v10.1.8-alpha — CloudTAK video playback fixed end-to-end

CloudTAK video playback — fixed at every layer

Video in the CloudTAK web map now actually plays — both kinds:

• External camera feeds (state DOT traffic cams, any public HLS .m3u8 URL on a map marker) failed with a 404 in the web player on every deployment. Root cause: the reverse proxy routed the player's /stream/* requests to the wrong internal service. Fixed, with an automatic self-heal that converges already-deployed servers on the next console update — if you hand-patched your Caddyfile as a workaround, the update supersedes it cleanly.
• Live RTSP streams (phones running TAK ICU, drones, restreamer feeds) were separately broken by the media component CloudTAK's own compose still pins (media-infra v9.1.1), which cannot serve non-HTTP lease sources. infra-TAK now pins the current upstream release (v9.7.0), applies its kernel socket-buffer requirement automatically, and re-applies the container tuning it needs — all delivered through the normal update path.
• Streaming ingest ports (RTSP/RTMP/SRT for publishing into CloudTAK leases) were never explicitly opened in the firewall, so direct publishes were silently dropped on default-deny hosts. They're now allowed automatically (ufw and firewalld).

Validated live end-to-end: phone → restreamer → CloudTAK web player, seconds behind live.

ARM note: upstream publishes no ARM build of the newer media component (last ARM image is v9.1.1), so ARM servers keep v9.1.1 — external camera feeds play; RTSP-lease playback in the browser remains unavailable on ARM until upstream resumes ARM builds (requested).

Settings can no longer silently lose module configuration

A rare write race could drop non-core settings — mail relay, database configuration, admin credentials — while preserving server identity, requiring manual repair. The persistence guard now restores every setting from the last good on-disk copy when it detects a torn write, not just the core keys. Intentional removals (module uninstalls) are unaffected.

RHEL 9 installs fail loudly instead of mysteriously (GH #56)

On genuine RHEL 9 (subscription-manager), the EPEL repository step could fail silently and surface three steps later as a baffling PostGIS hdf5/xerces-c dependency error. The installer now falls back to the correct RHEL installation method automatically, enables CodeReady Builder via subscription-manager, verifies the repository actually landed, and — if it still can't — stops immediately with the exact manual fix. Thanks to the reporter of #56 for the precise diagnosis.

Also fixed

• A CloudTAK plugin rebuild that failed after its image had already built could leave that image live for the next restart despite the source rollback — the rollback now restores the image tag too.

Upgrade

Applied automatically on the next console update — routing self-heal, media component, kernel settings, and firewall rules all converge without SSH.