From ba064cc136e2f626f6110fbf7abe880db2c3f66a Mon Sep 17 00:00:00 2001
From: daniel-c-harvey <the.real.daniel.harvey@gmail.com>
Date: Tue, 23 Jun 2026 07:30:13 -0400
Subject: [PATCH] provision ffmpeg on DeepDrftAPI host for Opus transcode

Phase 18.1 needs ffmpeg (libopus). Add it to bootstrap.sh apt prereqs and a
preflight guard in install.sh; resolves via the systemd user unit's default
PATH (/usr/bin), no config change.
---
 deploy/bootstrap.sh | 3 ++-
 deploy/install.sh   | 9 ++++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/deploy/bootstrap.sh b/deploy/bootstrap.sh
index 17e8ef5..6903bda 100644
--- a/deploy/bootstrap.sh
+++ b/deploy/bootstrap.sh
@@ -41,7 +41,8 @@ apt-get install -y --no-install-recommends \
   openssl \
   jq \
   wget \
-  ca-certificates
+  ca-certificates \
+  ffmpeg
 
 echo "  [ok] apt packages installed"
 
diff --git a/deploy/install.sh b/deploy/install.sh
index 8a2441a..ddd7e69 100644
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -41,6 +41,12 @@ if ! command -v nginx &>/dev/null; then
   die "nginx not found on PATH. Install nginx before running this script."
 fi
 
+# ffmpeg (with libopus) is required at runtime by DeepDrftAPI for Opus transcode (Phase 18.1).
+# On Ubuntu/Debian the stock ffmpeg apt package includes libopus; bootstrap.sh installs it.
+if ! command -v ffmpeg &>/dev/null; then
+  die "ffmpeg not found on PATH. Install it before running this script: apt-get install -y ffmpeg"
+fi
+
 # rrsync ships in the rsync package; path varies by distro version
 RRSYNC_BIN=""
 if command -v rrsync &>/dev/null; then
@@ -51,7 +57,7 @@ else
   die "rrsync not found. Install the rsync package: apt-get install -y rsync"
 fi
 
-ok "psql present, PostgreSQL active, nginx present"
+ok "psql present, PostgreSQL active, nginx present, ffmpeg present"
 ok "rrsync found at: ${RRSYNC_BIN}"
 
 # ── Step 0b: Parameter collection ─────────────────────────────────────────────
@@ -433,6 +439,7 @@ Installed / configured:
   - PostgreSQL role '${PG_ROLE}' and databases: ${DB_META}, ${DB_AUTH}
   - SSH authorized_keys with forced-command + restrict
   - nginx sites-available + sites-enabled, default site removed
+  - ffmpeg (with libopus) installed at $(command -v ffmpeg) — runtime prereq for Opus transcode
 
 ------------------------------------------------------------------------
 Remaining manual steps: