YOUR BANNER MSG HERE
" -INV_HEALTHCHECK_URL="watch?v=jNQXAC9IVRw" - -BANNER_MSG="" - -# PSQL -POSTGRES_DB="invidious" -POSTGRES_USER="invidious" -POSTGRES_PASSWORD="" - -INV_PSQL_CPU_CORES=6 -INV_PSQL_MEM_LIMIT="8448m" -INV_PSQL_MEM_RESERVATION="6400m" -INV_PSQL_IMAGE="docker.io/library/postgres:14" - -# Materialious -VITE_DEFAULT_INVIDIOUS_INSTANCE="https://api.invidious.nerdvpn.de" -VITE_DEFAULT_RETURNYTDISLIKES_INSTANCE="https://ryd.invidious.nerdvpn.de" -VITE_DEFAULT_FRONTEND_URL="https://materialious.nerdvpn.de" -VITE_DEFAULT_SPONSERBLOCK_INSTANCE="https://sponsor.ajay.app" -VITE_DEFAULT_DEARROW_INSTANCE="" -VITE_DEFAULT_DEARROW_THUMBNAIL_INSTANCE="" -VITE_DEFAULT_SYNCIOUS_INSTANCE="https://sync.invidious.nerdvpn.de" -VITE_DEFAULT_PEERJS_HOST="peer.invidious.nerdvpn.de" -VITE_DEFAULT_PEERJS_PATH="/" -VITE_DEFAULT_PEERJS_PORT=443 -VITE_DEFAULT_SETTINGS='{"region": "DE", "darkMode": false, "themeColor": "#FFB81C", "autoPlay": true, "alwaysLoop": false, "proxyVideos": false, "listenByDefault": false, "savePlaybackPosition": true, "dashEnabled": false, "theatreModeByDefault": false, "autoplayNextByDefault": true, "returnYtDislikes": true, "searchSuggestions": true, "previewVideoOnHover": false, "sponsorBlock": true, "sponsorBlockCategories": "sponsor,interaction,selfpromo", "deArrowEnabled": false, "playerMiniPlayer": true, "syncious": true}' +# Companion +COMP_CPU_CORES=4 +COMP_MEM_LIMIT="1536m" +COMP_MEM_SWAP="2048m" diff --git a/README.md b/README.md index ebad708..599feb0 100644 --- a/README.md +++ b/README.md @@ -5,39 +5,49 @@ Theme for my instance is based on: https://github.com/Tsyron/Invidious-Theme Original repo at: https://github.com/iv-org/invidious -Based upon patches from: https://github.com/yewtudotbe/invidious-custom +Based upon patches from: +https://github.com/yewtudotbe/invidious-custom +https://git.nadeko.net/Fijxu/invidious +<<<<<<< HEAD # IMPORTANT The instructions below are outdated. YouTube is currently quadrupling down on trying to block Invidious instances, so there are almost daily changes to my server setup. I haven't found the time yet to provide new/better instructions, so the instructions below should be taken with some grain of salt. +======= +# Requirements - you need to set this up before running my fork +1. HAProxy 2.x either run on the host or added to the docker-compose.yaml with my config under `etc/haproxy/haproxy.cfg` +2. PostgreSQL 16 server either run on the host or added to the docker-compose.yaml +3. (optional bvut highly recommended) PGBouncer to pool the connections to PostgreSQL. You'll otherwise run into lots of db pool errors under high loads +4. Nginx with my configs under etc/nginx +5. Valid ssl certificate for your domain. I recommend using dehydrated: https://github.com/dehydrated-io/dehydrated +6. Docker compose V2 +>>>>>>> 9de2789 (Change to multiple backends) # Build instructions +Do this in a separate dir (for example /srv/invidious) under non-root permissions + 1. `git clone https://github.com/Sommerwiesel/invidious-nerdvpn .` 2. `git clone https://github.com/iv-org/invidious build` -3. `./patch.sh` -4. `./build.sh development` for the development image or `./build.sh release` for the production image +3. `git clone https://github.com/iv-org/invidious-companion companion` +4. Modify the patches under invidious-nerdvpn/patches to your needs (i.e. change branding) and then run `./patch.sh` +5. `./build.sh development` for the development image or `./build.sh release` for the production image +6. `build.sh companion` to build the invidious companion # Update instructions -- Simply run `./update.sh` +1. Run `./revert.sh` to remove all patches +2. Update both repos (build and companion) via `git pull` +3. Run the steps 5 and 6 again fro mthe run instructions # Run instructions (docker compose) -- For the database: `docker compose --profile database up -d` -- For the worker: `docker compose --profile worker up -d` -- For the web client: `docker compose --profile web up -d` -- For the tor web client: `docker compose --profile tor up -d` -- For materialious: `docker compose --profile materialious up -d` +- Simply run `docker compose up -d` # Run instructions (systemd) First copy the invidious.service to /etc/systemd/system/ -- For the database: `systemctl enable --now invidious@database.service` -- For the worker: `systemctl enable --now invidious@worker.service` -- For the web client: `systemctl enable --now invidious@web.service` -- For the tor web client: `systemctl enable --now invidious@tor.service` -- For materialious: `systemctl enable --now invidious@materialious.service` +- Enable and start with: `systemctl enable --now invidious.service` diff --git a/build.sh b/build.sh index c347ceb..cad5535 100755 --- a/build.sh +++ b/build.sh @@ -6,14 +6,18 @@ if [ $# -eq 0 ]; then fi mode=$1 - +export COMPOSE_BAKE=true if [ "$mode" == "release" ]; then - docker compose --profile base build --build-arg release=1 + docker compose --profile base build invidious-base --build-arg release=1 fi if [ "$mode" == "development" ]; then - docker compose --profile base build --build-arg release=0 + docker compose --profile base build invidious-base --build-arg release=0 +fi + +if [ "$mode" == "companion" ]; then + docker compose build "invidious-companion-3" --build-arg release=0 fi yes | docker system prune diff --git a/docker-compose.yml b/docker-compose.yml index f8e0122..24bc3a6 100755 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,128 +1,90 @@ -x-volumes: &volumes +x-defaults: &defaults volumes: - /var/run/redis/redis-server.sock:/invidious/redis-server.sock:rw + labels: + - "com.centurylinklabs.watchtower.enable=false" +services: -services: - - # This service is for building the base image (patch.sh && build.sh) - invidious: - <<: *volumes + invidious-base: + <<: *defaults env_file: - .env profiles: ["base"] - cpus: ${INV_CPU_CORES} + cpus: 16 mem_limit: "${INV_MEM_LIMIT}" - mem_reservation: "${INV_MEM_RESERVATION}" - image: "${INV_IMAGE}" + memswap_limit: "${INV_MEM_SWAP}" + image: invidious-nerdvpn:latest build: context: build dockerfile: docker/Dockerfile restart: "${INV_RESTART_POLICY}" environment: &environment INVIDIOUS_CONFIG: | - #force_resolve: ipv6 + force_resolve: ipv6 + invidious_companion: + # IPv6 + - private_url: "http://invidious-companion-1:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- EU, NL" + - private_url: "http://invidious-companion-2:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- EU, DE" + - private_url: "http://invidious-companion-3:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- EU, FR" + - private_url: "http://invidious-companion-4:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- US 1" + - private_url: "http://invidious-companion-5:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- US 2" + - private_url: "http://invidious-companion-6:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- CA" + - private_url: "http://invidious-companion-7:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- UK" + - private_url: "http://invidious-companion-8:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- AU" + # IPv4 (currently too expensive, so disabled) + #- private_url: "http://invidious-proxy-1:8282" + # public_url: "https://invidious.nerdvpn.de" + # note: "- Main, EU" + #- private_url: "http://invidious-proxy-2:8282" + # public_url: "https://invidious.nerdvpn.de" + # note: "- Main, US" + invidious_companion_key: "" + backend_name_prefix: "" modified_source_code_url: "https://github.com/Sommerwiesel/invidious-nerdvpn" hmac_key: db: dbname: invidious user: invidious password: - host: invidious-pgbouncer - port: 5432 + host: 192.42.6.1 + port: 6432 redis_socket: "/invidious/redis-server.sock" redis_db: 4 redis_auth: "" - http_proxy: - host: "192.42.6.30" - port: 80 - check_tables: true - external_port: 443 - domain: "invidious.nerdvpn.de" - https_only: true - hsts: true - pool_size: 60 - disable_proxy: ["local"] - log_level: "Fatal" - popular_enabled: true - statistics_enabled: true - enable_user_notifications: false - channel_threads: 0 - feed_threads: 0 - use_pubsub_feeds: false - banner: "${BANNER_MSG}" - jobs: - clear_expired_items: - enable: false - refresh_channels: - enable: false - refresh_feeds: - enable: false - default_user_preferences: - locale: "de" - region: "DE" - captions: ["","English","English (auto-generated)"] - dark_mode: "dark" - feed_menu: ["Trending", "Subscriptions", "Playlists", "Search"] - default_home: "Search" - comments: ["youtube", ""] - autoplay: true - continue_autoplay: true - quality: "hd720" - quality_dash: "720p" - unseen_only: true - local: false - automatic_instance_redirect: true - networks: - invidious_proxy: - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - retries: 2 - - # Takes care of refreshing the feeds - invidious_worker: - <<: *volumes - env_file: - - .env - profiles: ["worker"] - container_name: invidious_worker - cpus: ${INV_CPU_CORES} - mem_limit: "1536m" - mem_reservation: "768m" - image: "${INV_IMAGE}" - restart: "${INV_RESTART_POLICY}" - environment: - INVIDIOUS_CONFIG: | - #force_resolve: ipv6 - modified_source_code_url: "https://github.com/Sommerwiesel/invidious-nerdvpn" - hmac_key: - db: - dbname: invidious - user: invidious - password: - host: invidious-pgbouncer - port: 5432 - redis_socket: "/invidious/redis-server.sock" - redis_db: 4 - redis_auth: "" - http_proxy: - host: "192.42.6.30" - port: 80 check_tables: true external_port: 443 domain: "invidious.nerdvpn.de" https_only: true hsts: true pool_size: 100 - disable_proxy: ["livestreams","local"] - log_level: "Fatal" + disable_proxy: ["livestreams","local","dash","downloads"] + log_level: "Error" popular_enabled: true statistics_enabled: true + admins: [""] enable_user_notifications: false channel_threads: 4 - feed_threads: 4 - channel_refresh_interval: "15m" + channel_refresh_interval: "120m" use_pubsub_feeds: true + feed_threads: 4 + banner: "${BANNER_MSG}" + use_innertube_for_captions: true default_user_preferences: locale: "de" region: "DE" @@ -138,24 +100,293 @@ services: unseen_only: true local: false automatic_instance_redirect: true + hide_shorts: false networks: invidious_proxy: - ipv4_address: 192.42.6.9 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 3m - timeout: 5s - retries: 2 - invidious_1: - <<: *volumes + invidious-companion-1: + container_name: invidious-companion-1 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/1:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.11 + + invidious-companion-2: + container_name: invidious-companion-2 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/2:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.12 + + invidious-companion-3: + container_name: invidious-companion-3 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/3:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.13 + + invidious-companion-4: + container_name: invidious-companion-4 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/4:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.14 + + invidious-companion-5: + container_name: invidious-companion-5 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/5:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.15 + + invidious-companion-6: + container_name: invidious-companion-6 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/6:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.16 + + invidious-companion-7: + container_name: invidious-companion-7 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/7:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.17 + + invidious-companion-8: + container_name: invidious-companion-8 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/8:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.18 + + # companion 11 and 12 are for ipv4 proxies that only support socks5 + invidious-companion-11: + profiles: ["disabled"] + container_name: invidious-companion-11 + cpus: ${COMP_CPU_CORES} + mem_limit: "${INV_MEM_LIMIT}" + memswap_limit: "${INV_MEM_SWAP}" + image: quay.io/invidious/invidious-companion:latest + environment: + - SERVER_SECRET_KEY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/11:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + #networks: + # invidious_proxy: + # ipv4_address: 192.42.6.21 + network_mode: "container:invidious-proxy-1" + depends_on: + - invidious-proxy-1 + + invidious-companion-12: + profiles: ["disabled"] + container_name: invidious-companion-12 + cpus: ${COMP_CPU_CORES} + mem_limit: "${INV_MEM_LIMIT}" + memswap_limit: "${INV_MEM_SWAP}" + image: quay.io/invidious/invidious-companion:latest + environment: + - SERVER_SECRET_KEY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/12:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + #networks: + # invidious_proxy: + # ipv4_address: 192.42.6.22 + network_mode: "container:invidious-proxy-2" + depends_on: + - invidious-proxy-2 + + invidious: + <<: *defaults env_file: - .env - profiles: ["web"] - container_name: invidious_1 + container_name: invidious cpus: ${INV_CPU_CORES} mem_limit: "${INV_MEM_LIMIT}" - mem_reservation: "${INV_MEM_RESERVATION}" + memswap_limit: "${INV_MEM_SWAP}" image: "${INV_IMAGE}" restart: "${INV_RESTART_POLICY}" environment: @@ -163,374 +394,61 @@ services: networks: invidious_proxy: ipv4_address: 192.42.6.2 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - timeout: 5s - retries: 2 - - invidious_2: - <<: *volumes - env_file: - - .env - profiles: ["web"] - container_name: invidious_2 - cpus: ${INV_CPU_CORES} - mem_limit: "${INV_MEM_LIMIT}" - mem_reservation: "${INV_MEM_RESERVATION}" - image: "${INV_IMAGE}" - restart: "${INV_RESTART_POLICY}" - environment: - <<: *environment - networks: - invidious_proxy: - ipv4_address: 192.42.6.3 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - timeout: 5s - retries: 2 - - invidious_3: - <<: *volumes - env_file: - - .env - profiles: ["web"] - container_name: invidious_3 - cpus: ${INV_CPU_CORES} - mem_limit: "${INV_MEM_LIMIT}" - mem_reservation: "${INV_MEM_RESERVATION}" - image: "${INV_IMAGE}" - restart: "${INV_RESTART_POLICY}" - environment: - <<: *environment - networks: - invidious_proxy: - ipv4_address: 192.42.6.4 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - timeout: 5s - retries: 2 - - invidious_4: - <<: *volumes - env_file: - - .env - profiles: ["web"] - container_name: invidious_4 - cpus: ${INV_CPU_CORES} - mem_limit: "${INV_MEM_LIMIT}" - mem_reservation: "${INV_MEM_RESERVATION}" - image: "${INV_IMAGE}" - restart: "${INV_RESTART_POLICY}" - environment: - <<: *environment - networks: - invidious_proxy: - ipv4_address: 192.42.6.5 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - timeout: 5s - retries: 2 - - invidious_5: - <<: *volumes - env_file: - - .env - profiles: ["web"] - container_name: invidious_5 - cpus: ${INV_CPU_CORES} - mem_limit: "${INV_MEM_LIMIT}" - mem_reservation: "${INV_MEM_RESERVATION}" - image: "${INV_IMAGE}" - restart: "${INV_RESTART_POLICY}" - environment: - <<: *environment - networks: - invidious_proxy: - ipv4_address: 192.42.6.6 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - timeout: 5s - retries: 2 - - invidious_6: - <<: *volumes - env_file: - - .env - profiles: ["web"] - container_name: invidious_6 - cpus: ${INV_CPU_CORES} - mem_limit: "${INV_MEM_LIMIT}" - mem_reservation: "${INV_MEM_RESERVATION}" - image: "${INV_IMAGE}" - restart: "${INV_RESTART_POLICY}" - environment: - <<: *environment - networks: - invidious_proxy: - ipv4_address: 192.42.6.7 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - timeout: 5s - retries: 2 - - materialious: - env_file: - - .env - profiles: ["materialious"] - container_name: materialious - cpus: "2" - mem_reservation: "32m" - mem_limit: "64m" - image: "wardpearce/materialious" - restart: "unless-stopped" - networks: - invidious_proxy: - ipv4_address: 192.42.6.13 - - # Return YouTube Dislike proxy via tor - materialious_ryd-proxy: - profiles: ["materialious"] - container_name: materialious_ryd-proxy - image: 1337kavin/ryd-proxy:latest - restart: "unless-stopped" - cpus: "2" - mem_reservation: "128m" - mem_limit: "256m" - depends_on: - - materialious_tor - environment: - - PROXY=socks5://materialious_tor:5566 - - WEB_CONCURRENCY=3 - networks: - invidious_proxy: - ipv4_address: 192.42.6.14 - materialious_api: - profiles: ["materialious"] - container_name: materialious_api - image: wardpearce/invidious_api_extended:latest - restart: "unless-stopped" - cpus: "3" - mem_reservation: "192m" - mem_limit: "320m" - environment: - api_extended_postgre: '{"host": "invidious-db", "port": 5432, "database": "invidious", "user": "invidious", "password": ""}' - api_extended_allowed_origins: '["https://materialious.nerdvpn.de"]' - api_extended_debug: false - api_extended_invidious_instance: "https://api.invidious.nerdvpn.de" - api_extended_production_instance: "https://sync.invidious.nerdvpn.de" - WEB_CONCURRENCY: 3 - networks: - invidious_proxy: - ipv4_address: 192.42.6.15 - - # Opens tor circuits - materialious_tor: - profiles: ["materialious"] - container_name: materialious_tor - image: 1337kavin/alpine-tor:latest - restart: "unless-stopped" - cpus: "2" - mem_reservation: "128m" - mem_limit: "256m" - environment: - - tors=2 - - test_url="http://nerdvpn2awosmfgodp77bavzve3k2kvxw52z364suglul2qaalcdqtad.onion" - networks: - invidious_proxy: - ipv4_address: 192.42.6.20 - - materialious_peerjs: - profiles: ["materialious"] - container_name: materialious_peerjs - build: - context: peerjs - dockerfile: Dockerfile - restart: "unless-stopped" - cpus: "2" - mem_reservation: "32m" + # Those are for proxies that only support socks5 + invidious-proxy-1: + profiles: ["disabled"] + container_name: invidious-proxy-1 + restart: unless-stopped + image: ghcr.io/xjasonlyu/tun2socks:latest + cpus: 2 mem_limit: "128m" - labels: - - "com.centurylinklabs.watchtower.enable=false" - networks: - invidious_proxy: - ipv4_address: 192.42.6.19 - - invidious_tor: - <<: *volumes - env_file: - - .env - profiles: ["tor"] - container_name: invidious_tor - cpus: ${INV_CPU_CORES} - mem_limit: "512m" - mem_reservation: "128m" - image: "${INV_IMAGE}" - restart: "${INV_RESTART_POLICY}" + memswap_limit: "320m" + cap_add: + - NET_ADMIN + devices: + - '/dev/net/tun:/dev/net/tun' environment: - INVIDIOUS_CONFIG: | - force_resolve: ipv6 - modified_source_code_url: "https://github.com/Sommerwiesel/invidious-nerdvpn" - hmac_key: - db: - dbname: invidious - user: invidious - password: - host: invidious-pgbouncer - port: 5432 - redis_socket: "/invidious/redis-server.sock" - redis_db: 4 - redis_auth: "" - http_proxy: - host: "192.42.6.30" - port: 80 - check_tables: true - external_port: 80 - domain: "jt3wafuew7rumgwp7wfixpbtxc4dw6jvvfjt7dud33xczvwvgih5nfqd.onion" - https_only: false - hsts: false - pool_size: 40 - disable_proxy: ["livestreams","local","dash","downloads"] - log_level: "Fatal" - popular_enabled: false - statistics_enabled: true - enable_user_notifications: false - channel_threads: 0 - feed_threads: 0 - use_pubsub_feeds: false - jobs: - clear_expired_items: - enable: false - refresh_channels: - enable: false - refresh_feeds: - enable: false - default_user_preferences: - locale: "de" - region: "DE" - captions: ["","English","English (auto-generated)"] - dark_mode: "dark" - feed_menu: ["Trending", "Subscriptions", "Playlists", "Search"] - default_home: "Search" - comments: ["youtube", ""] - autoplay: true - continue_autoplay: true - quality: "hd720" - quality_dash: "720p" - unseen_only: true - local: false - automatic_instance_redirect: false + - LOGLEVEL=info + - TUN=tun0 + - ADDR=198.18.0.1/15 + - MTU=9000 + - PROXY= + sysctls: + - net.ipv4.ip_forward=1 + - net.ipv6.conf.all.forwarding=1 + - net.ipv6.conf.default.disable_ipv6=0 networks: invidious_proxy: - ipv4_address: 192.42.6.8 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - timeout: 5s - retries: 2 + ipv4_address: 192.42.6.200 - invidious-pgbouncer: - env_file: - - .env - profiles: ["database"] - container_name: invidious-pgbouncer + invidious-proxy-2: + profiles: ["disabled"] + container_name: invidious-proxy-2 + restart: unless-stopped + image: ghcr.io/xjasonlyu/tun2socks:latest + cpus: 2 mem_limit: "128m" - mem_reservation: "64m" - image: edoburu/pgbouncer - restart: "${INV_RESTART_POLICY}" + memswap_limit: "320m" + cap_add: + - NET_ADMIN + devices: + - '/dev/net/tun:/dev/net/tun' environment: - - DB_HOST=invidious-db - - DB_PORT=5432 - - DB_USER=invidious - - DB_PASSWORD= - - DB_NAME=invidious - - ADMIN_USERS=pgbouncer - - POOL_MODE=transaction - - DEFAULT_POOL_SIZE=80 - - MIN_POOL_SIZE=20 - - RESERVE_POOL_SIZE=80 - - RESERVE_POOL_TIMEOUT=5 - - MAX_DB_CONNECTIONS=160 - - MAX_USER_CONNECTIONS=160 - - MAX_CLIENT_CONN=1000 - - AUTH_TYPE=scram-sha-256 - - IGNORE_STARTUP_PARAMETERS=extra_float_digits - volumes: - - ./docker/userlist.txt:/etc/pgbouncer/userlist.txt:rw - healthcheck: - test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB -h invidious-db"] - interval: 5m - timeout: 15s - retries: 2 + - LOGLEVEL=info + - TUN=tun0 + - ADDR=198.18.0.1/15 + - MTU=9000 + - PROXY= + sysctls: + - net.ipv4.ip_forward=1 + - net.ipv6.conf.all.forwarding=1 + - net.ipv6.conf.default.disable_ipv6=0 networks: invidious_proxy: - ipv4_address: 192.42.6.11 - - invidious-db: - env_file: - - .env - profiles: ["database"] - container_name: invidious-db - cpus: ${INV_PSQL_CPU_CORES} - mem_limit: "${INV_PSQL_MEM_LIMIT}" - memswap_limit: "${INV_PSQL_MEM_LIMIT}" - mem_reservation: "${INV_PSQL_MEM_RESERVATION}" - image: "${INV_PSQL_IMAGE}" - restart: "${INV_RESTART_POLICY}" - volumes: - - type: bind - source: /srv/invidious/database - target: /var/lib/postgresql/data - - ./config/sql:/config/sql - - ./docker/init-invidious-db.sh:/docker-entrypoint-initdb.d/init-invidious-db.sh - - ./docker/pg-tune.sql:/docker-entrypoint-initdb.d/pg-tune.sql - - ./docker/pgstat.sql:/tmp/pgstat.sql - - ./docker/pg-cleanup.sql:/tmp/pgcleanup.sql - healthcheck: - test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"] - interval: 5m - timeout: 15s - retries: 2 - networks: - invidious_proxy: - ipv4_address: 192.42.6.10 - - invidious-proxy: - profiles: ["web"] - image: 1337kavin/ytproxy:latest - container_name: invidious_proxy - cpus: "4" - mem_reservation: "256m" - mem_limit: "512m" - restart: "unless-stopped" - user: 33:33 - network_mode: "host" - environment: - - DISABLE_WEBP=1 - volumes: - - /srv/ytproxy:/app/socket - - invidious-haproxy: - profiles: ["web"] - image: haproxytech/haproxy-alpine:latest - container_name: invidious_haproxy - cpus: "3" - mem_reservation: "64m" - mem_limit: "128m" - restart: "unless-stopped" - volumes: - - ./docker/haproxy:/usr/local/etc/haproxy:ro - networks: - invidious_proxy: - ipv4_address: 192.42.6.30 - + ipv4_address: 192.42.6.201 networks: invidious_proxy: + enable_ipv6: true external: true diff --git a/docker/haproxy/haproxy.cfg b/docker/haproxy/haproxy.cfg deleted file mode 100644 index accdefa..0000000 --- a/docker/haproxy/haproxy.cfg +++ /dev/null @@ -1,31 +0,0 @@ -global - stats socket /var/run/api.sock user haproxy group haproxy mode 660 level admin expose-fd listeners - log stdout format raw local0 notice - -defaults - log global - mode http - option httplog - option dontlognull - timeout connect 5s - timeout client 10s - timeout server 10s - timeout http-request 10s - - - -frontend invidious - log stdout format raw local0 emerg - bind *:80 - mode http - default_backend proxies - -backend proxies - balance leastconn - http-reuse always - http-request set-header Proxy-Authorization Basic\ base64_here - # Normal proxies go here - server proxy_normal_1 ipaddr_here check fall 3 rise 3 inter 15s observe layer7 error-limit 10 on-error mark-down sni hdr(host) - - # Add at least 1 backup proxy to shortly take over until the others have rotated their ips during YT blockage - server proxy_backup_1 ipaddr_here backup check fall 3 rise 3 inter 15s observe layer7 error-limit 10 on-error mark-down sni hdr(host) diff --git a/docker/userlist.txt b/docker/userlist.txt deleted file mode 100644 index 72cac7f..0000000 --- a/docker/userlist.txt +++ /dev/null @@ -1,2 +0,0 @@ -"pgbouncer" "" -"invidious" "" diff --git a/invidious.service b/invidious.service index 0f93b24..b71d75d 100644 --- a/invidious.service +++ b/invidious.service @@ -1,18 +1,16 @@ [Unit] -Description=Invidious (%i) -After=syslog.target -After=network.target -Requires=docker.service -After=docker.service +Description=Invidious +After=network.target postgresql@16-main.service redis.service +Requires=postgresql@16-main.service redis.service [Service] Restart=always RestartSec=15s -User=invidious -Group=invidious + WorkingDirectory=/srv/invidious -ExecStart=/usr/bin/docker compose --env-file .env --profile %i up -ExecStop=/usr/bin/docker compose --env-file .env --profile %i down + +ExecStart=/usr/bin/docker compose --env-file .env up +ExecStop=/usr/bin/docker compose --env-file .env down [Install] WantedBy=multi-user.target diff --git a/nginx/sites-enabled/invidious.vhost b/nginx/sites-enabled/invidious.vhost index 513428b..7656e5d 100644 --- a/nginx/sites-enabled/invidious.vhost +++ b/nginx/sites-enabled/invidious.vhost @@ -1,505 +1,169 @@ upstream invidious { - least_conn; server 192.42.6.2:3000 fail_timeout=3s; - server 192.42.6.3:3000 fail_timeout=3s; - server 192.42.6.4:3000 fail_timeout=3s; - server 192.42.6.5:3000 fail_timeout=3s; - server 192.42.6.6:3000 fail_timeout=3s; - server 192.42.6.7:3000 fail_timeout=3s; - keepalive 30; + keepalive 21; } -upstream invidious_worker { - server 192.42.6.9:3000; - keepalive 1; -} - -upstream invidious_proxy { - server unix:/srv/ytproxy/http-proxy.sock; - keepalive 6; -} - -upstream invidious_tor { - server 192.42.6.8:3000; - keepalive 2; -} - -upstream ryd_proxy { - server 192.42.6.14:3000; - keepalive 3; -} - -upstream invidious_sync { - server 192.42.6.15:80; - keepalive 3; -} - -upstream invidious_peer { - server 192.42.6.19:9000; - keepalive 3; +# This is routed over a HAProxy that looks for the cookie +upstream invidious_companion { + server 192.42.6.1:8118 fail_timeout=3s; } map $upstream_addr $server_instance { - default "invidious"; - 192.42.6.2:3000 "invidious_1"; - 192.42.6.3:3000 "invidious_2"; - 192.42.6.4:3000 "invidious_3"; - 192.42.6.5:3000 "invidious_4"; - 192.42.6.6:3000 "invidious_5"; - 192.42.6.7:3000 "invidious_6"; + default "invidious"; } -# I use this line to switch to a testing instance of invidious when I test a new docker image geo $upstream_server { - default invidious; + default invidious; } -# Toggle to switch between using team piped ytproxy or invidious to server google asssets and video stream -geo $ivproxy_server { - default invidious_proxy; - #default invidious; +map "$http_origin" $cors { + default ''; } -# The api is for internal access only -geo $api_invidious_access { - default 0; - - # locahost - 127.0.0.1/32 1; - - # Docker network - 192.42.0.0/16 1; -} - -# Access to feeds is rate limited except for google ips geo $feeds_whitelist { default 0; # CIDR in the list below are not limited - + # Google 8.34.208.0/20 1; - 8.35.192.0/20 1; - 23.236.48.0/20 1; - 23.251.128.0/19 1; - 34.0.0.0/15 1; - 34.2.0.0/16 1; - 34.3.0.0/23 1; - 34.3.3.0/24 1; - 34.3.4.0/24 1; - 34.3.8.0/21 1; - 34.3.16.0/20 1; - 34.3.32.0/19 1; - 34.3.64.0/18 1; - 34.4.0.0/14 1; - 34.8.0.0/13 1; - 34.16.0.0/12 1; - 34.32.0.0/11 1; - 34.64.0.0/10 1; - 34.128.0.0/10 1; - 35.184.0.0/13 1; - 35.192.0.0/14 1; - 35.196.0.0/15 1; - 35.198.0.0/16 1; - 35.199.0.0/17 1; - 35.199.128.0/18 1; - 35.200.0.0/13 1; - 35.208.0.0/12 1; - 35.224.0.0/12 1; - 35.240.0.0/13 1; - 64.15.112.0/20 1; - 64.233.160.0/19 1; - 66.22.228.0/23 1; - 66.102.0.0/20 1; - 66.249.64.0/19 1; - 70.32.128.0/19 1; - 72.14.192.0/18 1; - 74.125.0.0/16 1; - 104.154.0.0/15 1; - 104.196.0.0/14 1; - 104.237.160.0/19 1; - 107.167.160.0/19 1; - 107.178.192.0/18 1; - 108.59.80.0/20 1; - 108.170.192.0/18 1; - 108.177.0.0/17 1; - 130.211.0.0/16 1; - 142.250.0.0/15 1; - 146.148.0.0/17 1; - 162.216.148.0/22 1; - 162.222.176.0/21 1; - 172.110.32.0/21 1; - 172.217.0.0/16 1; - 172.253.0.0/16 1; - 173.194.0.0/16 1; - 173.255.112.0/20 1; - 193.186.4.0/24 1; - 199.36.154.0/23 1; - 199.36.156.0/24 1; - 199.192.112.0/22 1; - 199.223.232.0/21 1; - 207.223.160.0/20 1; - 208.65.152.0/22 1; - 208.68.108.0/22 1; - 208.81.188.0/22 1; - 208.117.224.0/19 1; - 209.85.128.0/17 1; - 216.58.192.0/19 1; - 216.73.80.0/20 1; - 216.239.32.0/19 1; - 2001:4860::/32 1; - 2404:6800::/32 1; - 2404:f340::/32 1; - 2600:1900::/28 1; - 2606:73c0::/32 1; - 2607:f8b0::/32 1; - 2620:11a:a000::/40 1; - 2620:120:e000::/40 1; - 2800:3f0::/32 1; - 2a00:1450::/32 1; - 2c0f:fb50::/32 1; + 8.35.192.0/20 1; + 23.236.48.0/20 1; + 23.251.128.0/19 1; + 34.0.0.0/15 1; + 34.2.0.0/16 1; + 34.3.0.0/23 1; + 34.3.3.0/24 1; + 34.3.4.0/24 1; + 34.3.8.0/21 1; + 34.3.16.0/20 1; + 34.3.32.0/19 1; + 34.3.64.0/18 1; + 34.4.0.0/14 1; + 34.8.0.0/13 1; + 34.16.0.0/12 1; + 34.32.0.0/11 1; + 34.64.0.0/10 1; + 34.128.0.0/10 1; + 35.184.0.0/13 1; + 35.192.0.0/14 1; + 35.196.0.0/15 1; + 35.198.0.0/16 1; + 35.199.0.0/17 1; + 35.199.128.0/18 1; + 35.200.0.0/13 1; + 35.208.0.0/12 1; + 35.224.0.0/12 1; + 35.240.0.0/13 1; + 64.15.112.0/20 1; + 64.233.160.0/19 1; + 66.22.228.0/23 1; + 66.102.0.0/20 1; + 66.249.64.0/19 1; + 70.32.128.0/19 1; + 72.14.192.0/18 1; + 74.125.0.0/16 1; + 104.154.0.0/15 1; + 104.196.0.0/14 1; + 104.237.160.0/19 1; + 107.167.160.0/19 1; + 107.178.192.0/18 1; + 108.59.80.0/20 1; + 108.170.192.0/18 1; + 108.177.0.0/17 1; + 130.211.0.0/16 1; + 142.250.0.0/15 1; + 146.148.0.0/17 1; + 162.216.148.0/22 1; + 162.222.176.0/21 1; + 172.110.32.0/21 1; + 172.217.0.0/16 1; + 172.253.0.0/16 1; + 173.194.0.0/16 1; + 173.255.112.0/20 1; + 193.186.4.0/24 1; + 199.36.154.0/23 1; + 199.36.156.0/24 1; + 199.192.112.0/22 1; + 199.223.232.0/21 1; + 207.223.160.0/20 1; + 208.65.152.0/22 1; + 208.68.108.0/22 1; + 208.81.188.0/22 1; + 208.117.224.0/19 1; + 209.85.128.0/17 1; + 216.58.192.0/19 1; + 216.73.80.0/20 1; + 216.239.32.0/19 1; + 2001:4860::/32 1; + 2404:6800::/32 1; + 2404:f340::/32 1; + 2600:1900::/28 1; + 2606:73c0::/32 1; + 2607:f8b0::/32 1; + 2620:11a:a000::/40 1; + 2620:120:e000::/40 1; + 2800:3f0::/32 1; + 2a00:1450::/32 1; + 2c0f:fb50::/32 1; } map $feeds_whitelist $feeds_limit { - 0 ""; - 1 $binary_remote_addr; + 0 ""; + 1 $binary_remote_addr; } -# Limit login to prevent bruteforce -limit_req_zone $binary_remote_addr zone=invidious_login:5m rate=2r/s; -# Limit global requests to prevent DoS +limit_req_zone $binary_remote_addr zone=invidious_login:5m rate=5r/m; limit_req_zone $binary_remote_addr zone=invidious_requests:5m rate=5r/s; - -# Limit webfeed hook limit_req_zone $feeds_limit zone=invidious_feeds:5m rate=3r/s; -####### -# HTTP -####### - server { - listen 80; - listen [::]:80; + listen 80; + listen [::]:80; - server_name invidious.nerdvpn.de www.invidious.nerdvpn.de; + server_name invidious.nerdvpn.de www.invidious.nerdvpn.de; root /srv/nginx/public/invidious; - location /.well-known/acme-challenge/ { - allow all; - default_type "text/plain"; - alias /srv/nginx/public/acme/; - } - - location / { - return 301 https://invidious.nerdvpn.de$request_uri; - } -} -server { - listen 80; - listen [::]:80; - - server_name api.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; + include snippets/malicious.conf; location /.well-known/acme-challenge/ { - allow all; - default_type "text/plain"; - alias /srv/nginx/public/acme/; - } + allow all; + default_type "text/plain"; + alias /srv/nginx/public/acme/; + } - location / { - return 301 https://$host$request_uri; - } + location / { + return 301 https://invidious.nerdvpn.de$request_uri; + } } -server { - listen 80; - listen [::]:80; - - server_name ryd.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; - - location /.well-known/acme-challenge/ { - allow all; - default_type "text/plain"; - alias /srv/nginx/public/acme/; - } - - location / { - return 301 https://$host$request_uri; - } -} -server { - listen 80; - listen [::]:80; - - server_name sync.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; - - location /.well-known/acme-challenge/ { - allow all; - default_type "text/plain"; - alias /srv/nginx/public/acme/; - } - - location / { - return 301 https://$host$request_uri; - } -} -server { - listen 80; - listen [::]:80; - - server_name peer.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; - - location /.well-known/acme-challenge/ { - allow all; - default_type "text/plain"; - alias /srv/nginx/public/acme/; - } - - location / { - return 301 https://$host$request_uri; - } -} - -######## -# HTTPS -######## server { listen 443 ssl; - listen [::]:443 ssl; - - http2 on; - - server_name api.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; - - ssl_session_cache shared:nginx_TLS_api_invidious:5m; - - add_header X-Robots-Tag "none"; - - ssl_certificate /srv/letsencrypt/certs/api.invidious.nerdvpn.de/fullchain.pem; - ssl_certificate_key /srv/letsencrypt/certs/api.invidious.nerdvpn.de/privkey.pem; - include snippets/htst.conf; - - access_log off; - error_log /dev/null emerg; - - include snippets/malicious.conf; - - proxy_hide_header Access-Control-Allow-Origin; - add_header Access-Control-Allow-Credentials true; - add_header Access-Control-Allow-Origin "https://materialious.nerdvpn.de" always; - add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, HEAD, PATCH, PUT, DELETE" always; - add_header Access-Control-Allow-Headers "User-Agent, Authorization, Content-Type" always; - - location = /favicon.ico { - allow all; - } - - location = /robots.txt { - add_header Content-Type text/plain; - return 200 "User-agent: *\nDisallow: /"; - } - - location = /css/default.css { - root /srv/nginx/public/invidious; - } - - limit_rate 6000k; - - location / { - if ($api_invidious_access != 1) { - return 302 "https://invidious.nerdvpn.de$request_uri"; - } - - if ($request_method = OPTIONS) { - return 204; - } - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - - proxy_pass http://$upstream_server; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } - location ~ /(css|js|fonts|login|authorize_token|api) { - if ($request_method = OPTIONS) { - return 204; - } - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - - proxy_pass http://$upstream_server; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } -} -server { - listen 443 ssl; - listen [::]:443 ssl; - - http2 on; - - server_name ryd.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; - - ssl_session_cache shared:nginx_TLS_ryd:5m; - - add_header X-Robots-Tag "none"; - - ssl_certificate /srv/letsencrypt/certs/ryd.invidious.nerdvpn.de/fullchain.pem; - ssl_certificate_key /srv/letsencrypt/certs/ryd.invidious.nerdvpn.de/privkey.pem; - include snippets/htst.conf; - - access_log off; - error_log /dev/null emerg; - - include snippets/malicious.conf; - - location = /favicon.ico { - allow all; - } - - location = /robots.txt { - add_header Content-Type text/plain; - return 200 "User-agent: *\nDisallow: /"; - } - - limit_rate 6000k; - - location / { - add_header Access-Control-Allow-Origin "https://materialious.nerdvpn.de" always; - add_header Access-Control-Allow-Methods "GET, OPTIONS" always; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_pass http://ryd_proxy; - } -} -server { - listen 443 ssl; - listen [::]:443 ssl; - - http2 on; - - server_name sync.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; - - ssl_session_cache shared:nginx_TLS_sync:5m; - - add_header X-Robots-Tag "none"; - - ssl_certificate /srv/letsencrypt/certs/sync.invidious.nerdvpn.de/fullchain.pem; - ssl_certificate_key /srv/letsencrypt/certs/sync.invidious.nerdvpn.de/privkey.pem; - include snippets/htst.conf; - - access_log off; - error_log /dev/null emerg; - - include snippets/malicious.conf; - - location = /favicon.ico { - allow all; - } - - location = /robots.txt { - add_header Content-Type text/plain; - return 200 "User-agent: *\nDisallow: /"; - } - - limit_rate 6000k; - - location / { - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_pass http://invidious_sync; - } -} -server { - listen 443 ssl; - listen [::]:443 ssl; - - http2 on; - - server_name peer.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; - - ssl_session_cache shared:nginx_TLS_peer:5m; - - add_header X-Robots-Tag "none"; - - ssl_certificate /srv/letsencrypt/certs/peer.invidious.nerdvpn.de/fullchain.pem; - ssl_certificate_key /srv/letsencrypt/certs/peer.invidious.nerdvpn.de/privkey.pem; - include snippets/htst.conf; - - access_log off; - error_log /dev/null emerg; - - include snippets/invidious-errorpages.conf; - - location = /favicon.ico { - allow all; - } - - location = /robots.txt { - add_header Content-Type text/plain; - return 200 "User-agent: *\nDisallow: /"; - } - - limit_rate 6000k; - - location / { - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header "Connection" ""; - - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_pass http://invidious_peer; - } -} - -server { - listen 443 ssl; - listen [::]:443 ssl; + listen [::]:443 ssl; http2 on; server_name www.invidious.nerdvpn.de; root /srv/nginx/public/invidious; - - ssl_certificate /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem; - ssl_certificate_key /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem; + + include snippets/malicious.conf; + + ssl_certificate /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem; + ssl_certificate_key /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem; include snippets/htst.conf; access_log off; error_log /dev/null emerg; - - location / { - return 301 https://invidious.nerdvpn.de$request_uri; - } + + location / { + return 301 https://invidious.nerdvpn.de$request_uri; + } } server { - listen 443 ssl; + listen 443 ssl; listen 443 default_server quic reuseport; - listen [::]:443 ssl; + listen [::]:443 ssl; listen [::]:443 default_server quic reuseport; http2 on; @@ -508,7 +172,7 @@ server { server_name invidious.nerdvpn.de; root /srv/nginx/public/invidious; - + add_header Alt-Svc 'h3=":443"; ma=86400'; add_header X-server-instance $server_instance always; add_header X-server-proto $server_protocol always; @@ -516,213 +180,132 @@ server { ssl_session_cache shared:nginx_TLS_invidious:10m; - add_header X-Robots-Tag "noindex, nofollow, noai, noimageai"; + add_header X-Robots-Tag "index, follow, noai, noimageai"; - ssl_certificate /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem; - ssl_certificate_key /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem; + ssl_certificate /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem; + ssl_certificate_key /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem; include snippets/htst.conf; access_log off; error_log /dev/null emerg; + + include snippets/invidious_errorpages.conf; + include snippets/malicious.conf; - include snippets/malicious.conf; - - limit_rate 6000k; + limit_rate 4000k; - location = /favicon.ico { - include /etc/nginx/bots.d/ddos.conf; - allow all; - } - - location = /robots.txt { - add_header Content-Type text/plain; - return 200 "User-agent: GPTBot\nDisallow: /\nUser-agent: ChatGPT-User\nDisallow: /\nUser-agent: FacebookBot\nDisallow: /\nUser-agent: archive.org_bot\nDisallow: /\nUser-agent: Amazonbot\nDisallow: /\nUser-agent: *\nDisallow:"; - } - - error_page 503 @maintenance; + include snippets/favicon.conf; + include snippets/robots.conf; + + error_page 503 @maintenance; location @maintenance { - root /srv/nginx/public/maintenance/; - rewrite ^ "/index.html" break; - } - - location /api/v1/stats { - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_pass http://invidious/api/v1/stats; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + auth_request off; + root /srv/nginx/public/maintenance/; + rewrite ^ "/index.html" break; + } + location = /css/default.css { + auth_request off; + root /srv/nginx/public/invidious; } location ~ (^/feed/webhook) { + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + auth_request off; limit_req zone=invidious_feeds burst=240 delay=80; + #access_log /var/log/nginx/access/invidious.webfeed.log; + #error_log /var/log/nginx/errors/invidious.webfeed.log error; proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_pass http://invidious_worker; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Connection ""; + proxy_pass http://invidious; + } + location /.within.website/ { + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_pass http://anubis; + proxy_pass_request_body off; + proxy_set_header content-length ""; + auth_request off; + } + location @redirectToAnubis { + return 307 /.within.website/?redir=$request_uri; + auth_request off; } location / { + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + limit_req zone=invidious_requests burst=240 delay=80; - - if ($invidious_access != 1) { - return 503; - } + + if ($invidious_access != 1) { + return 503; + } if ($request_method = OPTIONS) { return 204; - } - - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_pass http://$upstream_server; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; } - # video streaming and downloads - location ~ (^/videoplayback) { - limit_req zone=invidious_requests burst=240 delay=80; + auth_request /.within.website/x/cmd/anubis/api/check; + error_page 401 = @redirectToAnubis; - # Limit user video streaming to 32 MBit/s - limit_rate 4000k; - - proxy_set_header X-Forwarded-For ""; - proxy_set_header CF-Connecting-IP ""; - proxy_hide_header "alt-svc"; - - sendfile on; - sendfile_max_chunk 512k; - tcp_nopush on; - aio threads=default; - aio_write on; - directio 16m; - - proxy_hide_header Cache-Control; - proxy_hide_header etag; - proxy_set_header Connection keep-alive; - proxy_max_temp_file_size 32m; - - proxy_http_version 1.1; - proxy_pass http://$ivproxy_server; - add_header Cache-Control private always; - } - # static assets from yt - location ~ (^/vi/|^/ggpht/) { - limit_req zone=invidious_requests burst=240 delay=80; - limit_rate 8000k; - - proxy_set_header X-Forwarded-For ""; - proxy_set_header CF-Connecting-IP ""; - proxy_hide_header "alt-svc"; - - sendfile on; - sendfile_max_chunk 512k; - tcp_nopush on; - aio threads=default; - aio_write on; - directio 16m; - - proxy_hide_header Cache-Control; - proxy_hide_header etag; - proxy_set_header Connection keep-alive; - proxy_max_temp_file_size 32m; - - proxy_http_version 1.1; - proxy_pass http://$ivproxy_server; - add_header Cache-Control private always; - } - location ~ /(login) { - limit_req zone=invidious_login burst=4 nodelay; + #error_page 503 = @maintenance; proxy_http_version 1.1; - proxy_set_header "Connection" ""; + proxy_set_header Connection ""; proxy_pass http://$upstream_server; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; } - location ~ /(css|js|fonts|delete_account|data_control|subscription_manager) { - limit_req zone=invidious_requests burst=240 delay=80; - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_pass http://$upstream_server; + + # Maintenance routes + #location ~ /(login) { + # auth_request off; + # limit_req zone=invidious_login burst=4 nodelay; + # proxy_http_version 1.1; + # proxy_set_header Connection ""; + # proxy_pass http://invidious_zero; + #} + #location ~ /(css|js|fonts|delete_account|data_control|subscription_manager|signout) { + # auth_request off; + # limit_req zone=invidious_requests burst=240 delay=80; + # proxy_http_version 1.1; + # proxy_set_header Connection ""; + # proxy_pass http://invidious_zero; + #} + + # Companion routes + location /latest_version { proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } -} - -server { - listen unix:/var/run/invidious-tor.sock; - - server_name nerdvpneaggggfdiurknszkbmhvjndks5z5k3g5yp4nhphflh3n3boad.onion; - root /srv/nginx/public/invidious; - - add_header X-server-instance $server_instance always; - - access_log off; - error_log /dev/null emerg; - - error_page 503 @maintenance; - location @maintenance { - root /srv/nginx/public/maintenance/; - rewrite ^ "/index.html" break; - } - - location / { - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_pass http://invidious_tor; - proxy_set_header Host $host; - } - # video streaming - location ~ (^/videoplayback) { - proxy_set_header X-Forwarded-For ""; - proxy_set_header CF-Connecting-IP ""; - proxy_hide_header "alt-svc"; - - sendfile on; - sendfile_max_chunk 512k; - tcp_nopush on; - aio threads=default; - aio_write on; - directio 16m; - - proxy_hide_header Cache-Control; - proxy_hide_header etag; - proxy_set_header Connection keep-alive; - proxy_max_temp_file_size 32m; - - proxy_http_version 1.1; - proxy_pass http://$ivproxy_server; - add_header Cache-Control private always; - } - # assets from yt - location ~ (^/vi/|^/ggpht/) { - proxy_set_header X-Forwarded-For ""; - proxy_set_header CF-Connecting-IP ""; - proxy_hide_header "alt-svc"; - - sendfile on; - sendfile_max_chunk 512k; - tcp_nopush on; - aio threads=default; - aio_write on; - directio 16m; - - proxy_hide_header Cache-Control; - proxy_hide_header etag; - proxy_set_header Connection keep-alive; - proxy_max_temp_file_size 32m; - - proxy_http_version 1.1; - proxy_pass http://$ivproxy_server; - add_header Cache-Control private always; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_pass http://invidious_companion; + proxy_http_version 1.1; + proxy_set_header Connection ""; + } + location /api/manifest/dash/id/ { + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_pass http://invidious_companion; + proxy_http_version 1.1; + proxy_set_header Connection ""; + } + location /videoplayback { + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_pass http://invidious_companion; + proxy_http_version 1.1; + proxy_set_header Connection ""; } } diff --git a/patches/001-nerdvpn-branding.patch b/patches/001-nerdvpn-branding.patch index 03b8a42..9641bfb 100644 --- a/patches/001-nerdvpn-branding.patch +++ b/patches/001-nerdvpn-branding.patch @@ -1,5 +1,5 @@ diff --git a/src/invidious.cr b/src/invidious.cr -index e0bd0101..bf1a46d1 100644 +index 3804197e..0e051080 100644 --- a/src/invidious.cr +++ b/src/invidious.cr @@ -75,9 +75,9 @@ REQUEST_HEADERS_WHITELIST = {"accept", "accept-encoding", "cache-control", "con @@ -15,10 +15,19 @@ index e0bd0101..bf1a46d1 100644 # This is used to determine the `?v=` on the end of file URLs (for cache busting). We # only need to expire modified assets, so we can use this to find the last commit that changes diff --git a/src/invidious/views/template.ecr b/src/invidious/views/template.ecr -index 9904b4fc..14170acd 100644 +index 9904b4fc..769ab1e2 100644 --- a/src/invidious/views/template.ecr +++ b/src/invidious/views/template.ecr -@@ -147,7 +147,7 @@ +@@ -142,12 +142,16 @@ + + <%= translate(locale, "View privacy policy.") %> + ++ ++ ++ <%= translate(locale, "View terms of use.") %> ++ + +In order to provide the best Invidious experience possible, I have rented a very powerful dedicated server with 16 cores, 48 GiB RAM and a 2 GBit/s unmetered network connection. I also use 3 different, fully e2e-encrypted backup locations with live replication and a zero-dataloss backup strategy. All of this has its cost.
-+All donations will go directly into paying my monthly infrastructure costs (server, domain, backups).
++In order to provide the best Invidious experience possible, I have rented a very powerful dedicated server with 16 cores, 48 GiB RAM and a 2 GBit/s unmetered network connection. On top of that are the multiple backends required to bypass blockage from YouTube. I also use 3 different, fully e2e-encrypted backup locations with live replication and a zero-dataloss backup strategy. All of this has a high cost.
++All donations will go directly into paying my monthly infrastructure costs (server, domain, backends, backups).
+Should the donations at any point fully cover the costs, I will invest the remaining directly into improving my infrastructure and thus improving the user experience.
+Every little bit helps. Thank you very much for considering to donate!
+If you have any questions, feel free to contact me via matrix at: @weidenwiesel:matrix.org
++If you have any questions, feel free to contact me via matrix at: @weidenwiesel:nerdvpn.de
+This instance uses proxies to bypass blockage from YouTube.
Right now, all of those proxies are blocked.
Please wait for up to two minutes until the automated background script has sucessfully rotated the proxies and refresh this site afterwards.
Please don't spam the refresh button, this won't make the process faster.
Please don't report this issue on github, we already know.
" ++ if message.includes?("This helps protect our community") || message.includes?("Watch on the latest version of YouTube") || message.includes?("Sign in to confirm you’re not a bot") || message.includes?("Please sign in") || message.includes?("This content isn't available, try again later") ++ error_message = "Received error from YouTube: " + message + "
Please try reloading the page or try switching to another backend.