From 66d0951fb39f455dc10d6f911a013968ffea1540 Mon Sep 17 00:00:00 2001 From: Sommerwiesel Date: Wed, 18 Jun 2025 11:27:18 +0200 Subject: [PATCH] Change to multiple backends --- .env | 41 +- README.md | 38 +- build.sh | 10 +- docker-compose.yml | 838 ++++++++--------- docker/haproxy/haproxy.cfg | 31 - docker/userlist.txt | 2 - invidious.service | 16 +- nginx/sites-enabled/invidious.vhost | 851 +++++------------- patches/001-nerdvpn-branding.patch | 15 +- patches/003-proxy-csp.patch | 37 - patches/004-donate-page.patch | 6 +- patches/010-use-redis-for-video-cache.patch | 151 ---- ...14-rewrite-obnoxious-blocked-message.patch | 4 +- scripts/deploy-database.sh | 3 +- 14 files changed, 664 insertions(+), 1379 deletions(-) delete mode 100644 docker/haproxy/haproxy.cfg delete mode 100644 docker/userlist.txt delete mode 100644 patches/003-proxy-csp.patch delete mode 100644 patches/010-use-redis-for-video-cache.patch diff --git a/.env b/.env index ed1705a..eab6aa3 100644 --- a/.env +++ b/.env @@ -1,33 +1,16 @@ +# I change the compose so often, it needs to ignore orphaned containers +COMPOSE_IGNORE_ORPHANS=True + # Invidious -INV_CPU_CORES=1 -INV_MEM_LIMIT="768m" -INV_MEM_RESERVATION="512m" +INV_CPU_CORES=4 +INV_MEM_LIMIT="1280m" +INV_MEM_SWAP="2048m" INV_IMAGE="invidious-nerdvpn:latest" INV_RESTART_POLICY="unless-stopped" +INV_HEALTHCHECK_URL="api/v1/stats" +BANNER_MSG="

YOUR BANNER MSG HERE

" -INV_HEALTHCHECK_URL="watch?v=jNQXAC9IVRw" - -BANNER_MSG="

" - -# PSQL -POSTGRES_DB="invidious" -POSTGRES_USER="invidious" -POSTGRES_PASSWORD="" - -INV_PSQL_CPU_CORES=6 -INV_PSQL_MEM_LIMIT="8448m" -INV_PSQL_MEM_RESERVATION="6400m" -INV_PSQL_IMAGE="docker.io/library/postgres:14" - -# Materialious -VITE_DEFAULT_INVIDIOUS_INSTANCE="https://api.invidious.nerdvpn.de" -VITE_DEFAULT_RETURNYTDISLIKES_INSTANCE="https://ryd.invidious.nerdvpn.de" -VITE_DEFAULT_FRONTEND_URL="https://materialious.nerdvpn.de" -VITE_DEFAULT_SPONSERBLOCK_INSTANCE="https://sponsor.ajay.app" -VITE_DEFAULT_DEARROW_INSTANCE="" -VITE_DEFAULT_DEARROW_THUMBNAIL_INSTANCE="" -VITE_DEFAULT_SYNCIOUS_INSTANCE="https://sync.invidious.nerdvpn.de" -VITE_DEFAULT_PEERJS_HOST="peer.invidious.nerdvpn.de" -VITE_DEFAULT_PEERJS_PATH="/" -VITE_DEFAULT_PEERJS_PORT=443 -VITE_DEFAULT_SETTINGS='{"region": "DE", "darkMode": false, "themeColor": "#FFB81C", "autoPlay": true, "alwaysLoop": false, "proxyVideos": false, "listenByDefault": false, "savePlaybackPosition": true, "dashEnabled": false, "theatreModeByDefault": false, "autoplayNextByDefault": true, "returnYtDislikes": true, "searchSuggestions": true, "previewVideoOnHover": false, "sponsorBlock": true, "sponsorBlockCategories": "sponsor,interaction,selfpromo", "deArrowEnabled": false, "playerMiniPlayer": true, "syncious": true}' +# Companion +COMP_CPU_CORES=4 +COMP_MEM_LIMIT="1536m" +COMP_MEM_SWAP="2048m" diff --git a/README.md b/README.md index ebad708..599feb0 100644 --- a/README.md +++ b/README.md @@ -5,39 +5,49 @@ Theme for my instance is based on: https://github.com/Tsyron/Invidious-Theme Original repo at: https://github.com/iv-org/invidious -Based upon patches from: https://github.com/yewtudotbe/invidious-custom +Based upon patches from: +https://github.com/yewtudotbe/invidious-custom +https://git.nadeko.net/Fijxu/invidious +<<<<<<< HEAD # IMPORTANT The instructions below are outdated. YouTube is currently quadrupling down on trying to block Invidious instances, so there are almost daily changes to my server setup. I haven't found the time yet to provide new/better instructions, so the instructions below should be taken with some grain of salt. +======= +# Requirements - you need to set this up before running my fork +1. HAProxy 2.x either run on the host or added to the docker-compose.yaml with my config under `etc/haproxy/haproxy.cfg` +2. PostgreSQL 16 server either run on the host or added to the docker-compose.yaml +3. (optional bvut highly recommended) PGBouncer to pool the connections to PostgreSQL. You'll otherwise run into lots of db pool errors under high loads +4. Nginx with my configs under etc/nginx +5. Valid ssl certificate for your domain. I recommend using dehydrated: https://github.com/dehydrated-io/dehydrated +6. Docker compose V2 +>>>>>>> 9de2789 (Change to multiple backends) # Build instructions +Do this in a separate dir (for example /srv/invidious) under non-root permissions + 1. `git clone https://github.com/Sommerwiesel/invidious-nerdvpn .` 2. `git clone https://github.com/iv-org/invidious build` -3. `./patch.sh` -4. `./build.sh development` for the development image or `./build.sh release` for the production image +3. `git clone https://github.com/iv-org/invidious-companion companion` +4. Modify the patches under invidious-nerdvpn/patches to your needs (i.e. change branding) and then run `./patch.sh` +5. `./build.sh development` for the development image or `./build.sh release` for the production image +6. `build.sh companion` to build the invidious companion # Update instructions -- Simply run `./update.sh` +1. Run `./revert.sh` to remove all patches +2. Update both repos (build and companion) via `git pull` +3. Run the steps 5 and 6 again fro mthe run instructions # Run instructions (docker compose) -- For the database: `docker compose --profile database up -d` -- For the worker: `docker compose --profile worker up -d` -- For the web client: `docker compose --profile web up -d` -- For the tor web client: `docker compose --profile tor up -d` -- For materialious: `docker compose --profile materialious up -d` +- Simply run `docker compose up -d` # Run instructions (systemd) First copy the invidious.service to /etc/systemd/system/ -- For the database: `systemctl enable --now invidious@database.service` -- For the worker: `systemctl enable --now invidious@worker.service` -- For the web client: `systemctl enable --now invidious@web.service` -- For the tor web client: `systemctl enable --now invidious@tor.service` -- For materialious: `systemctl enable --now invidious@materialious.service` +- Enable and start with: `systemctl enable --now invidious.service` diff --git a/build.sh b/build.sh index c347ceb..cad5535 100755 --- a/build.sh +++ b/build.sh @@ -6,14 +6,18 @@ if [ $# -eq 0 ]; then fi mode=$1 - +export COMPOSE_BAKE=true if [ "$mode" == "release" ]; then - docker compose --profile base build --build-arg release=1 + docker compose --profile base build invidious-base --build-arg release=1 fi if [ "$mode" == "development" ]; then - docker compose --profile base build --build-arg release=0 + docker compose --profile base build invidious-base --build-arg release=0 +fi + +if [ "$mode" == "companion" ]; then + docker compose build "invidious-companion-3" --build-arg release=0 fi yes | docker system prune diff --git a/docker-compose.yml b/docker-compose.yml index f8e0122..24bc3a6 100755 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,128 +1,90 @@ -x-volumes: &volumes +x-defaults: &defaults volumes: - /var/run/redis/redis-server.sock:/invidious/redis-server.sock:rw + labels: + - "com.centurylinklabs.watchtower.enable=false" +services: -services: - - # This service is for building the base image (patch.sh && build.sh) - invidious: - <<: *volumes + invidious-base: + <<: *defaults env_file: - .env profiles: ["base"] - cpus: ${INV_CPU_CORES} + cpus: 16 mem_limit: "${INV_MEM_LIMIT}" - mem_reservation: "${INV_MEM_RESERVATION}" - image: "${INV_IMAGE}" + memswap_limit: "${INV_MEM_SWAP}" + image: invidious-nerdvpn:latest build: context: build dockerfile: docker/Dockerfile restart: "${INV_RESTART_POLICY}" environment: &environment INVIDIOUS_CONFIG: | - #force_resolve: ipv6 + force_resolve: ipv6 + invidious_companion: + # IPv6 + - private_url: "http://invidious-companion-1:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- EU, NL" + - private_url: "http://invidious-companion-2:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- EU, DE" + - private_url: "http://invidious-companion-3:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- EU, FR" + - private_url: "http://invidious-companion-4:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- US 1" + - private_url: "http://invidious-companion-5:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- US 2" + - private_url: "http://invidious-companion-6:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- CA" + - private_url: "http://invidious-companion-7:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- UK" + - private_url: "http://invidious-companion-8:8282" + public_url: "https://invidious.nerdvpn.de" + note: "- AU" + # IPv4 (currently too expensive, so disabled) + #- private_url: "http://invidious-proxy-1:8282" + # public_url: "https://invidious.nerdvpn.de" + # note: "- Main, EU" + #- private_url: "http://invidious-proxy-2:8282" + # public_url: "https://invidious.nerdvpn.de" + # note: "- Main, US" + invidious_companion_key: "" + backend_name_prefix: "" modified_source_code_url: "https://github.com/Sommerwiesel/invidious-nerdvpn" hmac_key: db: dbname: invidious user: invidious password: - host: invidious-pgbouncer - port: 5432 + host: 192.42.6.1 + port: 6432 redis_socket: "/invidious/redis-server.sock" redis_db: 4 redis_auth: "" - http_proxy: - host: "192.42.6.30" - port: 80 - check_tables: true - external_port: 443 - domain: "invidious.nerdvpn.de" - https_only: true - hsts: true - pool_size: 60 - disable_proxy: ["local"] - log_level: "Fatal" - popular_enabled: true - statistics_enabled: true - enable_user_notifications: false - channel_threads: 0 - feed_threads: 0 - use_pubsub_feeds: false - banner: "${BANNER_MSG}" - jobs: - clear_expired_items: - enable: false - refresh_channels: - enable: false - refresh_feeds: - enable: false - default_user_preferences: - locale: "de" - region: "DE" - captions: ["","English","English (auto-generated)"] - dark_mode: "dark" - feed_menu: ["Trending", "Subscriptions", "Playlists", "Search"] - default_home: "Search" - comments: ["youtube", ""] - autoplay: true - continue_autoplay: true - quality: "hd720" - quality_dash: "720p" - unseen_only: true - local: false - automatic_instance_redirect: true - networks: - invidious_proxy: - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - retries: 2 - - # Takes care of refreshing the feeds - invidious_worker: - <<: *volumes - env_file: - - .env - profiles: ["worker"] - container_name: invidious_worker - cpus: ${INV_CPU_CORES} - mem_limit: "1536m" - mem_reservation: "768m" - image: "${INV_IMAGE}" - restart: "${INV_RESTART_POLICY}" - environment: - INVIDIOUS_CONFIG: | - #force_resolve: ipv6 - modified_source_code_url: "https://github.com/Sommerwiesel/invidious-nerdvpn" - hmac_key: - db: - dbname: invidious - user: invidious - password: - host: invidious-pgbouncer - port: 5432 - redis_socket: "/invidious/redis-server.sock" - redis_db: 4 - redis_auth: "" - http_proxy: - host: "192.42.6.30" - port: 80 check_tables: true external_port: 443 domain: "invidious.nerdvpn.de" https_only: true hsts: true pool_size: 100 - disable_proxy: ["livestreams","local"] - log_level: "Fatal" + disable_proxy: ["livestreams","local","dash","downloads"] + log_level: "Error" popular_enabled: true statistics_enabled: true + admins: [""] enable_user_notifications: false channel_threads: 4 - feed_threads: 4 - channel_refresh_interval: "15m" + channel_refresh_interval: "120m" use_pubsub_feeds: true + feed_threads: 4 + banner: "${BANNER_MSG}" + use_innertube_for_captions: true default_user_preferences: locale: "de" region: "DE" @@ -138,24 +100,293 @@ services: unseen_only: true local: false automatic_instance_redirect: true + hide_shorts: false networks: invidious_proxy: - ipv4_address: 192.42.6.9 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 3m - timeout: 5s - retries: 2 - invidious_1: - <<: *volumes + invidious-companion-1: + container_name: invidious-companion-1 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/1:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.11 + + invidious-companion-2: + container_name: invidious-companion-2 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/2:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.12 + + invidious-companion-3: + container_name: invidious-companion-3 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/3:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.13 + + invidious-companion-4: + container_name: invidious-companion-4 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/4:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.14 + + invidious-companion-5: + container_name: invidious-companion-5 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/5:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.15 + + invidious-companion-6: + container_name: invidious-companion-6 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/6:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.16 + + invidious-companion-7: + container_name: invidious-companion-7 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/7:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.17 + + invidious-companion-8: + container_name: invidious-companion-8 + cpus: ${COMP_CPU_CORES} + mem_limit: "${COMP_MEM_LIMIT}" + memswap_limit: "${COMP_MEM_SWAP}" + #image: quay.io/invidious/invidious-companion:latest + image: invidious-companion-nerdvpn:latest + build: + context: companion + dockerfile: Dockerfile + labels: + - "com.centurylinklabs.watchtower.enable=false" + environment: + - SERVER_SECRET_KEY= + - PROXY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/8:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + networks: + invidious_proxy: + ipv4_address: 192.42.6.18 + + # companion 11 and 12 are for ipv4 proxies that only support socks5 + invidious-companion-11: + profiles: ["disabled"] + container_name: invidious-companion-11 + cpus: ${COMP_CPU_CORES} + mem_limit: "${INV_MEM_LIMIT}" + memswap_limit: "${INV_MEM_SWAP}" + image: quay.io/invidious/invidious-companion:latest + environment: + - SERVER_SECRET_KEY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/11:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + #networks: + # invidious_proxy: + # ipv4_address: 192.42.6.21 + network_mode: "container:invidious-proxy-1" + depends_on: + - invidious-proxy-1 + + invidious-companion-12: + profiles: ["disabled"] + container_name: invidious-companion-12 + cpus: ${COMP_CPU_CORES} + mem_limit: "${INV_MEM_LIMIT}" + memswap_limit: "${INV_MEM_SWAP}" + image: quay.io/invidious/invidious-companion:latest + environment: + - SERVER_SECRET_KEY= + - SERVER_ENABLE_METRICS=false + restart: unless-stopped + cap_drop: + - ALL + read_only: true + volumes: + - /srv/invidious/cache/12:/var/tmp/youtubei.js:rw + security_opt: + - no-new-privileges:true + #networks: + # invidious_proxy: + # ipv4_address: 192.42.6.22 + network_mode: "container:invidious-proxy-2" + depends_on: + - invidious-proxy-2 + + invidious: + <<: *defaults env_file: - .env - profiles: ["web"] - container_name: invidious_1 + container_name: invidious cpus: ${INV_CPU_CORES} mem_limit: "${INV_MEM_LIMIT}" - mem_reservation: "${INV_MEM_RESERVATION}" + memswap_limit: "${INV_MEM_SWAP}" image: "${INV_IMAGE}" restart: "${INV_RESTART_POLICY}" environment: @@ -163,374 +394,61 @@ services: networks: invidious_proxy: ipv4_address: 192.42.6.2 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - timeout: 5s - retries: 2 - - invidious_2: - <<: *volumes - env_file: - - .env - profiles: ["web"] - container_name: invidious_2 - cpus: ${INV_CPU_CORES} - mem_limit: "${INV_MEM_LIMIT}" - mem_reservation: "${INV_MEM_RESERVATION}" - image: "${INV_IMAGE}" - restart: "${INV_RESTART_POLICY}" - environment: - <<: *environment - networks: - invidious_proxy: - ipv4_address: 192.42.6.3 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - timeout: 5s - retries: 2 - - invidious_3: - <<: *volumes - env_file: - - .env - profiles: ["web"] - container_name: invidious_3 - cpus: ${INV_CPU_CORES} - mem_limit: "${INV_MEM_LIMIT}" - mem_reservation: "${INV_MEM_RESERVATION}" - image: "${INV_IMAGE}" - restart: "${INV_RESTART_POLICY}" - environment: - <<: *environment - networks: - invidious_proxy: - ipv4_address: 192.42.6.4 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - timeout: 5s - retries: 2 - - invidious_4: - <<: *volumes - env_file: - - .env - profiles: ["web"] - container_name: invidious_4 - cpus: ${INV_CPU_CORES} - mem_limit: "${INV_MEM_LIMIT}" - mem_reservation: "${INV_MEM_RESERVATION}" - image: "${INV_IMAGE}" - restart: "${INV_RESTART_POLICY}" - environment: - <<: *environment - networks: - invidious_proxy: - ipv4_address: 192.42.6.5 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - timeout: 5s - retries: 2 - - invidious_5: - <<: *volumes - env_file: - - .env - profiles: ["web"] - container_name: invidious_5 - cpus: ${INV_CPU_CORES} - mem_limit: "${INV_MEM_LIMIT}" - mem_reservation: "${INV_MEM_RESERVATION}" - image: "${INV_IMAGE}" - restart: "${INV_RESTART_POLICY}" - environment: - <<: *environment - networks: - invidious_proxy: - ipv4_address: 192.42.6.6 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - timeout: 5s - retries: 2 - - invidious_6: - <<: *volumes - env_file: - - .env - profiles: ["web"] - container_name: invidious_6 - cpus: ${INV_CPU_CORES} - mem_limit: "${INV_MEM_LIMIT}" - mem_reservation: "${INV_MEM_RESERVATION}" - image: "${INV_IMAGE}" - restart: "${INV_RESTART_POLICY}" - environment: - <<: *environment - networks: - invidious_proxy: - ipv4_address: 192.42.6.7 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - timeout: 5s - retries: 2 - - materialious: - env_file: - - .env - profiles: ["materialious"] - container_name: materialious - cpus: "2" - mem_reservation: "32m" - mem_limit: "64m" - image: "wardpearce/materialious" - restart: "unless-stopped" - networks: - invidious_proxy: - ipv4_address: 192.42.6.13 - - # Return YouTube Dislike proxy via tor - materialious_ryd-proxy: - profiles: ["materialious"] - container_name: materialious_ryd-proxy - image: 1337kavin/ryd-proxy:latest - restart: "unless-stopped" - cpus: "2" - mem_reservation: "128m" - mem_limit: "256m" - depends_on: - - materialious_tor - environment: - - PROXY=socks5://materialious_tor:5566 - - WEB_CONCURRENCY=3 - networks: - invidious_proxy: - ipv4_address: 192.42.6.14 - materialious_api: - profiles: ["materialious"] - container_name: materialious_api - image: wardpearce/invidious_api_extended:latest - restart: "unless-stopped" - cpus: "3" - mem_reservation: "192m" - mem_limit: "320m" - environment: - api_extended_postgre: '{"host": "invidious-db", "port": 5432, "database": "invidious", "user": "invidious", "password": ""}' - api_extended_allowed_origins: '["https://materialious.nerdvpn.de"]' - api_extended_debug: false - api_extended_invidious_instance: "https://api.invidious.nerdvpn.de" - api_extended_production_instance: "https://sync.invidious.nerdvpn.de" - WEB_CONCURRENCY: 3 - networks: - invidious_proxy: - ipv4_address: 192.42.6.15 - - # Opens tor circuits - materialious_tor: - profiles: ["materialious"] - container_name: materialious_tor - image: 1337kavin/alpine-tor:latest - restart: "unless-stopped" - cpus: "2" - mem_reservation: "128m" - mem_limit: "256m" - environment: - - tors=2 - - test_url="http://nerdvpn2awosmfgodp77bavzve3k2kvxw52z364suglul2qaalcdqtad.onion" - networks: - invidious_proxy: - ipv4_address: 192.42.6.20 - - materialious_peerjs: - profiles: ["materialious"] - container_name: materialious_peerjs - build: - context: peerjs - dockerfile: Dockerfile - restart: "unless-stopped" - cpus: "2" - mem_reservation: "32m" + # Those are for proxies that only support socks5 + invidious-proxy-1: + profiles: ["disabled"] + container_name: invidious-proxy-1 + restart: unless-stopped + image: ghcr.io/xjasonlyu/tun2socks:latest + cpus: 2 mem_limit: "128m" - labels: - - "com.centurylinklabs.watchtower.enable=false" - networks: - invidious_proxy: - ipv4_address: 192.42.6.19 - - invidious_tor: - <<: *volumes - env_file: - - .env - profiles: ["tor"] - container_name: invidious_tor - cpus: ${INV_CPU_CORES} - mem_limit: "512m" - mem_reservation: "128m" - image: "${INV_IMAGE}" - restart: "${INV_RESTART_POLICY}" + memswap_limit: "320m" + cap_add: + - NET_ADMIN + devices: + - '/dev/net/tun:/dev/net/tun' environment: - INVIDIOUS_CONFIG: | - force_resolve: ipv6 - modified_source_code_url: "https://github.com/Sommerwiesel/invidious-nerdvpn" - hmac_key: - db: - dbname: invidious - user: invidious - password: - host: invidious-pgbouncer - port: 5432 - redis_socket: "/invidious/redis-server.sock" - redis_db: 4 - redis_auth: "" - http_proxy: - host: "192.42.6.30" - port: 80 - check_tables: true - external_port: 80 - domain: "jt3wafuew7rumgwp7wfixpbtxc4dw6jvvfjt7dud33xczvwvgih5nfqd.onion" - https_only: false - hsts: false - pool_size: 40 - disable_proxy: ["livestreams","local","dash","downloads"] - log_level: "Fatal" - popular_enabled: false - statistics_enabled: true - enable_user_notifications: false - channel_threads: 0 - feed_threads: 0 - use_pubsub_feeds: false - jobs: - clear_expired_items: - enable: false - refresh_channels: - enable: false - refresh_feeds: - enable: false - default_user_preferences: - locale: "de" - region: "DE" - captions: ["","English","English (auto-generated)"] - dark_mode: "dark" - feed_menu: ["Trending", "Subscriptions", "Playlists", "Search"] - default_home: "Search" - comments: ["youtube", ""] - autoplay: true - continue_autoplay: true - quality: "hd720" - quality_dash: "720p" - unseen_only: true - local: false - automatic_instance_redirect: false + - LOGLEVEL=info + - TUN=tun0 + - ADDR=198.18.0.1/15 + - MTU=9000 + - PROXY= + sysctls: + - net.ipv4.ip_forward=1 + - net.ipv6.conf.all.forwarding=1 + - net.ipv6.conf.default.disable_ipv6=0 networks: invidious_proxy: - ipv4_address: 192.42.6.8 - healthcheck: - test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1 - interval: 5m - timeout: 5s - retries: 2 + ipv4_address: 192.42.6.200 - invidious-pgbouncer: - env_file: - - .env - profiles: ["database"] - container_name: invidious-pgbouncer + invidious-proxy-2: + profiles: ["disabled"] + container_name: invidious-proxy-2 + restart: unless-stopped + image: ghcr.io/xjasonlyu/tun2socks:latest + cpus: 2 mem_limit: "128m" - mem_reservation: "64m" - image: edoburu/pgbouncer - restart: "${INV_RESTART_POLICY}" + memswap_limit: "320m" + cap_add: + - NET_ADMIN + devices: + - '/dev/net/tun:/dev/net/tun' environment: - - DB_HOST=invidious-db - - DB_PORT=5432 - - DB_USER=invidious - - DB_PASSWORD= - - DB_NAME=invidious - - ADMIN_USERS=pgbouncer - - POOL_MODE=transaction - - DEFAULT_POOL_SIZE=80 - - MIN_POOL_SIZE=20 - - RESERVE_POOL_SIZE=80 - - RESERVE_POOL_TIMEOUT=5 - - MAX_DB_CONNECTIONS=160 - - MAX_USER_CONNECTIONS=160 - - MAX_CLIENT_CONN=1000 - - AUTH_TYPE=scram-sha-256 - - IGNORE_STARTUP_PARAMETERS=extra_float_digits - volumes: - - ./docker/userlist.txt:/etc/pgbouncer/userlist.txt:rw - healthcheck: - test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB -h invidious-db"] - interval: 5m - timeout: 15s - retries: 2 + - LOGLEVEL=info + - TUN=tun0 + - ADDR=198.18.0.1/15 + - MTU=9000 + - PROXY= + sysctls: + - net.ipv4.ip_forward=1 + - net.ipv6.conf.all.forwarding=1 + - net.ipv6.conf.default.disable_ipv6=0 networks: invidious_proxy: - ipv4_address: 192.42.6.11 - - invidious-db: - env_file: - - .env - profiles: ["database"] - container_name: invidious-db - cpus: ${INV_PSQL_CPU_CORES} - mem_limit: "${INV_PSQL_MEM_LIMIT}" - memswap_limit: "${INV_PSQL_MEM_LIMIT}" - mem_reservation: "${INV_PSQL_MEM_RESERVATION}" - image: "${INV_PSQL_IMAGE}" - restart: "${INV_RESTART_POLICY}" - volumes: - - type: bind - source: /srv/invidious/database - target: /var/lib/postgresql/data - - ./config/sql:/config/sql - - ./docker/init-invidious-db.sh:/docker-entrypoint-initdb.d/init-invidious-db.sh - - ./docker/pg-tune.sql:/docker-entrypoint-initdb.d/pg-tune.sql - - ./docker/pgstat.sql:/tmp/pgstat.sql - - ./docker/pg-cleanup.sql:/tmp/pgcleanup.sql - healthcheck: - test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"] - interval: 5m - timeout: 15s - retries: 2 - networks: - invidious_proxy: - ipv4_address: 192.42.6.10 - - invidious-proxy: - profiles: ["web"] - image: 1337kavin/ytproxy:latest - container_name: invidious_proxy - cpus: "4" - mem_reservation: "256m" - mem_limit: "512m" - restart: "unless-stopped" - user: 33:33 - network_mode: "host" - environment: - - DISABLE_WEBP=1 - volumes: - - /srv/ytproxy:/app/socket - - invidious-haproxy: - profiles: ["web"] - image: haproxytech/haproxy-alpine:latest - container_name: invidious_haproxy - cpus: "3" - mem_reservation: "64m" - mem_limit: "128m" - restart: "unless-stopped" - volumes: - - ./docker/haproxy:/usr/local/etc/haproxy:ro - networks: - invidious_proxy: - ipv4_address: 192.42.6.30 - + ipv4_address: 192.42.6.201 networks: invidious_proxy: + enable_ipv6: true external: true diff --git a/docker/haproxy/haproxy.cfg b/docker/haproxy/haproxy.cfg deleted file mode 100644 index accdefa..0000000 --- a/docker/haproxy/haproxy.cfg +++ /dev/null @@ -1,31 +0,0 @@ -global - stats socket /var/run/api.sock user haproxy group haproxy mode 660 level admin expose-fd listeners - log stdout format raw local0 notice - -defaults - log global - mode http - option httplog - option dontlognull - timeout connect 5s - timeout client 10s - timeout server 10s - timeout http-request 10s - - - -frontend invidious - log stdout format raw local0 emerg - bind *:80 - mode http - default_backend proxies - -backend proxies - balance leastconn - http-reuse always - http-request set-header Proxy-Authorization Basic\ base64_here - # Normal proxies go here - server proxy_normal_1 ipaddr_here check fall 3 rise 3 inter 15s observe layer7 error-limit 10 on-error mark-down sni hdr(host) - - # Add at least 1 backup proxy to shortly take over until the others have rotated their ips during YT blockage - server proxy_backup_1 ipaddr_here backup check fall 3 rise 3 inter 15s observe layer7 error-limit 10 on-error mark-down sni hdr(host) diff --git a/docker/userlist.txt b/docker/userlist.txt deleted file mode 100644 index 72cac7f..0000000 --- a/docker/userlist.txt +++ /dev/null @@ -1,2 +0,0 @@ -"pgbouncer" "" -"invidious" "" diff --git a/invidious.service b/invidious.service index 0f93b24..b71d75d 100644 --- a/invidious.service +++ b/invidious.service @@ -1,18 +1,16 @@ [Unit] -Description=Invidious (%i) -After=syslog.target -After=network.target -Requires=docker.service -After=docker.service +Description=Invidious +After=network.target postgresql@16-main.service redis.service +Requires=postgresql@16-main.service redis.service [Service] Restart=always RestartSec=15s -User=invidious -Group=invidious + WorkingDirectory=/srv/invidious -ExecStart=/usr/bin/docker compose --env-file .env --profile %i up -ExecStop=/usr/bin/docker compose --env-file .env --profile %i down + +ExecStart=/usr/bin/docker compose --env-file .env up +ExecStop=/usr/bin/docker compose --env-file .env down [Install] WantedBy=multi-user.target diff --git a/nginx/sites-enabled/invidious.vhost b/nginx/sites-enabled/invidious.vhost index 513428b..7656e5d 100644 --- a/nginx/sites-enabled/invidious.vhost +++ b/nginx/sites-enabled/invidious.vhost @@ -1,505 +1,169 @@ upstream invidious { - least_conn; server 192.42.6.2:3000 fail_timeout=3s; - server 192.42.6.3:3000 fail_timeout=3s; - server 192.42.6.4:3000 fail_timeout=3s; - server 192.42.6.5:3000 fail_timeout=3s; - server 192.42.6.6:3000 fail_timeout=3s; - server 192.42.6.7:3000 fail_timeout=3s; - keepalive 30; + keepalive 21; } -upstream invidious_worker { - server 192.42.6.9:3000; - keepalive 1; -} - -upstream invidious_proxy { - server unix:/srv/ytproxy/http-proxy.sock; - keepalive 6; -} - -upstream invidious_tor { - server 192.42.6.8:3000; - keepalive 2; -} - -upstream ryd_proxy { - server 192.42.6.14:3000; - keepalive 3; -} - -upstream invidious_sync { - server 192.42.6.15:80; - keepalive 3; -} - -upstream invidious_peer { - server 192.42.6.19:9000; - keepalive 3; +# This is routed over a HAProxy that looks for the cookie +upstream invidious_companion { + server 192.42.6.1:8118 fail_timeout=3s; } map $upstream_addr $server_instance { - default "invidious"; - 192.42.6.2:3000 "invidious_1"; - 192.42.6.3:3000 "invidious_2"; - 192.42.6.4:3000 "invidious_3"; - 192.42.6.5:3000 "invidious_4"; - 192.42.6.6:3000 "invidious_5"; - 192.42.6.7:3000 "invidious_6"; + default "invidious"; } -# I use this line to switch to a testing instance of invidious when I test a new docker image geo $upstream_server { - default invidious; + default invidious; } -# Toggle to switch between using team piped ytproxy or invidious to server google asssets and video stream -geo $ivproxy_server { - default invidious_proxy; - #default invidious; +map "$http_origin" $cors { + default ''; } -# The api is for internal access only -geo $api_invidious_access { - default 0; - - # locahost - 127.0.0.1/32 1; - - # Docker network - 192.42.0.0/16 1; -} - -# Access to feeds is rate limited except for google ips geo $feeds_whitelist { default 0; # CIDR in the list below are not limited - + # Google 8.34.208.0/20 1; - 8.35.192.0/20 1; - 23.236.48.0/20 1; - 23.251.128.0/19 1; - 34.0.0.0/15 1; - 34.2.0.0/16 1; - 34.3.0.0/23 1; - 34.3.3.0/24 1; - 34.3.4.0/24 1; - 34.3.8.0/21 1; - 34.3.16.0/20 1; - 34.3.32.0/19 1; - 34.3.64.0/18 1; - 34.4.0.0/14 1; - 34.8.0.0/13 1; - 34.16.0.0/12 1; - 34.32.0.0/11 1; - 34.64.0.0/10 1; - 34.128.0.0/10 1; - 35.184.0.0/13 1; - 35.192.0.0/14 1; - 35.196.0.0/15 1; - 35.198.0.0/16 1; - 35.199.0.0/17 1; - 35.199.128.0/18 1; - 35.200.0.0/13 1; - 35.208.0.0/12 1; - 35.224.0.0/12 1; - 35.240.0.0/13 1; - 64.15.112.0/20 1; - 64.233.160.0/19 1; - 66.22.228.0/23 1; - 66.102.0.0/20 1; - 66.249.64.0/19 1; - 70.32.128.0/19 1; - 72.14.192.0/18 1; - 74.125.0.0/16 1; - 104.154.0.0/15 1; - 104.196.0.0/14 1; - 104.237.160.0/19 1; - 107.167.160.0/19 1; - 107.178.192.0/18 1; - 108.59.80.0/20 1; - 108.170.192.0/18 1; - 108.177.0.0/17 1; - 130.211.0.0/16 1; - 142.250.0.0/15 1; - 146.148.0.0/17 1; - 162.216.148.0/22 1; - 162.222.176.0/21 1; - 172.110.32.0/21 1; - 172.217.0.0/16 1; - 172.253.0.0/16 1; - 173.194.0.0/16 1; - 173.255.112.0/20 1; - 193.186.4.0/24 1; - 199.36.154.0/23 1; - 199.36.156.0/24 1; - 199.192.112.0/22 1; - 199.223.232.0/21 1; - 207.223.160.0/20 1; - 208.65.152.0/22 1; - 208.68.108.0/22 1; - 208.81.188.0/22 1; - 208.117.224.0/19 1; - 209.85.128.0/17 1; - 216.58.192.0/19 1; - 216.73.80.0/20 1; - 216.239.32.0/19 1; - 2001:4860::/32 1; - 2404:6800::/32 1; - 2404:f340::/32 1; - 2600:1900::/28 1; - 2606:73c0::/32 1; - 2607:f8b0::/32 1; - 2620:11a:a000::/40 1; - 2620:120:e000::/40 1; - 2800:3f0::/32 1; - 2a00:1450::/32 1; - 2c0f:fb50::/32 1; + 8.35.192.0/20 1; + 23.236.48.0/20 1; + 23.251.128.0/19 1; + 34.0.0.0/15 1; + 34.2.0.0/16 1; + 34.3.0.0/23 1; + 34.3.3.0/24 1; + 34.3.4.0/24 1; + 34.3.8.0/21 1; + 34.3.16.0/20 1; + 34.3.32.0/19 1; + 34.3.64.0/18 1; + 34.4.0.0/14 1; + 34.8.0.0/13 1; + 34.16.0.0/12 1; + 34.32.0.0/11 1; + 34.64.0.0/10 1; + 34.128.0.0/10 1; + 35.184.0.0/13 1; + 35.192.0.0/14 1; + 35.196.0.0/15 1; + 35.198.0.0/16 1; + 35.199.0.0/17 1; + 35.199.128.0/18 1; + 35.200.0.0/13 1; + 35.208.0.0/12 1; + 35.224.0.0/12 1; + 35.240.0.0/13 1; + 64.15.112.0/20 1; + 64.233.160.0/19 1; + 66.22.228.0/23 1; + 66.102.0.0/20 1; + 66.249.64.0/19 1; + 70.32.128.0/19 1; + 72.14.192.0/18 1; + 74.125.0.0/16 1; + 104.154.0.0/15 1; + 104.196.0.0/14 1; + 104.237.160.0/19 1; + 107.167.160.0/19 1; + 107.178.192.0/18 1; + 108.59.80.0/20 1; + 108.170.192.0/18 1; + 108.177.0.0/17 1; + 130.211.0.0/16 1; + 142.250.0.0/15 1; + 146.148.0.0/17 1; + 162.216.148.0/22 1; + 162.222.176.0/21 1; + 172.110.32.0/21 1; + 172.217.0.0/16 1; + 172.253.0.0/16 1; + 173.194.0.0/16 1; + 173.255.112.0/20 1; + 193.186.4.0/24 1; + 199.36.154.0/23 1; + 199.36.156.0/24 1; + 199.192.112.0/22 1; + 199.223.232.0/21 1; + 207.223.160.0/20 1; + 208.65.152.0/22 1; + 208.68.108.0/22 1; + 208.81.188.0/22 1; + 208.117.224.0/19 1; + 209.85.128.0/17 1; + 216.58.192.0/19 1; + 216.73.80.0/20 1; + 216.239.32.0/19 1; + 2001:4860::/32 1; + 2404:6800::/32 1; + 2404:f340::/32 1; + 2600:1900::/28 1; + 2606:73c0::/32 1; + 2607:f8b0::/32 1; + 2620:11a:a000::/40 1; + 2620:120:e000::/40 1; + 2800:3f0::/32 1; + 2a00:1450::/32 1; + 2c0f:fb50::/32 1; } map $feeds_whitelist $feeds_limit { - 0 ""; - 1 $binary_remote_addr; + 0 ""; + 1 $binary_remote_addr; } -# Limit login to prevent bruteforce -limit_req_zone $binary_remote_addr zone=invidious_login:5m rate=2r/s; -# Limit global requests to prevent DoS +limit_req_zone $binary_remote_addr zone=invidious_login:5m rate=5r/m; limit_req_zone $binary_remote_addr zone=invidious_requests:5m rate=5r/s; - -# Limit webfeed hook limit_req_zone $feeds_limit zone=invidious_feeds:5m rate=3r/s; -####### -# HTTP -####### - server { - listen 80; - listen [::]:80; + listen 80; + listen [::]:80; - server_name invidious.nerdvpn.de www.invidious.nerdvpn.de; + server_name invidious.nerdvpn.de www.invidious.nerdvpn.de; root /srv/nginx/public/invidious; - location /.well-known/acme-challenge/ { - allow all; - default_type "text/plain"; - alias /srv/nginx/public/acme/; - } - - location / { - return 301 https://invidious.nerdvpn.de$request_uri; - } -} -server { - listen 80; - listen [::]:80; - - server_name api.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; + include snippets/malicious.conf; location /.well-known/acme-challenge/ { - allow all; - default_type "text/plain"; - alias /srv/nginx/public/acme/; - } + allow all; + default_type "text/plain"; + alias /srv/nginx/public/acme/; + } - location / { - return 301 https://$host$request_uri; - } + location / { + return 301 https://invidious.nerdvpn.de$request_uri; + } } -server { - listen 80; - listen [::]:80; - - server_name ryd.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; - - location /.well-known/acme-challenge/ { - allow all; - default_type "text/plain"; - alias /srv/nginx/public/acme/; - } - - location / { - return 301 https://$host$request_uri; - } -} -server { - listen 80; - listen [::]:80; - - server_name sync.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; - - location /.well-known/acme-challenge/ { - allow all; - default_type "text/plain"; - alias /srv/nginx/public/acme/; - } - - location / { - return 301 https://$host$request_uri; - } -} -server { - listen 80; - listen [::]:80; - - server_name peer.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; - - location /.well-known/acme-challenge/ { - allow all; - default_type "text/plain"; - alias /srv/nginx/public/acme/; - } - - location / { - return 301 https://$host$request_uri; - } -} - -######## -# HTTPS -######## server { listen 443 ssl; - listen [::]:443 ssl; - - http2 on; - - server_name api.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; - - ssl_session_cache shared:nginx_TLS_api_invidious:5m; - - add_header X-Robots-Tag "none"; - - ssl_certificate /srv/letsencrypt/certs/api.invidious.nerdvpn.de/fullchain.pem; - ssl_certificate_key /srv/letsencrypt/certs/api.invidious.nerdvpn.de/privkey.pem; - include snippets/htst.conf; - - access_log off; - error_log /dev/null emerg; - - include snippets/malicious.conf; - - proxy_hide_header Access-Control-Allow-Origin; - add_header Access-Control-Allow-Credentials true; - add_header Access-Control-Allow-Origin "https://materialious.nerdvpn.de" always; - add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, HEAD, PATCH, PUT, DELETE" always; - add_header Access-Control-Allow-Headers "User-Agent, Authorization, Content-Type" always; - - location = /favicon.ico { - allow all; - } - - location = /robots.txt { - add_header Content-Type text/plain; - return 200 "User-agent: *\nDisallow: /"; - } - - location = /css/default.css { - root /srv/nginx/public/invidious; - } - - limit_rate 6000k; - - location / { - if ($api_invidious_access != 1) { - return 302 "https://invidious.nerdvpn.de$request_uri"; - } - - if ($request_method = OPTIONS) { - return 204; - } - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - - proxy_pass http://$upstream_server; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } - location ~ /(css|js|fonts|login|authorize_token|api) { - if ($request_method = OPTIONS) { - return 204; - } - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - - proxy_pass http://$upstream_server; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } -} -server { - listen 443 ssl; - listen [::]:443 ssl; - - http2 on; - - server_name ryd.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; - - ssl_session_cache shared:nginx_TLS_ryd:5m; - - add_header X-Robots-Tag "none"; - - ssl_certificate /srv/letsencrypt/certs/ryd.invidious.nerdvpn.de/fullchain.pem; - ssl_certificate_key /srv/letsencrypt/certs/ryd.invidious.nerdvpn.de/privkey.pem; - include snippets/htst.conf; - - access_log off; - error_log /dev/null emerg; - - include snippets/malicious.conf; - - location = /favicon.ico { - allow all; - } - - location = /robots.txt { - add_header Content-Type text/plain; - return 200 "User-agent: *\nDisallow: /"; - } - - limit_rate 6000k; - - location / { - add_header Access-Control-Allow-Origin "https://materialious.nerdvpn.de" always; - add_header Access-Control-Allow-Methods "GET, OPTIONS" always; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_pass http://ryd_proxy; - } -} -server { - listen 443 ssl; - listen [::]:443 ssl; - - http2 on; - - server_name sync.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; - - ssl_session_cache shared:nginx_TLS_sync:5m; - - add_header X-Robots-Tag "none"; - - ssl_certificate /srv/letsencrypt/certs/sync.invidious.nerdvpn.de/fullchain.pem; - ssl_certificate_key /srv/letsencrypt/certs/sync.invidious.nerdvpn.de/privkey.pem; - include snippets/htst.conf; - - access_log off; - error_log /dev/null emerg; - - include snippets/malicious.conf; - - location = /favicon.ico { - allow all; - } - - location = /robots.txt { - add_header Content-Type text/plain; - return 200 "User-agent: *\nDisallow: /"; - } - - limit_rate 6000k; - - location / { - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_pass http://invidious_sync; - } -} -server { - listen 443 ssl; - listen [::]:443 ssl; - - http2 on; - - server_name peer.invidious.nerdvpn.de; - root /srv/nginx/public/invidious; - - ssl_session_cache shared:nginx_TLS_peer:5m; - - add_header X-Robots-Tag "none"; - - ssl_certificate /srv/letsencrypt/certs/peer.invidious.nerdvpn.de/fullchain.pem; - ssl_certificate_key /srv/letsencrypt/certs/peer.invidious.nerdvpn.de/privkey.pem; - include snippets/htst.conf; - - access_log off; - error_log /dev/null emerg; - - include snippets/invidious-errorpages.conf; - - location = /favicon.ico { - allow all; - } - - location = /robots.txt { - add_header Content-Type text/plain; - return 200 "User-agent: *\nDisallow: /"; - } - - limit_rate 6000k; - - location / { - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header "Connection" ""; - - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_pass http://invidious_peer; - } -} - -server { - listen 443 ssl; - listen [::]:443 ssl; + listen [::]:443 ssl; http2 on; server_name www.invidious.nerdvpn.de; root /srv/nginx/public/invidious; - - ssl_certificate /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem; - ssl_certificate_key /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem; + + include snippets/malicious.conf; + + ssl_certificate /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem; + ssl_certificate_key /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem; include snippets/htst.conf; access_log off; error_log /dev/null emerg; - - location / { - return 301 https://invidious.nerdvpn.de$request_uri; - } + + location / { + return 301 https://invidious.nerdvpn.de$request_uri; + } } server { - listen 443 ssl; + listen 443 ssl; listen 443 default_server quic reuseport; - listen [::]:443 ssl; + listen [::]:443 ssl; listen [::]:443 default_server quic reuseport; http2 on; @@ -508,7 +172,7 @@ server { server_name invidious.nerdvpn.de; root /srv/nginx/public/invidious; - + add_header Alt-Svc 'h3=":443"; ma=86400'; add_header X-server-instance $server_instance always; add_header X-server-proto $server_protocol always; @@ -516,213 +180,132 @@ server { ssl_session_cache shared:nginx_TLS_invidious:10m; - add_header X-Robots-Tag "noindex, nofollow, noai, noimageai"; + add_header X-Robots-Tag "index, follow, noai, noimageai"; - ssl_certificate /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem; - ssl_certificate_key /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem; + ssl_certificate /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem; + ssl_certificate_key /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem; include snippets/htst.conf; access_log off; error_log /dev/null emerg; + + include snippets/invidious_errorpages.conf; + include snippets/malicious.conf; - include snippets/malicious.conf; - - limit_rate 6000k; + limit_rate 4000k; - location = /favicon.ico { - include /etc/nginx/bots.d/ddos.conf; - allow all; - } - - location = /robots.txt { - add_header Content-Type text/plain; - return 200 "User-agent: GPTBot\nDisallow: /\nUser-agent: ChatGPT-User\nDisallow: /\nUser-agent: FacebookBot\nDisallow: /\nUser-agent: archive.org_bot\nDisallow: /\nUser-agent: Amazonbot\nDisallow: /\nUser-agent: *\nDisallow:"; - } - - error_page 503 @maintenance; + include snippets/favicon.conf; + include snippets/robots.conf; + + error_page 503 @maintenance; location @maintenance { - root /srv/nginx/public/maintenance/; - rewrite ^ "/index.html" break; - } - - location /api/v1/stats { - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_pass http://invidious/api/v1/stats; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + auth_request off; + root /srv/nginx/public/maintenance/; + rewrite ^ "/index.html" break; + } + location = /css/default.css { + auth_request off; + root /srv/nginx/public/invidious; } location ~ (^/feed/webhook) { + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + auth_request off; limit_req zone=invidious_feeds burst=240 delay=80; + #access_log /var/log/nginx/access/invidious.webfeed.log; + #error_log /var/log/nginx/errors/invidious.webfeed.log error; proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_pass http://invidious_worker; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Connection ""; + proxy_pass http://invidious; + } + location /.within.website/ { + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_pass http://anubis; + proxy_pass_request_body off; + proxy_set_header content-length ""; + auth_request off; + } + location @redirectToAnubis { + return 307 /.within.website/?redir=$request_uri; + auth_request off; } location / { + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + limit_req zone=invidious_requests burst=240 delay=80; - - if ($invidious_access != 1) { - return 503; - } + + if ($invidious_access != 1) { + return 503; + } if ($request_method = OPTIONS) { return 204; - } - - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_pass http://$upstream_server; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; } - # video streaming and downloads - location ~ (^/videoplayback) { - limit_req zone=invidious_requests burst=240 delay=80; + auth_request /.within.website/x/cmd/anubis/api/check; + error_page 401 = @redirectToAnubis; - # Limit user video streaming to 32 MBit/s - limit_rate 4000k; - - proxy_set_header X-Forwarded-For ""; - proxy_set_header CF-Connecting-IP ""; - proxy_hide_header "alt-svc"; - - sendfile on; - sendfile_max_chunk 512k; - tcp_nopush on; - aio threads=default; - aio_write on; - directio 16m; - - proxy_hide_header Cache-Control; - proxy_hide_header etag; - proxy_set_header Connection keep-alive; - proxy_max_temp_file_size 32m; - - proxy_http_version 1.1; - proxy_pass http://$ivproxy_server; - add_header Cache-Control private always; - } - # static assets from yt - location ~ (^/vi/|^/ggpht/) { - limit_req zone=invidious_requests burst=240 delay=80; - limit_rate 8000k; - - proxy_set_header X-Forwarded-For ""; - proxy_set_header CF-Connecting-IP ""; - proxy_hide_header "alt-svc"; - - sendfile on; - sendfile_max_chunk 512k; - tcp_nopush on; - aio threads=default; - aio_write on; - directio 16m; - - proxy_hide_header Cache-Control; - proxy_hide_header etag; - proxy_set_header Connection keep-alive; - proxy_max_temp_file_size 32m; - - proxy_http_version 1.1; - proxy_pass http://$ivproxy_server; - add_header Cache-Control private always; - } - location ~ /(login) { - limit_req zone=invidious_login burst=4 nodelay; + #error_page 503 = @maintenance; proxy_http_version 1.1; - proxy_set_header "Connection" ""; + proxy_set_header Connection ""; proxy_pass http://$upstream_server; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; } - location ~ /(css|js|fonts|delete_account|data_control|subscription_manager) { - limit_req zone=invidious_requests burst=240 delay=80; - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_pass http://$upstream_server; + + # Maintenance routes + #location ~ /(login) { + # auth_request off; + # limit_req zone=invidious_login burst=4 nodelay; + # proxy_http_version 1.1; + # proxy_set_header Connection ""; + # proxy_pass http://invidious_zero; + #} + #location ~ /(css|js|fonts|delete_account|data_control|subscription_manager|signout) { + # auth_request off; + # limit_req zone=invidious_requests burst=240 delay=80; + # proxy_http_version 1.1; + # proxy_set_header Connection ""; + # proxy_pass http://invidious_zero; + #} + + # Companion routes + location /latest_version { proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } -} - -server { - listen unix:/var/run/invidious-tor.sock; - - server_name nerdvpneaggggfdiurknszkbmhvjndks5z5k3g5yp4nhphflh3n3boad.onion; - root /srv/nginx/public/invidious; - - add_header X-server-instance $server_instance always; - - access_log off; - error_log /dev/null emerg; - - error_page 503 @maintenance; - location @maintenance { - root /srv/nginx/public/maintenance/; - rewrite ^ "/index.html" break; - } - - location / { - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_pass http://invidious_tor; - proxy_set_header Host $host; - } - # video streaming - location ~ (^/videoplayback) { - proxy_set_header X-Forwarded-For ""; - proxy_set_header CF-Connecting-IP ""; - proxy_hide_header "alt-svc"; - - sendfile on; - sendfile_max_chunk 512k; - tcp_nopush on; - aio threads=default; - aio_write on; - directio 16m; - - proxy_hide_header Cache-Control; - proxy_hide_header etag; - proxy_set_header Connection keep-alive; - proxy_max_temp_file_size 32m; - - proxy_http_version 1.1; - proxy_pass http://$ivproxy_server; - add_header Cache-Control private always; - } - # assets from yt - location ~ (^/vi/|^/ggpht/) { - proxy_set_header X-Forwarded-For ""; - proxy_set_header CF-Connecting-IP ""; - proxy_hide_header "alt-svc"; - - sendfile on; - sendfile_max_chunk 512k; - tcp_nopush on; - aio threads=default; - aio_write on; - directio 16m; - - proxy_hide_header Cache-Control; - proxy_hide_header etag; - proxy_set_header Connection keep-alive; - proxy_max_temp_file_size 32m; - - proxy_http_version 1.1; - proxy_pass http://$ivproxy_server; - add_header Cache-Control private always; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_pass http://invidious_companion; + proxy_http_version 1.1; + proxy_set_header Connection ""; + } + location /api/manifest/dash/id/ { + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_pass http://invidious_companion; + proxy_http_version 1.1; + proxy_set_header Connection ""; + } + location /videoplayback { + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_pass http://invidious_companion; + proxy_http_version 1.1; + proxy_set_header Connection ""; } } diff --git a/patches/001-nerdvpn-branding.patch b/patches/001-nerdvpn-branding.patch index 03b8a42..9641bfb 100644 --- a/patches/001-nerdvpn-branding.patch +++ b/patches/001-nerdvpn-branding.patch @@ -1,5 +1,5 @@ diff --git a/src/invidious.cr b/src/invidious.cr -index e0bd0101..bf1a46d1 100644 +index 3804197e..0e051080 100644 --- a/src/invidious.cr +++ b/src/invidious.cr @@ -75,9 +75,9 @@ REQUEST_HEADERS_WHITELIST = {"accept", "accept-encoding", "cache-control", "con @@ -15,10 +15,19 @@ index e0bd0101..bf1a46d1 100644 # This is used to determine the `?v=` on the end of file URLs (for cache busting). We # only need to expire modified assets, so we can use this to find the last commit that changes diff --git a/src/invidious/views/template.ecr b/src/invidious/views/template.ecr -index 9904b4fc..14170acd 100644 +index 9904b4fc..769ab1e2 100644 --- a/src/invidious/views/template.ecr +++ b/src/invidious/views/template.ecr -@@ -147,7 +147,7 @@ +@@ -142,12 +142,16 @@ + + <%= translate(locale, "View privacy policy.") %> + ++ ++ ++ <%= translate(locale, "View terms of use.") %> ++ + +
diff --git a/patches/003-proxy-csp.patch b/patches/003-proxy-csp.patch deleted file mode 100644 index c6e8bf7..0000000 --- a/patches/003-proxy-csp.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 236a2c70d3974f5a1fc55a5bc8047ff24d94bce2 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?=C3=89milien=20Devos?= -Date: Tue, 16 Aug 2022 06:51:52 +0000 -Subject: [PATCH] more csp - ---- - src/invidious/routes/before_all.cr | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/src/invidious/routes/before_all.cr b/src/invidious/routes/before_all.cr -index 8e2a253f..5c7cc959 100644 ---- a/src/invidious/routes/before_all.cr -+++ b/src/invidious/routes/before_all.cr -@@ -23,9 +23,9 @@ module Invidious::Routes::BeforeAll - # Allow media resources to be loaded from google servers - # TODO: check if *.youtube.com can be removed - if CONFIG.disabled?("local") || !preferences.local -- extra_media_csp = " https://*.googlevideo.com:443 https://*.youtube.com:443" -+ extra_media_csp = " https://*.googlevideo.com:443 https://*.youtube.com:443 https://*.invidious.nerdvpn.de:443" - else -- extra_media_csp = "" -+ extra_media_csp = " https://*.invidious.nerdvpn.de:443" - end - - # Only allow the pages at /embed/* to be embedded -@@ -43,7 +43,7 @@ module Invidious::Routes::BeforeAll - "style-src 'self' 'unsafe-inline'", - "img-src 'self' data:", - "font-src 'self' data:", -- "connect-src 'self'", -+ "connect-src 'self' https://*.invidious.nerdvpn.de:443", - "manifest-src 'self'", - "media-src 'self' blob:" + extra_media_csp, - "child-src 'self' blob:", --- -2.36.1 - diff --git a/patches/004-donate-page.patch b/patches/004-donate-page.patch index 80afab3..8960ab0 100644 --- a/patches/004-donate-page.patch +++ b/patches/004-donate-page.patch @@ -64,8 +64,8 @@ index 00000000..0c7deecc +
+

Donate to NerdVPN.de

+

Why donating?

-+

In order to provide the best Invidious experience possible, I have rented a very powerful dedicated server with 16 cores, 48 GiB RAM and a 2 GBit/s unmetered network connection. I also use 3 different, fully e2e-encrypted backup locations with live replication and a zero-dataloss backup strategy. All of this has its cost.

-+

All donations will go directly into paying my monthly infrastructure costs (server, domain, backups).

++

In order to provide the best Invidious experience possible, I have rented a very powerful dedicated server with 16 cores, 48 GiB RAM and a 2 GBit/s unmetered network connection. On top of that are the multiple backends required to bypass blockage from YouTube. I also use 3 different, fully e2e-encrypted backup locations with live replication and a zero-dataloss backup strategy. All of this has a high cost.

++

All donations will go directly into paying my monthly infrastructure costs (server, domain, backends, backups).

+

Should the donations at any point fully cover the costs, I will invest the remaining directly into improving my infrastructure and thus improving the user experience.

+

Every little bit helps. Thank you very much for considering to donate!

+

Payment methods

@@ -81,7 +81,7 @@ index 00000000..0c7deecc +
  • Ethereum (ETH): 0xD1F7E3Bfb19Ee5a52baED396Ad34717aF18d995B
    • +
  • Litecoin (LTC): ltc1q8787aq2xrseq5yx52axx8c4fqks88zj5vr0zx9 + -+

    If you have any questions, feel free to contact me via matrix at: @weidenwiesel:matrix.org

    ++

    If you have any questions, feel free to contact me via matrix at: @weidenwiesel:nerdvpn.de

    +
    • \ No newline at end of file -- diff --git a/patches/010-use-redis-for-video-cache.patch b/patches/010-use-redis-for-video-cache.patch deleted file mode 100644 index 8c208de..0000000 --- a/patches/010-use-redis-for-video-cache.patch +++ /dev/null @@ -1,151 +0,0 @@ -From 7c4c24f829b4eeb8ca035b4a9d77eef53ca8aefa Mon Sep 17 00:00:00 2001 -From: Emilien Devos -Date: Sat, 10 Jun 2023 22:21:38 +0200 -Subject: [PATCH 1/1] use redis for video cache - ---- - shard.lock | 8 ++++++++ - shard.yml | 2 ++ - src/invidious.cr | 8 +++++++- - src/invidious/config.cr | 3 +++ - src/invidious/database/videos.cr | 16 +++++++++++++--- - src/invidious/videos.cr | 2 +- - 6 files changed, 34 insertions(+), 5 deletions(-) - -diff --git a/shard.lock b/shard.lock -index 397bd8bc..8c599d1b 100644 ---- a/shard.lock -+++ b/shard.lock -@@ -32,6 +32,10 @@ shards: - git: https://github.com/will/crystal-pg.git - version: 0.24.0 - -+ pool: -+ git: https://github.com/ysbaddaden/pool.git -+ version: 0.2.4 -+ - protodec: - git: https://github.com/iv-org/protodec.git - version: 0.1.5 -@@ -40,6 +44,10 @@ shards: - git: https://github.com/luislavena/radix.git - version: 0.4.1 - -+ redis: -+ git: https://github.com/stefanwille/crystal-redis.git -+ version: 2.9.1 -+ - spectator: - git: https://github.com/icy-arctic-fox/spectator.git - version: 0.10.4 -diff --git a/shard.yml b/shard.yml -index 367f7c73..c46e1c42 100644 ---- a/shard.yml -+++ b/shard.yml -@@ -28,6 +28,8 @@ dependencies: - athena-negotiation: - github: athena-framework/negotiation - version: ~> 0.1.1 -+ redis: -+ github: stefanwille/crystal-redis - - development_dependencies: - spectator: -diff --git a/src/invidious.cr b/src/invidious.cr -index 3804197e..e2d40597 100644 ---- a/src/invidious.cr -+++ b/src/invidious.cr -@@ -31,6 +31,7 @@ require "xml" - require "yaml" - require "compress/zip" - require "protodec/utils" -+require "redis" - - require "./invidious/database/*" - require "./invidious/database/migrations/*" -@@ -60,7 +61,12 @@ alias IV = Invidious - CONFIG = Config.load - HMAC_KEY = CONFIG.hmac_key - --PG_DB = DB.open CONFIG.database_url -+PG_DB = DB.open CONFIG.database_url -+REDIS_DB = Redis::PooledClient.new(unixsocket: CONFIG.redis_socket || nil, url: CONFIG.redis_url || nil, database: CONFIG.redis_db || 0, password: CONFIG.redis_auth || nil) -+ -+if REDIS_DB.ping -+ puts "Connected to redis" -+end - ARCHIVE_URL = URI.parse("https://archive.org") - PUBSUB_URL = URI.parse("https://pubsubhubbub.appspot.com") - REDDIT_URL = URI.parse("https://www.reddit.com") -diff --git a/src/invidious/config.cr b/src/invidious/config.cr -index c4ddcdb3..5b6c576c 100644 ---- a/src/invidious/config.cr -+++ b/src/invidious/config.cr -@@ -77,6 +77,11 @@ class Config - # Used for crawling channels: threads should check all videos uploaded by a channel - property full_refresh : Bool = false - -+ property redis_url : String? -+ property redis_socket : String? -+ property redis_auth : String? -+ property redis_db : Int32? -+ - # Jobs config structure. See jobs.cr and jobs/base_job.cr - property jobs = Invidious::Jobs::JobsConfig.new - -diff --git a/src/invidious/database/videos.cr b/src/invidious/database/videos.cr -index 695f5b33..776ef5b1 100644 ---- a/src/invidious/database/videos.cr -+++ b/src/invidious/database/videos.cr -@@ -10,7 +10,8 @@ module Invidious::Database::Videos - ON CONFLICT (id) DO NOTHING - SQL - -- PG_DB.exec(request, video.id, video.info.to_json, video.updated) -+ REDIS_DB.set(video.id, video.info.to_json, ex: 3600) -+ REDIS_DB.set(video.id + ":time", video.updated, ex: 3600) - end - - def delete(id) -@@ -19,7 +20,8 @@ module Invidious::Database::Videos - WHERE id = $1 - SQL - -- PG_DB.exec(request, id) -+ REDIS_DB.del(id) -+ REDIS_DB.del(id + ":time") - end - - def delete_expired -@@ -47,6 +49,14 @@ module Invidious::Database::Videos - WHERE id = $1 - SQL - -- return PG_DB.query_one?(request, id, as: Video) -+ if ((info = REDIS_DB.get(id)) && (time = REDIS_DB.get(id + ":time"))) -+ return Video.new({ -+ id: id, -+ info: JSON.parse(info).as_h, -+ updated: Time.parse(time, "%Y-%m-%d %H:%M:%S %z", Time::Location::UTC), -+ }) -+ else -+ return nil -+ end - end - end -diff --git a/src/invidious/videos.cr b/src/invidious/videos.cr -index 6d0cf9ba..dde35291 100644 ---- a/src/invidious/videos.cr -+++ b/src/invidious/videos.cr -@@ -400,7 +400,7 @@ def get_video(id, refresh = true, region = nil, force_refresh = false) - video.schema_version != Video::SCHEMA_VERSION # cache control - begin - video = fetch_video(id, region) -- Invidious::Database::Videos.update(video) -+ Invidious::Database::Videos.insert(video) - rescue ex - Invidious::Database::Videos.delete(id) - raise ex --- -2.46.0 - diff --git a/patches/014-rewrite-obnoxious-blocked-message.patch b/patches/014-rewrite-obnoxious-blocked-message.patch index 7bb52ee..bfc0967 100644 --- a/patches/014-rewrite-obnoxious-blocked-message.patch +++ b/patches/014-rewrite-obnoxious-blocked-message.patch @@ -7,8 +7,8 @@ index b2df682d..7534ef31 100644 locale = env.get("preferences").as(Preferences).locale - error_message = translate(locale, message) -+ if message == "This helps protect our community. Learn more" -+ error_message = "

    Instance is blocked temporarily

    This instance uses proxies to bypass blockage from YouTube.
    Right now, all of those proxies are blocked.

    Please wait for up to two minutes until the automated background script has sucessfully rotated the proxies and refresh this site afterwards.

    Please don't spam the refresh button, this won't make the process faster.

    Please don't report this issue on github, we already know.

    " ++ if message.includes?("This helps protect our community") || message.includes?("Watch on the latest version of YouTube") || message.includes?("Sign in to confirm you’re not a bot") || message.includes?("Please sign in") || message.includes?("This content isn't available, try again later") ++ error_message = "

    Error loading video

    Received error from YouTube: " + message + "

    Please try reloading the page or try switching to another backend.

    " + else + error_message = translate(locale, message) + end diff --git a/scripts/deploy-database.sh b/scripts/deploy-database.sh index f61113c..6dd1c6c 100755 --- a/scripts/deploy-database.sh +++ b/scripts/deploy-database.sh @@ -18,7 +18,7 @@ sudo systemctl start postgresql.service sudo systemctl enable postgresql.service # -# Create databse and user +# Create database and user # if [ "$interactive" = "true" ]; then @@ -56,5 +56,6 @@ if [ "$interactive" = "true" ]; then echo echo "host invidious invidious 127.0.0.1/32 md5" echo "host invidious invidious ::1/128 md5" + echo "host invidious invidious 192.42.6.0/24 md5" echo fi