---
status: accepted
---

# Domain split: nodecast as family viewer, Dispatcharr as engine

The family needs comfortable SSO viewing in the browser; Dispatcharr's web UI
is an admin surface, not a viewer. We reinstated nodecast-tv as the browser
frontend on <viewer-host> (it already has an OIDC login and in-browser
transcoding) — but demoted to a pure viewer with exactly one source:
Dispatcharr's M3U/EPG output. Dispatcharr stays the engine (sources,
aggregation, failover, per-user favorites for the TV app) and moved to
<admin-host> (internal admin) plus api.<viewer-host> (external API
for Castarr sticks outside the LAN; the OIDC redirect URI is derived from the
request host, all three hosts are registered at the IdP).

Access control lives on the IdP, not in app code: an Authentik group policy
binding (`adult`) on the nodecast, Dispatcharr and Castarr applications gates
both browser login and the device flow. The fork's OIDC_REQUIRED_GROUP knob
stays unused.