api/channels/recordings/{pk}/hls/index.m3u8"
+                )
+                return HttpResponseRedirect(hls_url)
+            if not file_path or not os.path.exists(file_path):
+                raise Http404("Recording file not found")
 
         # Guess content type
         ext = os.path.splitext(file_path)[1].lower()
@@ -2532,6 +2596,74 @@ class RecordingViewSet(viewsets.ModelViewSet):
         response["Content-Disposition"] = f"inline; filename=\"{file_name}\""
         return response
 
+    @action(detail=True, methods=["get"], url_path="hls/(?P<seg_path>.+)")
+    def hls(self, request, pk=None, seg_path=None):
+        """Serve HLS playlist and segment files for an in-progress (or completed) recording.
+
+        Clients connecting during recording should use the m3u8 URL returned in
+        custom_properties.file_url.  Segment URLs inside the playlist are rewritten
+        to route through this endpoint so authentication and path isolation are
+        preserved.
+        """
+        if not network_access_allowed(request, "STREAMS"):
+            return JsonResponse({"error": "Forbidden"}, status=403)
+        recording = get_object_or_404(Recording, pk=pk)
+        if not self._user_can_play_recording(request, recording):
+            return JsonResponse({"error": "Forbidden"}, status=403)
+        cp = recording.custom_properties or {}
+        hls_dir = cp.get("_hls_dir")
+
+        if not hls_dir or not os.path.isdir(hls_dir):
+            # HLS dir is gone, recording is likely complete.  Redirect to the
+            # permanent MKV endpoint for .m3u8 requests so clients that still
+            # have the HLS URL bookmarked get a useful response.
+            cp = recording.custom_properties or {}
+            file_path = cp.get("file_path")
+            if seg_path.endswith(".m3u8") and file_path and os.path.exists(file_path) and os.path.getsize(file_path) > 0:
+                return HttpResponseRedirect(
+                    request.build_absolute_uri(f"/api/channels/recordings/{pk}/file/")
+                )
+            raise Http404("HLS content not available for this recording")
+
+        # Security: prevent path traversal outside the HLS directory
+        safe_dir = os.path.realpath(hls_dir)
+        requested = os.path.realpath(os.path.join(hls_dir, seg_path))
+        if not requested.startswith(safe_dir + os.sep) and requested != safe_dir:
+            return Response({"error": "Forbidden"}, status=403)
+
+        if not os.path.isfile(requested):
+            raise Http404(f"HLS file not found: {seg_path}")
+
+        if seg_path.endswith(".m3u8"):
+            # Rewrite relative segment lines to absolute URLs through this API
+            base_url = request.build_absolute_uri(
+                f"/api/channels/recordings/{pk}/hls/"
+            )
+            lines = []
+            with open(requested) as _f:
+                for line in _f:
+                    stripped = line.strip()
+                    if stripped and not stripped.startswith("#"):
+                        lines.append(f"{base_url}{stripped}\n")
+                    else:
+                        lines.append(line)
+            return HttpResponse("".join(lines), content_type="application/x-mpegURL")
+
+        if seg_path.endswith(".ts"):
+            # Refresh the viewer heartbeat in Redis so the Celery task knows an
+            # active client is still fetching segments.  TTL is 20 s, enough for
+            # three 4-second segments plus network margin.
+            try:
+                from core.utils import RedisClient
+                _rv = RedisClient.get_client(max_retries=1, retry_interval=0)
+                if _rv:
+                    _rv.set(f"dvr:hls_viewer:{pk}", "1", ex=20)
+            except Exception:
+                pass
+            return FileResponse(open(requested, "rb"), content_type="video/mp2t")
+
+        raise Http404("Unsupported HLS file type")
+
     @action(detail=True, methods=["post"], url_path="stop")
     def stop(self, request, pk=None):
         """Stop a recording early while retaining the partial content for playback."""
@@ -2838,7 +2970,7 @@ class RecordingViewSet(viewsets.ModelViewSet):
         cp = instance.custom_properties or {}
         rec_status = cp.get("status", "")
         file_path = cp.get("file_path")
-        temp_ts_path = cp.get("_temp_file_path")
+        hls_dir = cp.get("_hls_dir")
         channel_uuid = str(instance.channel.uuid)
 
         # 1. Delete the DB record (also fires post_delete → revoke_task_on_delete)
@@ -2871,6 +3003,41 @@ class RecordingViewSet(viewsets.ModelViewSet):
             except Exception as ex:
                 logger.warning(f"Failed to delete recording artifact {path}: {ex}")
 
+        def _safe_rmtree(path: str):
+            if not path or not isinstance(path, str):
+                return
+            try:
+                import shutil as _shutil
+                if any(path.startswith(root) for root in allowed_roots) and os.path.isdir(path):
+                    _shutil.rmtree(path)
+                    logger.info(f"Deleted recording HLS directory: {path}")
+            except Exception as ex:
+                logger.warning(f"Failed to delete HLS directory {path}: {ex}")
+
+        # Clean up empty parent directories up to the recordings root to prevent orphaned folders from accumulating over time.
+        recordings_root = os.path.normpath('/data/recordings')
+
+        def _prune_empty_parents(path: str):
+            if not path or not isinstance(path, str):
+                return
+            try:
+                parent = os.path.dirname(os.path.normpath(path))
+                while (
+                    parent
+                    and parent != recordings_root
+                    and parent.startswith(recordings_root + os.sep)
+                    and os.path.isdir(parent)
+                    and not os.listdir(parent)
+                ):
+                    try:
+                        os.rmdir(parent)
+                        logger.info(f"Removed empty recording directory: {parent}")
+                    except OSError:
+                        break
+                    parent = os.path.dirname(parent)
+            except Exception as ex:
+                logger.debug(f"Unable to prune empty parents for {path}: {ex}")
+
         def _background_cancel():
             # Only stop the DVR client if the recording was actively streaming.
             # Stopping for completed/upcoming recordings would kill an unrelated
@@ -2888,7 +3055,13 @@ class RecordingViewSet(viewsets.ModelViewSet):
             # Best-effort file cleanup in case run_recording already exited
             # before the DB delete.
             _safe_remove(file_path)
-            _safe_remove(temp_ts_path)
+            _safe_rmtree(hls_dir)
+
+            # If removing the file/HLS dir leaves the show/season folder
+            # empty, clean those up too.  Both paths share the same parent
+            # in normal layouts, but run the prune for each just in case.
+            _prune_empty_parents(file_path)
+            _prune_empty_parents(hls_dir)
 
             try:
                 from django.db import connection as _conn

apps/channels/tests/test_dvr_port_resolution.py

@@ -2,58 +2,68 @@ import os
 from django.test import SimpleTestCase
 from unittest.mock import patch
 
-from apps.channels.tasks import build_dvr_candidates
+from apps.channels.tasks import get_dvr_stream_base_url
 
 
-class DVRPortResolutionTests(SimpleTestCase):
+class DVRStreamBaseURLTests(SimpleTestCase):
     """
-    Tests that DVR recording candidate URLs respect the DISPATCHARR_PORT
-    environment variable instead of hardcoding port 9191.
+    Tests that get_dvr_stream_base_url() returns the correct single URL
+    for each deployment mode.
     """
 
-    @patch.dict(os.environ, {'REDIS_HOST': 'redis'}, clear=True)
-    def test_default_port_uses_9191(self):
-        """Without DISPATCHARR_PORT set, candidates default to 9191."""
-        candidates = build_dvr_candidates()
-        self.assertIn('http://web:9191', candidates)
-        self.assertIn('http://localhost:9191', candidates)
+    @patch.dict(os.environ, {}, clear=True)
+    def test_aio_default_uses_localhost_5656(self):
+        """AIO mode (default) reaches uwsgi directly on loopback port 5656."""
+        url = get_dvr_stream_base_url()
+        self.assertEqual(url, 'http://127.0.0.1:5656')
 
-    @patch.dict(os.environ, {'DISPATCHARR_PORT': '8080', 'REDIS_HOST': 'redis'}, clear=True)
-    def test_custom_port_reflected_in_candidates(self):
-        """DISPATCHARR_PORT=8080 replaces all hardcoded 9191 references."""
-        candidates = build_dvr_candidates()
-        self.assertIn('http://web:8080', candidates)
-        self.assertIn('http://localhost:8080', candidates)
-        self.assertNotIn('http://web:9191', candidates)
-        self.assertNotIn('http://localhost:9191', candidates)
+    @patch.dict(os.environ, {'DISPATCHARR_ENV': 'aio'}, clear=True)
+    def test_aio_explicit_uses_localhost_5656(self):
+        """Explicit DISPATCHARR_ENV=aio also uses loopback port 5656."""
+        url = get_dvr_stream_base_url()
+        self.assertEqual(url, 'http://127.0.0.1:5656')
+
+    @patch.dict(os.environ, {'DISPATCHARR_ENV': 'dev'}, clear=True)
+    def test_dev_mode_uses_localhost_5656(self):
+        """Dev mode shares the container with uwsgi — uses loopback port 5656."""
+        url = get_dvr_stream_base_url()
+        self.assertEqual(url, 'http://127.0.0.1:5656')
+
+    @patch.dict(os.environ, {'DISPATCHARR_ENV': 'modular', 'DISPATCHARR_PORT': '9191'}, clear=True)
+    def test_modular_uses_web_service_name(self):
+        """Modular mode uses the 'web' Docker service name by default."""
+        url = get_dvr_stream_base_url()
+        self.assertEqual(url, 'http://web:9191')
+
+    @patch.dict(os.environ, {'DISPATCHARR_ENV': 'modular', 'DISPATCHARR_PORT': '8080'}, clear=True)
+    def test_modular_custom_port(self):
+        """Modular mode respects DISPATCHARR_PORT."""
+        url = get_dvr_stream_base_url()
+        self.assertEqual(url, 'http://web:8080')
 
     @patch.dict(os.environ, {
-        'DISPATCHARR_PORT': '7777',
-        'DISPATCHARR_ENV': 'dev',
-        'REDIS_HOST': 'redis',
+        'DISPATCHARR_ENV': 'modular',
+        'DISPATCHARR_PORT': '9191',
+        'DISPATCHARR_WEB_HOST': 'dispatcharr_web',
     }, clear=True)
-    def test_dev_mode_includes_5656_and_custom_port(self):
-        """Dev mode includes both uwsgi internal port (5656) and custom port."""
-        candidates = build_dvr_candidates()
-        self.assertIn('http://127.0.0.1:5656', candidates)
-        self.assertIn('http://127.0.0.1:7777', candidates)
+    def test_modular_custom_web_host(self):
+        """DISPATCHARR_WEB_HOST overrides the default 'web' service name."""
+        url = get_dvr_stream_base_url()
+        self.assertEqual(url, 'http://dispatcharr_web:9191')
 
     @patch.dict(os.environ, {
         'DISPATCHARR_INTERNAL_TS_BASE_URL': 'http://custom:1234',
-        'REDIS_HOST': 'redis',
+        'DISPATCHARR_ENV': 'modular',
     }, clear=True)
-    def test_explicit_override_is_first(self):
-        """DISPATCHARR_INTERNAL_TS_BASE_URL should be the first candidate."""
-        candidates = build_dvr_candidates()
-        self.assertEqual(candidates[0], 'http://custom:1234')
+    def test_explicit_override_always_wins(self):
+        """DISPATCHARR_INTERNAL_TS_BASE_URL takes priority over all other settings."""
+        url = get_dvr_stream_base_url()
+        self.assertEqual(url, 'http://custom:1234')
 
     @patch.dict(os.environ, {
-        'DISPATCHARR_PORT': '3000',
-        'DISPATCHARR_INTERNAL_API_BASE': 'http://myhost:4000',
-        'REDIS_HOST': 'redis',
+        'DISPATCHARR_INTERNAL_TS_BASE_URL': 'http://custom:1234/',
     }, clear=True)
-    def test_internal_api_base_overrides_web_fallback(self):
-        """DISPATCHARR_INTERNAL_API_BASE replaces the http://web:{port} default."""
-        candidates = build_dvr_candidates()
-        self.assertIn('http://myhost:4000', candidates)
-        self.assertNotIn('http://web:3000', candidates)
+    def test_explicit_override_strips_trailing_slash(self):
+        """Trailing slash is stripped from DISPATCHARR_INTERNAL_TS_BASE_URL."""
+        url = get_dvr_stream_base_url()
+        self.assertEqual(url, 'http://custom:1234')

dispatcharr/celery.py

@@ -49,6 +49,11 @@ app.conf.update(
     worker_task_log_format='%(asctime)s %(levelname)s %(task_name)s: %(message)s',
 )
 
+# Route long-running DVR recordings to a dedicated `dvr` queue consumed by a thread-pool worker.
+app.conf.task_routes = {
+    'apps.channels.tasks.run_recording': {'queue': 'dvr'},
+}
+
 # Add memory cleanup after task completion
 @task_postrun.connect  # Use the imported signal
 def cleanup_task_memory(**kwargs):

docker/docker-compose.yml

@@ -118,8 +118,12 @@ services:
       - DISPATCHARR_ENV=modular
 
       # Internal Service Communication
-      # Must match the web service port for DVR recording and internal API calls
+      # Celery uses these to reach the web container for DVR recording.
+      # DISPATCHARR_PORT must match the port exposed by the web service.
+      # DISPATCHARR_WEB_HOST defaults to "web" (the service name above).
+      # Only set DISPATCHARR_WEB_HOST if you rename the web service in this file.
       - DISPATCHARR_PORT=9191
+      #- DISPATCHARR_WEB_HOST=web
 
       # PostgreSQL — must match web service settings
       - POSTGRES_HOST=db

docker/entrypoint.celery.sh

@@ -67,4 +67,8 @@ NICE_LEVEL="${CELERY_NICE_LEVEL:-5}"
 if [ "$NICE_LEVEL" -lt 0 ] 2>/dev/null; then
     echo "Warning: CELERY_NICE_LEVEL=$NICE_LEVEL is negative, requires SYS_NICE capability"
 fi
-nice -n "$NICE_LEVEL" celery -A dispatcharr worker -l info --autoscale=6,1
+
+# DVR worker: thread pool for the long-running, I/O-bound run_recording task.
+nice -n "$NICE_LEVEL" celery -A dispatcharr worker -Q dvr -n dvr@%h --pool=threads --concurrency=20 -l info &
+# Default prefork worker: every queue except `dvr`.
+nice -n "$NICE_LEVEL" celery -A dispatcharr worker -Q celery -n default@%h --autoscale=6,1 -l info

docker/uwsgi.debug.ini

@@ -7,9 +7,10 @@ exec-before = python /app/scripts/wait_for_redis.py
 
 ; Start Redis first
 attach-daemon = redis-server
-; Then start other services with configurable nice level (default: 5 for low priority)
-; Users can override via CELERY_NICE_LEVEL environment variable in docker-compose
-attach-daemon = nice -n $(CELERY_NICE_LEVEL) celery -A dispatcharr worker --autoscale=6,1
+; Default prefork worker: every queue except `dvr`.
+attach-daemon = nice -n $(CELERY_NICE_LEVEL) celery -A dispatcharr worker -Q celery -n default@%%h --autoscale=6,1
+; DVR worker: thread pool for the long-running, I/O-bound run_recording task.
+attach-daemon = nice -n $(CELERY_NICE_LEVEL) celery -A dispatcharr worker -Q dvr -n dvr@%%h --pool=threads --concurrency=20
 attach-daemon = nice -n $(CELERY_NICE_LEVEL) celery -A dispatcharr beat
 attach-daemon = daphne -b 0.0.0.0 -p 8001 dispatcharr.asgi:application
 attach-daemon = cd /app/frontend && npm run dev

docker/uwsgi.dev.ini

@@ -9,9 +9,10 @@ exec-pre = python /app/scripts/wait_for_redis.py
 
 ; Start Redis first
 attach-daemon = redis-server --protected-mode no
-; Then start other services with configurable nice level (default: 5 for low priority)
-; Users can override via CELERY_NICE_LEVEL environment variable in docker-compose
-attach-daemon = nice -n $(CELERY_NICE_LEVEL) celery -A dispatcharr worker --autoscale=6,1
+; Default prefork worker: every queue except `dvr`.
+attach-daemon = nice -n $(CELERY_NICE_LEVEL) celery -A dispatcharr worker -Q celery -n default@%%h --autoscale=6,1
+; DVR worker: thread pool for the long-running, I/O-bound run_recording task.
+attach-daemon = nice -n $(CELERY_NICE_LEVEL) celery -A dispatcharr worker -Q dvr -n dvr@%%h --pool=threads --concurrency=20
 attach-daemon = nice -n $(CELERY_NICE_LEVEL) celery -A dispatcharr beat
 attach-daemon = daphne -b 0.0.0.0 -p 8001 dispatcharr.asgi:application
 attach-daemon = cd /app/frontend && npm run dev

docker/uwsgi.ini

@@ -9,9 +9,10 @@ exec-pre = python /app/scripts/wait_for_redis.py
 
 ; Start Redis first
 attach-daemon = redis-server
-; Then start other services with configurable nice level (default: 5 for low priority)
-; Users can override via CELERY_NICE_LEVEL environment variable in docker-compose
-attach-daemon = nice -n $(CELERY_NICE_LEVEL) celery -A dispatcharr worker --autoscale=6,1
+; Default prefork worker: every queue except `dvr`.
+attach-daemon = nice -n $(CELERY_NICE_LEVEL) celery -A dispatcharr worker -Q celery -n default@%%h --autoscale=6,1
+; DVR worker: thread pool for the long-running, I/O-bound run_recording task.
+attach-daemon = nice -n $(CELERY_NICE_LEVEL) celery -A dispatcharr worker -Q dvr -n dvr@%%h --pool=threads --concurrency=20
 attach-daemon = nice -n $(CELERY_NICE_LEVEL) celery -A dispatcharr beat
 attach-daemon = daphne -b 0.0.0.0 -p 8001 dispatcharr.asgi:application
 

frontend/src/components/FloatingVideo.jsx

@@ -4,6 +4,7 @@ import Draggable from 'react-draggable';
 import useVideoStore from '../store/useVideoStore';
 import useAuthStore from '../store/auth';
 import mpegts from 'mpegts.js';
+import Hls from 'hls.js';
 import { CloseButton, Flex, Loader, Text, Box } from '@mantine/core';
 import {
   applyConstraints,
@@ -118,7 +119,6 @@ export default function FloatingVideo() {
   const contentType = useVideoStore((s) => s.contentType);
   const metadata = useVideoStore((s) => s.metadata);
   const hideVideo = useVideoStore((s) => s.hideVideo);
-  const accessToken = useAuthStore((s) => s.accessToken);
 
   const videoRef = useRef(null);
   const playerRef = useRef(null);
@@ -241,10 +241,46 @@ export default function FloatingVideo() {
     const { volume: savedVolume, muted: savedMuted } = getPlayerPrefs();
     if (typeof savedVolume === 'number') video.volume = savedVolume;
     if (typeof savedMuted === 'boolean') video.muted = savedMuted;
+    // Always start playback from the beginning of the seekable range.
+    let hasSeekedToStart = false;
+    const seekToStart = () => {
+      if (hasSeekedToStart) return;
+      try {
+        let target = 0;
+        if (video.seekable && video.seekable.length > 0) {
+          target = video.seekable.start(0);
+        }
+        // Only apply if we're not already at/near the start.  Avoid
+        // setting currentTime when the video has no duration yet.
+        if (
+          Number.isFinite(target) &&
+          Math.abs((video.currentTime || 0) - target) > 0.25
+        ) {
+          video.currentTime = target;
+        }
+        hasSeekedToStart = true;
+      } catch {
+        // ignore
+      }
+    };
+
     const handleLoadStart = () => setIsLoading(true);
-    const handleLoadedData = () => setIsLoading(false);
+    const handleLoadedMetadata = () => {
+      seekToStart();
+    };
+    const handleLoadedData = () => {
+      setIsLoading(false);
+      // hls.js applies its `startPosition` after MEDIA_ATTACHED, which can
+      // run later than `loadedmetadata`. Re-seek here as a safety net so a
+      // hls.js live playlist doesn't snap to the live edge after our first
+      // seek attempt happened against an empty seekable range.
+      seekToStart();
+    };
     const handleCanPlay = () => {
       setIsLoading(false);
+      // Final fallback for the Safari native-HLS path where seekable.start(0)
+      // is sometimes only valid by the time `canplay` fires.
+      seekToStart();
       // Auto-play for VOD content
       video.play().catch((e) => {
         console.log('Auto-play prevented:', e);
@@ -274,23 +310,114 @@ export default function FloatingVideo() {
 
     // Add event listeners
     video.addEventListener('loadstart', handleLoadStart);
+    video.addEventListener('loadedmetadata', handleLoadedMetadata);
     video.addEventListener('loadeddata', handleLoadedData);
     video.addEventListener('canplay', handleCanPlay);
     video.addEventListener('error', handleError);
     video.addEventListener('progress', handleProgress);
 
-    // Set the source
-    video.src = streamUrl;
-    video.load();
+    // HLS handling: in-progress recordings expose .m3u8 playlists (and ended
+    // recordings whose MKV concat hasn't completed yet still serve via /hls/).
+    // Native <video src="*.m3u8"> only works on Safari/iOS, and even there it
+    // cannot follow a growing playlist with a useful seekable window.  Use
+    // hls.js when supported so the user gets a full DVR/timeshift window
+    // across all browsers.  The HLS playlist uses #EXT-X-PLAYLIST-TYPE=EVENT-
+    // style growth (omit_endlist + hls_list_size 0), so hls.js will treat the
+    // entire recorded duration as the seekable range while the recording is
+    // still in progress and as a complete VOD once it ends.
+    const isHls =
+      typeof streamUrl === 'string' &&
+      (streamUrl.includes('.m3u8') ||
+        streamUrl.includes('/hls/index') ||
+        streamUrl.includes('application/vnd.apple.mpegurl'));
+    let hls = null;
+
+    if (isHls && Hls.isSupported()) {
+      hls = new Hls({
+        // Open at the very beginning of the recording rather than the live
+        // edge.  Without this, an in-progress recording would start at "now"
+        // and hide everything already recorded.  hls.js applies this AFTER
+        // MEDIA_ATTACHED, so the listener-driven `seekToStart()` above is
+        // also kept as a safety net for the Safari native-HLS path and for
+        // edge cases where this initial-position logic loses to the user's
+        // first interaction.
+        startPosition: 0,
+        // Allow seeking back to the start of the recording, regardless of
+        // current playhead position.  Recordings can be hours long and the
+        // user may want to scrub anywhere; we explicitly disable buffer
+        // eviction by setting a very large back-buffer length.
+        backBufferLength: 90 * 60, // 90 minutes
+        maxBufferLength: 60,
+        maxMaxBufferLength: 600,
+        // For an in-progress recording, hls.js refreshes the playlist on
+        // its target-duration cadence; let it follow the live edge but keep
+        // the full DVR window seekable.
+        liveSyncDurationCount: 3,
+        liveMaxLatencyDurationCount: 10,
+        enableWorker: true,
+        lowLatencyMode: false,
+        // Inject the JWT into every playlist + segment XHR.  Read the token
+        // from the auth store at request time rather than capturing the
+        // closure value at hls.js init, so a refreshed access token mid-
+        // playback is picked up on the next segment fetch.
+        xhrSetup: (xhr) => {
+          const token = useAuthStore.getState().accessToken;
+          if (token) {
+            xhr.setRequestHeader('Authorization', `Bearer ${token}`);
+          }
+        },
+      });
+      hls.on(Hls.Events.ERROR, (_evt, data) => {
+        if (data.fatal) {
+          // eslint-disable-next-line no-console
+          console.error('HLS fatal error:', data.type, data.details);
+          if (data.type === Hls.ErrorTypes.NETWORK_ERROR) {
+            try {
+              hls.startLoad();
+            } catch {
+              // ignore
+            }
+          } else if (data.type === Hls.ErrorTypes.MEDIA_ERROR) {
+            try {
+              hls.recoverMediaError();
+            } catch {
+              // ignore
+            }
+          } else {
+            setLoadError(`HLS playback error: ${data.details || data.type}`);
+          }
+        }
+      });
+      hls.attachMedia(video);
+      hls.on(Hls.Events.MEDIA_ATTACHED, () => {
+        hls.loadSource(streamUrl);
+      });
+    } else if (isHls && video.canPlayType('application/vnd.apple.mpegurl')) {
+      // Safari path: native HLS support, including seekable DVR windows.
+      video.src = streamUrl;
+      video.load();
+    } else {
+      // Plain progressive file (MKV/MP4): native HTML5.
+      video.src = streamUrl;
+      video.load();
+    }
 
     // Store cleanup function
     playerRef.current = {
       destroy: () => {
         video.removeEventListener('loadstart', handleLoadStart);
+        video.removeEventListener('loadedmetadata', handleLoadedMetadata);
         video.removeEventListener('loadeddata', handleLoadedData);
         video.removeEventListener('canplay', handleCanPlay);
         video.removeEventListener('error', handleError);
         video.removeEventListener('progress', handleProgress);
+        if (hls) {
+          try {
+            hls.destroy();
+          } catch {
+            // ignore
+          }
+        }
         video.removeAttribute('src');
         video.load();
       },
@@ -321,6 +448,14 @@ export default function FloatingVideo() {
           ? `${window.location.origin}${streamUrl}`
           : streamUrl;
 
+      // Read the JWT from the auth store at player-creation time rather than
+      // relying on the closure-captured `accessToken` value.  mpegts.js has
+      // no per-request setup hook (unlike hls.js's xhrSetup), so this header
+      // is baked into the IO loader for the life of the player; we just want
+      // to be sure we use the freshest token available at the moment of
+      // connection rather than whatever React-render snapshot we closed over.
+      const liveAccessToken = useAuthStore.getState().accessToken;
+
       const player = mpegts.createPlayer(
         {
           type: 'mpegts',
@@ -337,8 +472,8 @@ export default function FloatingVideo() {
           autoCleanupMaxBackwardDuration: 120,
           autoCleanupMinBackwardDuration: 60,
           reuseRedirectedURL: true,
-          headers: accessToken
-            ? { Authorization: `Bearer ${accessToken}` }
+          headers: liveAccessToken
+            ? { Authorization: `Bearer ${liveAccessToken}` }
             : undefined,
         }
       );

frontend/src/components/cards/RecordingCard.jsx

@@ -285,7 +285,9 @@ const RecordingCard = ({
       <Tooltip
         label={
           customProps.file_url || customProps.output_file_url
-            ? 'Watch recording'
+            ? isInProgress
+              ? 'Watch in progress recording'
+              : 'Watch recording'
             : 'Recording playback not available yet'
         }
       >
@@ -296,10 +298,7 @@ const RecordingCard = ({
             e.stopPropagation();
             handleWatchRecording();
           }}
-          disabled={
-            customProps.status === 'recording' ||
-            !(customProps.file_url || customProps.output_file_url)
-          }
+          disabled={!(customProps.file_url || customProps.output_file_url)}
         >
           Watch
         </Button>

frontend/src/components/forms/RecordingDetailsModal.jsx

@@ -122,7 +122,8 @@ const RecordingDetailsModal = ({
   const canWatchRecording =
     (customProps.status === 'completed' ||
       customProps.status === 'stopped' ||
-      customProps.status === 'interrupted') &&
+      customProps.status === 'interrupted' ||
+      customProps.status === 'recording') &&
     Boolean(fileUrl);
 
   const isSeriesGroup = Boolean(