Public Sector setup guide

Conceptual mapping

Nothing in the panel is called a session, a resident or a department. The table says which object plays which role; the chapters below set them up in that order.

1Prerequisites

What to have before installing.

1. A server in the institution's data centre (Ubuntu 22.04 or 24.04), the installer, and a domain behind the institution's reverse proxy for the public address.
2. The chamber's encoder or video mixer able to push RTMP, the recordings of past sessions, and the training videos for staff.
3. A decision on what is public and what is internal, how long a public line lasts, and who among the operators gets a panel account.

2Infrastructure deployment

The management server, then any remote site.

1. Run the installer on the institution's server; put the panel behind the reverse proxy with TLS and set TRUSTED_PROXIES so the audit log and IP rules see real addresses.
2. Set the playback base to the public address residents reach, and the licence key on the server.
3. Enrol a node from Servers for a site that needs one, such as a second building with a chamber; the panel installs it over SSH.
4. Create a partner account (reseller) for the communications team with permissions for public lines, and one for HR or training for staff lines.

3Content organisation

A public programme and department collections.

1. Create categories for sessions, committees and public information, and one series per body, with one episode per meeting.
2. Create a public bouquet with the live session channel and the archive, and one bouquet per department training collection.
3. Create a package for residents that grants only the public bouquet, with a long duration as the access period.
4. Create packages for staff that add the training and internal bouquets to the public one.

4Partner (reseller) configuration

Teams that hand out access.

1. Create a group with permissions for lines only, and no access to the catalogue or settings.
2. Add the communications team as a partner account with the residents' package, and HR or training with the staff packages.
3. A body with several services can give each service its own partner account; it is a delegated account, not an isolated installation.

5Resident and staff line configuration

Public lines and staff lines.

1. Create a Reseller API key for the council's website and keep it in its secrets; when a resident asks for access it calls action=create_line with the public package and a request id.
2. Set a long expiry on public lines, and a connection limit that suits household viewing.
3. Create staff lines per department with the staff packages, from the council's staff system through the API or from Lines → add.
4. Bind staff lines to the institution's address range where the network allows.

6Session archive and training library

Recordings on demand.

1. Add each recorded session as an episode of its body's series, ingested with the VOD ingest job or uploaded, with a title, date and description.
2. Put the sessions series in the public bouquet and the training library in department bouquets.
3. Check playback with a test line of the public package and one of a staff package to confirm who sees what.

7Live sessions

The chamber as a live channel.

1. Add a live stream with an RTMP push from the chamber's encoder and put it in the public bouquet.
2. Enable catch-up so late viewers can rewind, and add an EPG entry or a title so viewers know which meeting is on.
3. Test the feed before each meeting, and keep a node near a second site if it also hosts sessions.

8Expiry and renewal

Long for the public, tied to employment for staff.

1. A public line lasts as long as the package's duration; extend it with action=renew_line when the resident asks again.
2. A staff line is renewed while the person works for the institution and disabled with action=disable_line when they leave.
3. Subscribe the council's systems to the webhooks to see expiring and disabled lines.

9Integration with the institution's systems

Systems drive access; the player plays.

1. The website and the staff system create, renew, enable and disable lines through the Reseller API with a key and a request id.
2. There is no single sign-on for viewers and no native integration with a specific public-sector product: viewers sign in to the player with the credentials of their line.
3. Use Admin API keys with the read-only flag, an IP allow-list and an expiry date for reporting tools.

10Security considerations

Operated by the institution, in the open where it should be.

1. Keep the platform on the institution's infrastructure behind the reverse proxy with TLS, and keep public and internal material in separate bouquets.
2. Two-factor sign-in for every panel account and permission groups per team; reCAPTCHA or Turnstile on the sign-in if the panel is reachable from outside.
3. Signed and expiring playback links, a connection limit per line, and address binding on staff lines.
4. Encrypted database backups with an off-site copy, and the audit log for every change of lines and catalogue.

11Troubleshooting

The usual first checks.

1. A resident cannot watch: check the line's expiry, that it is enabled, and the package's public bouquet.
2. A session does not start: check the encoder's push to the stream and the stream's status in the panel.
3. Staff see no training library: check the package of the staff line and the bouquets it grants.
4. The audit log shows the proxy's address: set TRUSTED_PROXIES to the proxy and restart the panel.