Change to multiple backends

.env

@@ -1,33 +1,16 @@
+# I change the compose so often, it needs to ignore orphaned containers
+COMPOSE_IGNORE_ORPHANS=True
+
 # Invidious
-INV_CPU_CORES=1
+INV_CPU_CORES=4
-INV_MEM_LIMIT="768m"
+INV_MEM_LIMIT="1280m"
-INV_MEM_RESERVATION="512m"
+INV_MEM_SWAP="2048m"
 INV_IMAGE="invidious-nerdvpn:latest"
 INV_RESTART_POLICY="unless-stopped"
+INV_HEALTHCHECK_URL="api/v1/stats"
+BANNER_MSG="<p style='font-size:0.75em; text-align:center;'>YOUR BANNER MSG HERE</p>"
 
-INV_HEALTHCHECK_URL="watch?v=jNQXAC9IVRw"
+# Companion
-
+COMP_CPU_CORES=4
-BANNER_MSG="<p style='font-size:0.75em; text-align:center;'></p>"
+COMP_MEM_LIMIT="1536m"
-
+COMP_MEM_SWAP="2048m"
-# PSQL
-POSTGRES_DB="invidious"
-POSTGRES_USER="invidious"
-POSTGRES_PASSWORD=""
-
-INV_PSQL_CPU_CORES=6
-INV_PSQL_MEM_LIMIT="8448m"
-INV_PSQL_MEM_RESERVATION="6400m"
-INV_PSQL_IMAGE="docker.io/library/postgres:14"
-
-# Materialious
-VITE_DEFAULT_INVIDIOUS_INSTANCE="https://api.invidious.nerdvpn.de"
-VITE_DEFAULT_RETURNYTDISLIKES_INSTANCE="https://ryd.invidious.nerdvpn.de"
-VITE_DEFAULT_FRONTEND_URL="https://materialious.nerdvpn.de"
-VITE_DEFAULT_SPONSERBLOCK_INSTANCE="https://sponsor.ajay.app"
-VITE_DEFAULT_DEARROW_INSTANCE=""
-VITE_DEFAULT_DEARROW_THUMBNAIL_INSTANCE=""
-VITE_DEFAULT_SYNCIOUS_INSTANCE="https://sync.invidious.nerdvpn.de"
-VITE_DEFAULT_PEERJS_HOST="peer.invidious.nerdvpn.de"
-VITE_DEFAULT_PEERJS_PATH="/"
-VITE_DEFAULT_PEERJS_PORT=443
-VITE_DEFAULT_SETTINGS='{"region": "DE", "darkMode": false, "themeColor": "#FFB81C", "autoPlay": true, "alwaysLoop": false, "proxyVideos": false, "listenByDefault": false, "savePlaybackPosition": true, "dashEnabled": false, "theatreModeByDefault": false, "autoplayNextByDefault": true, "returnYtDislikes": true, "searchSuggestions": true, "previewVideoOnHover": false, "sponsorBlock": true, "sponsorBlockCategories": "sponsor,interaction,selfpromo", "deArrowEnabled": false, "playerMiniPlayer": true, "syncious": true}'

README.md

@@ -5,39 +5,49 @@ Theme for my instance is based on: https://github.com/Tsyron/Invidious-Theme
 
 Original repo at: https://github.com/iv-org/invidious
 
-Based upon patches from: https://github.com/yewtudotbe/invidious-custom
+Based upon patches from: 
+https://github.com/yewtudotbe/invidious-custom
+https://git.nadeko.net/Fijxu/invidious
 
+<<<<<<< HEAD
 # IMPORTANT
 The instructions below are outdated.
 YouTube is currently quadrupling down on trying to block Invidious instances, so there are almost daily changes to my server setup.
 I haven't found the time yet to provide new/better instructions, so the instructions below should be taken with some grain of salt.
+=======
+# Requirements - you need to set this up before running my fork
+1. HAProxy 2.x either run on the host or added to the docker-compose.yaml with my config under `etc/haproxy/haproxy.cfg`
+2. PostgreSQL 16 server either run on the host or added to the docker-compose.yaml
+3. (optional bvut highly recommended) PGBouncer to pool the connections to PostgreSQL. You'll otherwise run into lots of db pool errors under high loads
+4. Nginx with my configs under etc/nginx
+5. Valid ssl certificate for your domain. I recommend using dehydrated: https://github.com/dehydrated-io/dehydrated
+6. Docker compose V2
+>>>>>>> 9de2789 (Change to multiple backends)
 
 # Build instructions
 
+Do this in a separate dir (for example /srv/invidious) under non-root permissions
+
 1. `git clone https://github.com/Sommerwiesel/invidious-nerdvpn .`
 2. `git clone https://github.com/iv-org/invidious build`
-3. `./patch.sh`
+3. `git clone https://github.com/iv-org/invidious-companion companion`
-4. `./build.sh development` for the development image or `./build.sh release` for the production image
+4. Modify the patches under invidious-nerdvpn/patches to your needs (i.e. change branding) and then run `./patch.sh`
+5. `./build.sh development` for the development image or `./build.sh release` for the production image
+6. `build.sh companion` to build the invidious companion
 
 # Update instructions
 
-- Simply run `./update.sh`
+1. Run  `./revert.sh` to remove all patches
+2. Update both repos (build and companion) via `git pull`
+3. Run the steps 5 and 6 again fro mthe run instructions
 
 # Run instructions (docker compose)
 
-- For the database: `docker compose --profile database up -d`
+- Simply run `docker compose up -d`
-- For the worker: `docker compose --profile worker up -d` 
-- For the web client: `docker compose --profile web up -d`
-- For the tor web client: `docker compose --profile tor up -d`
-- For materialious: `docker compose --profile materialious up -d`
 
 # Run instructions (systemd)
 
 First copy the invidious.service to /etc/systemd/system/
 
-- For the database: `systemctl enable --now invidious@database.service`
+- Enable and start with: `systemctl enable --now invidious.service`
-- For the worker: `systemctl enable --now invidious@worker.service` 
-- For the web client: `systemctl enable --now invidious@web.service`
-- For the tor web client: `systemctl enable --now invidious@tor.service`
-- For materialious: `systemctl enable --now invidious@materialious.service`
 

build.sh

@@ -6,14 +6,18 @@ if [ $# -eq 0 ]; then
 fi
 
 mode=$1
-
+export COMPOSE_BAKE=true
 
 if [ "$mode" == "release" ]; then
-        docker compose --profile base build --build-arg release=1
+        docker compose --profile base build invidious-base --build-arg release=1
 fi
 
 if [ "$mode" == "development" ]; then
-        docker compose --profile base build --build-arg release=0
+        docker compose --profile base build invidious-base --build-arg release=0
+fi
+
+if [ "$mode" == "companion" ]; then
+        docker compose build "invidious-companion-3" --build-arg release=0
 fi
 
 yes | docker system prune

docker-compose.yml

@@ -1,128 +1,90 @@
-x-volumes: &volumes
+x-defaults: &defaults
   volumes:
     - /var/run/redis/redis-server.sock:/invidious/redis-server.sock:rw
+  labels:
+    - "com.centurylinklabs.watchtower.enable=false"
+services: 
 
-services:
+  invidious-base:
-  
+    <<: *defaults 
-  # This service is for building the base image (patch.sh && build.sh)
-  invidious:
-    <<: *volumes
     env_file:
       - .env
     profiles: ["base"]
-    cpus: ${INV_CPU_CORES}
+    cpus: 16
     mem_limit: "${INV_MEM_LIMIT}"
-    mem_reservation: "${INV_MEM_RESERVATION}"
+    memswap_limit: "${INV_MEM_SWAP}"
-    image: "${INV_IMAGE}"
+    image: invidious-nerdvpn:latest
     build:
       context: build
       dockerfile: docker/Dockerfile 
     restart: "${INV_RESTART_POLICY}"
     environment: &environment
       INVIDIOUS_CONFIG: |
-        #force_resolve: ipv6
+        force_resolve: ipv6
+        invidious_companion:
+        # IPv6
+        - private_url: "http://invidious-companion-1:8282"
+          public_url: "https://invidious.nerdvpn.de"
+          note: "- EU, NL"
+        - private_url: "http://invidious-companion-2:8282"
+          public_url: "https://invidious.nerdvpn.de"
+          note: "- EU, DE"
+        - private_url: "http://invidious-companion-3:8282"
+          public_url: "https://invidious.nerdvpn.de"
+          note: "- EU, FR"
+        - private_url: "http://invidious-companion-4:8282"
+          public_url: "https://invidious.nerdvpn.de"
+          note: "- US 1"
+        - private_url: "http://invidious-companion-5:8282"
+          public_url: "https://invidious.nerdvpn.de"
+          note: "- US 2"
+        - private_url: "http://invidious-companion-6:8282"
+          public_url: "https://invidious.nerdvpn.de"
+          note: "- CA"
+        - private_url: "http://invidious-companion-7:8282"
+          public_url: "https://invidious.nerdvpn.de"
+          note: "- UK"
+        - private_url: "http://invidious-companion-8:8282"
+          public_url: "https://invidious.nerdvpn.de"
+          note: "- AU"
+        # IPv4 (currently too expensive, so disabled) 
+        #- private_url: "http://invidious-proxy-1:8282"
+        #  public_url: "https://invidious.nerdvpn.de"
+        #  note: "- Main, EU"
+        #- private_url: "http://invidious-proxy-2:8282"
+        #  public_url: "https://invidious.nerdvpn.de"
+        #  note: "- Main, US"
+        invidious_companion_key: ""
+        backend_name_prefix: ""
         modified_source_code_url: "https://github.com/Sommerwiesel/invidious-nerdvpn"
         hmac_key: 
         db:
           dbname: invidious
           user: invidious
           password: 
-          host: invidious-pgbouncer
+          host: 192.42.6.1
-          port: 5432
+          port: 6432
         redis_socket: "/invidious/redis-server.sock"
         redis_db: 4 
         redis_auth: ""
-        http_proxy:
-          host: "192.42.6.30"
-          port: 80
-        check_tables: true
-        external_port: 443
-        domain: "invidious.nerdvpn.de"
-        https_only: true
-        hsts: true
-        pool_size: 60
-        disable_proxy: ["local"]
-        log_level: "Fatal"
-        popular_enabled: true
-        statistics_enabled: true
-        enable_user_notifications: false
-        channel_threads: 0
-        feed_threads: 0
-        use_pubsub_feeds: false
-        banner: "${BANNER_MSG}"
-        jobs:
-          clear_expired_items:
-            enable: false
-          refresh_channels:
-            enable: false
-          refresh_feeds:
-            enable: false 
-        default_user_preferences:
-          locale: "de"
-          region: "DE"
-          captions: ["","English","English (auto-generated)"]
-          dark_mode: "dark"
-          feed_menu: ["Trending", "Subscriptions", "Playlists", "Search"]
-          default_home: "Search"
-          comments: ["youtube", ""]
-          autoplay: true
-          continue_autoplay: true
-          quality: "hd720"
-          quality_dash: "720p"
-          unseen_only: true
-          local: false
-          automatic_instance_redirect: true
-    networks:
-      invidious_proxy:
-    healthcheck:
-      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1
-      interval: 5m
-      retries: 2
-
-  # Takes care of refreshing the feeds
-  invidious_worker:
-    <<: *volumes
-    env_file:
-      - .env
-    profiles: ["worker"]
-    container_name: invidious_worker
-    cpus: ${INV_CPU_CORES}
-    mem_limit: "1536m"
-    mem_reservation: "768m"
-    image: "${INV_IMAGE}"
-    restart: "${INV_RESTART_POLICY}"
-    environment:
-      INVIDIOUS_CONFIG: |
-        #force_resolve: ipv6
-        modified_source_code_url: "https://github.com/Sommerwiesel/invidious-nerdvpn"
-        hmac_key: 
-        db:
-          dbname: invidious
-          user: invidious
-          password: 
-          host: invidious-pgbouncer
-          port: 5432
-        redis_socket: "/invidious/redis-server.sock"
-        redis_db: 4 
-        redis_auth: ""
-        http_proxy:
-          host: "192.42.6.30"
-          port: 80
         check_tables: true
         external_port: 443
         domain: "invidious.nerdvpn.de"
         https_only: true
         hsts: true
         pool_size: 100
-        disable_proxy: ["livestreams","local"]
+        disable_proxy: ["livestreams","local","dash","downloads"]
-        log_level: "Fatal"
+        log_level: "Error"
         popular_enabled: true
         statistics_enabled: true
+        admins: [""]
         enable_user_notifications: false
         channel_threads: 4
-        feed_threads: 4
+        channel_refresh_interval: "120m"
-        channel_refresh_interval: "15m"
         use_pubsub_feeds: true
+        feed_threads: 4
+        banner: "${BANNER_MSG}"
+        use_innertube_for_captions: true
         default_user_preferences:
           locale: "de"
           region: "DE"
@@ -138,24 +100,293 @@ services:
           unseen_only: true
           local: false
           automatic_instance_redirect: true
+          hide_shorts: false
     networks:
       invidious_proxy:
-        ipv4_address: 192.42.6.9
-    healthcheck:
-      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1
-      interval: 3m
-      timeout: 5s
-      retries: 2
 
-  invidious_1:
+  invidious-companion-1:
-    <<: *volumes
+    container_name: invidious-companion-1
+    cpus: ${COMP_CPU_CORES}
+    mem_limit: "${COMP_MEM_LIMIT}"
+    memswap_limit: "${COMP_MEM_SWAP}"
+    #image: quay.io/invidious/invidious-companion:latest
+    image: invidious-companion-nerdvpn:latest
+    build:
+      context: companion
+      dockerfile: Dockerfile 
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    environment:
+       - SERVER_SECRET_KEY=
+       - PROXY=
+       - SERVER_ENABLE_METRICS=false
+    restart: unless-stopped
+    cap_drop:
+      - ALL
+    read_only: true
+    volumes:
+      - /srv/invidious/cache/1:/var/tmp/youtubei.js:rw
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      invidious_proxy:
+        ipv4_address: 192.42.6.11
+  
+  invidious-companion-2:
+    container_name: invidious-companion-2
+    cpus: ${COMP_CPU_CORES}
+    mem_limit: "${COMP_MEM_LIMIT}"
+    memswap_limit: "${COMP_MEM_SWAP}"
+    #image: quay.io/invidious/invidious-companion:latest
+    image: invidious-companion-nerdvpn:latest
+    build:
+      context: companion
+      dockerfile: Dockerfile 
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    environment:
+       - SERVER_SECRET_KEY=
+       - PROXY=
+       - SERVER_ENABLE_METRICS=false
+    restart: unless-stopped
+    cap_drop:
+      - ALL
+    read_only: true
+    volumes:
+      - /srv/invidious/cache/2:/var/tmp/youtubei.js:rw
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      invidious_proxy:
+        ipv4_address: 192.42.6.12
+  
+  invidious-companion-3:
+    container_name: invidious-companion-3
+    cpus: ${COMP_CPU_CORES}
+    mem_limit: "${COMP_MEM_LIMIT}"
+    memswap_limit: "${COMP_MEM_SWAP}"
+    #image: quay.io/invidious/invidious-companion:latest
+    image: invidious-companion-nerdvpn:latest
+    build:
+      context: companion
+      dockerfile: Dockerfile 
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    environment:
+       - SERVER_SECRET_KEY=
+       - PROXY=
+       - SERVER_ENABLE_METRICS=false
+    restart: unless-stopped
+    cap_drop:
+      - ALL
+    read_only: true
+    volumes:
+      - /srv/invidious/cache/3:/var/tmp/youtubei.js:rw
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      invidious_proxy:
+        ipv4_address: 192.42.6.13
+  
+  invidious-companion-4:
+    container_name: invidious-companion-4
+    cpus: ${COMP_CPU_CORES}
+    mem_limit: "${COMP_MEM_LIMIT}"
+    memswap_limit: "${COMP_MEM_SWAP}"
+    #image: quay.io/invidious/invidious-companion:latest
+    image: invidious-companion-nerdvpn:latest
+    build:
+      context: companion
+      dockerfile: Dockerfile 
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    environment:
+       - SERVER_SECRET_KEY=
+       - PROXY=
+       - SERVER_ENABLE_METRICS=false
+    restart: unless-stopped
+    cap_drop:
+      - ALL
+    read_only: true
+    volumes:
+      - /srv/invidious/cache/4:/var/tmp/youtubei.js:rw
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      invidious_proxy:
+        ipv4_address: 192.42.6.14
+  
+  invidious-companion-5:
+    container_name: invidious-companion-5
+    cpus: ${COMP_CPU_CORES}
+    mem_limit: "${COMP_MEM_LIMIT}"
+    memswap_limit: "${COMP_MEM_SWAP}"
+    #image: quay.io/invidious/invidious-companion:latest
+    image: invidious-companion-nerdvpn:latest
+    build:
+      context: companion
+      dockerfile: Dockerfile 
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    environment:
+       - SERVER_SECRET_KEY=
+       - PROXY=
+       - SERVER_ENABLE_METRICS=false
+    restart: unless-stopped
+    cap_drop:
+      - ALL
+    read_only: true
+    volumes:
+      - /srv/invidious/cache/5:/var/tmp/youtubei.js:rw
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      invidious_proxy:
+        ipv4_address: 192.42.6.15
+  
+  invidious-companion-6:
+    container_name: invidious-companion-6
+    cpus: ${COMP_CPU_CORES}
+    mem_limit: "${COMP_MEM_LIMIT}"
+    memswap_limit: "${COMP_MEM_SWAP}"
+    #image: quay.io/invidious/invidious-companion:latest
+    image: invidious-companion-nerdvpn:latest
+    build:
+      context: companion
+      dockerfile: Dockerfile 
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    environment:
+       - SERVER_SECRET_KEY=
+       - PROXY=
+       - SERVER_ENABLE_METRICS=false
+    restart: unless-stopped
+    cap_drop:
+      - ALL
+    read_only: true
+    volumes:
+      - /srv/invidious/cache/6:/var/tmp/youtubei.js:rw
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      invidious_proxy:
+        ipv4_address: 192.42.6.16
+  
+  invidious-companion-7:
+    container_name: invidious-companion-7
+    cpus: ${COMP_CPU_CORES}
+    mem_limit: "${COMP_MEM_LIMIT}"
+    memswap_limit: "${COMP_MEM_SWAP}"
+    #image: quay.io/invidious/invidious-companion:latest
+    image: invidious-companion-nerdvpn:latest
+    build:
+      context: companion
+      dockerfile: Dockerfile 
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    environment:
+       - SERVER_SECRET_KEY=
+       - PROXY=
+       - SERVER_ENABLE_METRICS=false
+    restart: unless-stopped
+    cap_drop:
+      - ALL
+    read_only: true
+    volumes:
+      - /srv/invidious/cache/7:/var/tmp/youtubei.js:rw
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      invidious_proxy:
+        ipv4_address: 192.42.6.17
+  
+  invidious-companion-8:
+    container_name: invidious-companion-8
+    cpus: ${COMP_CPU_CORES}
+    mem_limit: "${COMP_MEM_LIMIT}"
+    memswap_limit: "${COMP_MEM_SWAP}"
+    #image: quay.io/invidious/invidious-companion:latest
+    image: invidious-companion-nerdvpn:latest
+    build:
+      context: companion
+      dockerfile: Dockerfile 
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    environment:
+       - SERVER_SECRET_KEY=
+       - PROXY=
+       - SERVER_ENABLE_METRICS=false
+    restart: unless-stopped
+    cap_drop:
+      - ALL
+    read_only: true
+    volumes:
+      - /srv/invidious/cache/8:/var/tmp/youtubei.js:rw
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      invidious_proxy:
+        ipv4_address: 192.42.6.18
+  
+  # companion 11 and 12 are for ipv4 proxies that only support socks5
+  invidious-companion-11:
+    profiles: ["disabled"]
+    container_name: invidious-companion-11
+    cpus: ${COMP_CPU_CORES}
+    mem_limit: "${INV_MEM_LIMIT}"
+    memswap_limit: "${INV_MEM_SWAP}"
+    image: quay.io/invidious/invidious-companion:latest
+    environment:
+       - SERVER_SECRET_KEY=
+       - SERVER_ENABLE_METRICS=false
+    restart: unless-stopped
+    cap_drop:
+      - ALL
+    read_only: true
+    volumes:
+      - /srv/invidious/cache/11:/var/tmp/youtubei.js:rw
+    security_opt:
+      - no-new-privileges:true
+    #networks:
+    #  invidious_proxy:
+    #    ipv4_address: 192.42.6.21
+    network_mode: "container:invidious-proxy-1"
+    depends_on:
+      - invidious-proxy-1
+  
+  invidious-companion-12:
+    profiles: ["disabled"]
+    container_name: invidious-companion-12
+    cpus: ${COMP_CPU_CORES}
+    mem_limit: "${INV_MEM_LIMIT}"
+    memswap_limit: "${INV_MEM_SWAP}"
+    image: quay.io/invidious/invidious-companion:latest
+    environment:
+       - SERVER_SECRET_KEY=
+       - SERVER_ENABLE_METRICS=false
+    restart: unless-stopped
+    cap_drop:
+      - ALL
+    read_only: true
+    volumes:
+      - /srv/invidious/cache/12:/var/tmp/youtubei.js:rw
+    security_opt:
+      - no-new-privileges:true
+    #networks:
+    #  invidious_proxy:
+    #    ipv4_address: 192.42.6.22
+    network_mode: "container:invidious-proxy-2"
+    depends_on:
+      - invidious-proxy-2
+  
+  invidious:
+    <<: *defaults
     env_file:
       - .env
-    profiles: ["web"]
+    container_name: invidious
-    container_name: invidious_1
     cpus: ${INV_CPU_CORES}
     mem_limit: "${INV_MEM_LIMIT}"
-    mem_reservation: "${INV_MEM_RESERVATION}"
+    memswap_limit: "${INV_MEM_SWAP}"
     image: "${INV_IMAGE}"
     restart: "${INV_RESTART_POLICY}"
     environment:
@@ -163,374 +394,61 @@ services:
     networks:
       invidious_proxy:
         ipv4_address: 192.42.6.2
-    healthcheck:
-      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1
-      interval: 5m
-      timeout: 5s
-      retries: 2
-      
-  invidious_2:
-    <<: *volumes
-    env_file:
-      - .env
-    profiles: ["web"]
-    container_name: invidious_2
-    cpus: ${INV_CPU_CORES}
-    mem_limit: "${INV_MEM_LIMIT}"
-    mem_reservation: "${INV_MEM_RESERVATION}"
-    image: "${INV_IMAGE}"
-    restart: "${INV_RESTART_POLICY}"
-    environment:
-      <<: *environment
-    networks:
-      invidious_proxy:
-        ipv4_address: 192.42.6.3
-    healthcheck:
-      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1
-      interval: 5m
-      timeout: 5s
-      retries: 2
-      
-  invidious_3:
-    <<: *volumes
-    env_file:
-      - .env
-    profiles: ["web"]
-    container_name: invidious_3
-    cpus: ${INV_CPU_CORES}
-    mem_limit: "${INV_MEM_LIMIT}"
-    mem_reservation: "${INV_MEM_RESERVATION}"
-    image: "${INV_IMAGE}"
-    restart: "${INV_RESTART_POLICY}"
-    environment:
-      <<: *environment
-    networks:
-      invidious_proxy:
-        ipv4_address: 192.42.6.4
-    healthcheck:
-      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1
-      interval: 5m
-      timeout: 5s
-      retries: 2
-      
-  invidious_4:
-    <<: *volumes
-    env_file:
-      - .env
-    profiles: ["web"]
-    container_name: invidious_4
-    cpus: ${INV_CPU_CORES}
-    mem_limit: "${INV_MEM_LIMIT}"
-    mem_reservation: "${INV_MEM_RESERVATION}"
-    image: "${INV_IMAGE}"
-    restart: "${INV_RESTART_POLICY}"
-    environment:
-      <<: *environment
-    networks:
-      invidious_proxy:
-        ipv4_address: 192.42.6.5
-    healthcheck:
-      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1
-      interval: 5m
-      timeout: 5s
-      retries: 2
-      
-  invidious_5:
-    <<: *volumes
-    env_file:
-      - .env
-    profiles: ["web"]
-    container_name: invidious_5
-    cpus: ${INV_CPU_CORES}
-    mem_limit: "${INV_MEM_LIMIT}"
-    mem_reservation: "${INV_MEM_RESERVATION}"
-    image: "${INV_IMAGE}"
-    restart: "${INV_RESTART_POLICY}"
-    environment:
-      <<: *environment
-    networks:
-      invidious_proxy:
-        ipv4_address: 192.42.6.6
-    healthcheck:
-      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1
-      interval: 5m
-      timeout: 5s
-      retries: 2
-      
-  invidious_6:
-    <<: *volumes
-    env_file:
-      - .env
-    profiles: ["web"]
-    container_name: invidious_6
-    cpus: ${INV_CPU_CORES}
-    mem_limit: "${INV_MEM_LIMIT}"
-    mem_reservation: "${INV_MEM_RESERVATION}"
-    image: "${INV_IMAGE}"
-    restart: "${INV_RESTART_POLICY}"
-    environment:
-      <<: *environment
-    networks:
-      invidious_proxy:
-        ipv4_address: 192.42.6.7
-    healthcheck:
-      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1
-      interval: 5m
-      timeout: 5s
-      retries: 2
-  
-  materialious:
-    env_file:
-      - .env
-    profiles: ["materialious"]
-    container_name: materialious
-    cpus: "2"
-    mem_reservation: "32m"
-    mem_limit: "64m"
-    image: "wardpearce/materialious"
-    restart: "unless-stopped"
-    networks:
-      invidious_proxy:
-        ipv4_address: 192.42.6.13
-  
-  # Return YouTube Dislike proxy via tor
-  materialious_ryd-proxy:
-    profiles: ["materialious"]
-    container_name: materialious_ryd-proxy
-    image: 1337kavin/ryd-proxy:latest
-    restart: "unless-stopped"
-    cpus: "2"
-    mem_reservation: "128m"
-    mem_limit: "256m"
-    depends_on:
-      - materialious_tor
-    environment:
-      - PROXY=socks5://materialious_tor:5566
-      - WEB_CONCURRENCY=3
-    networks:
-      invidious_proxy:
-        ipv4_address: 192.42.6.14
 
-  materialious_api:
+  # Those are for proxies that only support socks5
-    profiles: ["materialious"]
+  invidious-proxy-1:
-    container_name: materialious_api
+    profiles: ["disabled"]
-    image: wardpearce/invidious_api_extended:latest
+    container_name: invidious-proxy-1
-    restart: "unless-stopped"
+    restart: unless-stopped
-    cpus: "3"
+    image: ghcr.io/xjasonlyu/tun2socks:latest
-    mem_reservation: "192m"
+    cpus: 2
-    mem_limit: "320m"
-    environment:
-      api_extended_postgre: '{"host": "invidious-db", "port": 5432, "database": "invidious", "user": "invidious", "password": ""}'
-      api_extended_allowed_origins: '["https://materialious.nerdvpn.de"]'
-      api_extended_debug: false
-      api_extended_invidious_instance: "https://api.invidious.nerdvpn.de"
-      api_extended_production_instance: "https://sync.invidious.nerdvpn.de"
-      WEB_CONCURRENCY: 3
-    networks:
-      invidious_proxy:
-        ipv4_address: 192.42.6.15
-
-  # Opens tor circuits
-  materialious_tor:
-    profiles: ["materialious"]
-    container_name: materialious_tor
-    image: 1337kavin/alpine-tor:latest
-    restart: "unless-stopped"
-    cpus: "2"
-    mem_reservation: "128m"
-    mem_limit: "256m"
-    environment:
-      - tors=2
-      - test_url="http://nerdvpn2awosmfgodp77bavzve3k2kvxw52z364suglul2qaalcdqtad.onion"
-    networks:
-      invidious_proxy:
-        ipv4_address: 192.42.6.20
-  
-  materialious_peerjs:
-    profiles: ["materialious"]
-    container_name: materialious_peerjs
-    build:
-      context: peerjs
-      dockerfile: Dockerfile
-    restart: "unless-stopped"
-    cpus: "2"
-    mem_reservation: "32m"
     mem_limit: "128m"
-    labels:
+    memswap_limit: "320m"
-      - "com.centurylinklabs.watchtower.enable=false"
+    cap_add:
-    networks:
+      - NET_ADMIN
-      invidious_proxy:
+    devices:
-        ipv4_address: 192.42.6.19
+        - '/dev/net/tun:/dev/net/tun'
-
-  invidious_tor:
-    <<: *volumes
-    env_file:
-      - .env
-    profiles: ["tor"]
-    container_name: invidious_tor
-    cpus: ${INV_CPU_CORES}
-    mem_limit: "512m"
-    mem_reservation: "128m"
-    image: "${INV_IMAGE}"
-    restart: "${INV_RESTART_POLICY}"
     environment:
-      INVIDIOUS_CONFIG: |
+      - LOGLEVEL=info
-        force_resolve: ipv6
+      - TUN=tun0
-        modified_source_code_url: "https://github.com/Sommerwiesel/invidious-nerdvpn"
+      - ADDR=198.18.0.1/15
-        hmac_key: 
+      - MTU=9000
-        db:
+      - PROXY=
-          dbname: invidious
+    sysctls:
-          user: invidious
+      - net.ipv4.ip_forward=1
-          password: 
+      - net.ipv6.conf.all.forwarding=1
-          host: invidious-pgbouncer
+      - net.ipv6.conf.default.disable_ipv6=0
-          port: 5432
-        redis_socket: "/invidious/redis-server.sock"
-        redis_db: 4 
-        redis_auth: ""
-        http_proxy:
-          host: "192.42.6.30"
-          port: 80
-        check_tables: true
-        external_port: 80
-        domain: "jt3wafuew7rumgwp7wfixpbtxc4dw6jvvfjt7dud33xczvwvgih5nfqd.onion"
-        https_only: false
-        hsts: false
-        pool_size: 40
-        disable_proxy: ["livestreams","local","dash","downloads"]
-        log_level: "Fatal"
-        popular_enabled: false
-        statistics_enabled: true
-        enable_user_notifications: false
-        channel_threads: 0
-        feed_threads: 0
-        use_pubsub_feeds: false
-        jobs:
-          clear_expired_items:
-            enable: false
-          refresh_channels:
-            enable: false
-          refresh_feeds:
-            enable: false 
-        default_user_preferences:
-          locale: "de"
-          region: "DE"
-          captions: ["","English","English (auto-generated)"]
-          dark_mode: "dark"
-          feed_menu: ["Trending", "Subscriptions", "Playlists", "Search"]
-          default_home: "Search"
-          comments: ["youtube", ""]
-          autoplay: true
-          continue_autoplay: true
-          quality: "hd720"
-          quality_dash: "720p"
-          unseen_only: true
-          local: false
-          automatic_instance_redirect: false
     networks:
       invidious_proxy:
-        ipv4_address: 192.42.6.8
+        ipv4_address: 192.42.6.200
-    healthcheck:
-      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/${INV_HEALTHCHECK_URL} || exit 1
-      interval: 5m
-      timeout: 5s
-      retries: 2
 
-  invidious-pgbouncer:
+  invidious-proxy-2:
-    env_file:
+    profiles: ["disabled"]
-      - .env
+    container_name: invidious-proxy-2
-    profiles: ["database"]
+    restart: unless-stopped
-    container_name: invidious-pgbouncer
+    image: ghcr.io/xjasonlyu/tun2socks:latest
+    cpus: 2
     mem_limit: "128m"
-    mem_reservation: "64m"
+    memswap_limit: "320m"
-    image: edoburu/pgbouncer
+    cap_add:
-    restart: "${INV_RESTART_POLICY}"
+      - NET_ADMIN
+    devices:
+        - '/dev/net/tun:/dev/net/tun'
     environment:
-      - DB_HOST=invidious-db
+      - LOGLEVEL=info
-      - DB_PORT=5432
+      - TUN=tun0
-      - DB_USER=invidious
+      - ADDR=198.18.0.1/15
-      - DB_PASSWORD=
+      - MTU=9000
-      - DB_NAME=invidious
+      - PROXY=
-      - ADMIN_USERS=pgbouncer
+    sysctls:
-      - POOL_MODE=transaction
+      - net.ipv4.ip_forward=1
-      - DEFAULT_POOL_SIZE=80
+      - net.ipv6.conf.all.forwarding=1
-      - MIN_POOL_SIZE=20
+      - net.ipv6.conf.default.disable_ipv6=0
-      - RESERVE_POOL_SIZE=80
-      - RESERVE_POOL_TIMEOUT=5
-      - MAX_DB_CONNECTIONS=160
-      - MAX_USER_CONNECTIONS=160
-      - MAX_CLIENT_CONN=1000
-      - AUTH_TYPE=scram-sha-256
-      - IGNORE_STARTUP_PARAMETERS=extra_float_digits
-    volumes:
-      - ./docker/userlist.txt:/etc/pgbouncer/userlist.txt:rw
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB -h invidious-db"]
-      interval: 5m
-      timeout: 15s
-      retries: 2
     networks:
       invidious_proxy:
-        ipv4_address: 192.42.6.11
+        ipv4_address: 192.42.6.201
-
-  invidious-db:
-    env_file:
-      - .env
-    profiles: ["database"]
-    container_name: invidious-db
-    cpus: ${INV_PSQL_CPU_CORES}
-    mem_limit: "${INV_PSQL_MEM_LIMIT}"
-    memswap_limit: "${INV_PSQL_MEM_LIMIT}"
-    mem_reservation: "${INV_PSQL_MEM_RESERVATION}"
-    image: "${INV_PSQL_IMAGE}"
-    restart: "${INV_RESTART_POLICY}"
-    volumes:
-      - type: bind
-        source: /srv/invidious/database
-        target: /var/lib/postgresql/data
-      - ./config/sql:/config/sql
-      - ./docker/init-invidious-db.sh:/docker-entrypoint-initdb.d/init-invidious-db.sh
-      - ./docker/pg-tune.sql:/docker-entrypoint-initdb.d/pg-tune.sql
-      - ./docker/pgstat.sql:/tmp/pgstat.sql
-      - ./docker/pg-cleanup.sql:/tmp/pgcleanup.sql
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
-      interval: 5m
-      timeout: 15s
-      retries: 2
-    networks:
-      invidious_proxy:
-        ipv4_address: 192.42.6.10
-
-  invidious-proxy:
-    profiles: ["web"]
-    image: 1337kavin/ytproxy:latest
-    container_name: invidious_proxy
-    cpus: "4"
-    mem_reservation: "256m"
-    mem_limit: "512m"
-    restart: "unless-stopped"
-    user: 33:33
-    network_mode: "host"
-    environment:
-     - DISABLE_WEBP=1
-    volumes:
-     - /srv/ytproxy:/app/socket
-
-  invidious-haproxy:
-    profiles: ["web"]
-    image: haproxytech/haproxy-alpine:latest
-    container_name: invidious_haproxy
-    cpus: "3"
-    mem_reservation: "64m"
-    mem_limit: "128m"
-    restart: "unless-stopped"
-    volumes:
-      - ./docker/haproxy:/usr/local/etc/haproxy:ro
-    networks:
-      invidious_proxy:
-        ipv4_address: 192.42.6.30
-
 
 networks:
   invidious_proxy:
+    enable_ipv6: true
     external: true

docker/haproxy/haproxy.cfg

@@ -1,31 +0,0 @@
-global
-	stats socket /var/run/api.sock user haproxy group haproxy mode 660 level admin expose-fd listeners
-	log stdout format raw local0 notice
-
-defaults
-	log	global
-	mode	http
-	option	httplog
-	option	dontlognull
-	timeout connect 	5s
-	timeout client  	10s
-	timeout server  	10s
-	timeout http-request 	10s
-
-
-
-frontend invidious
-	log stdout format raw local0 emerg
-	bind *:80
-	mode http
-	default_backend proxies
-
-backend proxies
-	balance leastconn
-	http-reuse always
-	http-request set-header Proxy-Authorization Basic\ base64_here
-	# Normal proxies go here
-	server proxy_normal_1 ipaddr_here check fall 3 rise 3 inter 15s observe layer7 error-limit 10 on-error mark-down sni hdr(host)
-	
-	# Add at least 1 backup proxy to shortly take over until the others have rotated their ips during YT blockage
-	server proxy_backup_1 ipaddr_here backup check fall 3 rise 3 inter 15s observe layer7 error-limit 10 on-error mark-down sni hdr(host)

docker/userlist.txt

@@ -1,2 +0,0 @@
-"pgbouncer" ""
-"invidious" ""

invidious.service

@@ -1,18 +1,16 @@
 [Unit]
-Description=Invidious (%i)
+Description=Invidious
-After=syslog.target
+After=network.target postgresql@16-main.service redis.service
-After=network.target
+Requires=postgresql@16-main.service redis.service
-Requires=docker.service
-After=docker.service
 
 [Service]
 Restart=always
 RestartSec=15s
-User=invidious
+
-Group=invidious
 WorkingDirectory=/srv/invidious
-ExecStart=/usr/bin/docker compose --env-file .env --profile %i up
+
-ExecStop=/usr/bin/docker compose --env-file .env --profile %i down
+ExecStart=/usr/bin/docker compose --env-file .env up
+ExecStop=/usr/bin/docker compose --env-file .env down
 
 [Install]
 WantedBy=multi-user.target

nginx/sites-enabled/invidious.vhost

@@ -1,505 +1,169 @@
 upstream invidious {
-	least_conn;
 	server 192.42.6.2:3000 fail_timeout=3s;
-	server 192.42.6.3:3000 fail_timeout=3s;
+	keepalive 21;
-	server 192.42.6.4:3000 fail_timeout=3s;
-	server 192.42.6.5:3000 fail_timeout=3s;
-	server 192.42.6.6:3000 fail_timeout=3s;
-	server 192.42.6.7:3000 fail_timeout=3s;
-	keepalive 30;
 }
 
-upstream invidious_worker {
+# This is routed over a HAProxy that looks for the cookie
-	server 192.42.6.9:3000;
+upstream invidious_companion {
-	keepalive 1;
+	server 192.42.6.1:8118 fail_timeout=3s;
-}
-
-upstream invidious_proxy {
-	server unix:/srv/ytproxy/http-proxy.sock;
-	keepalive 6;
-}
-
-upstream invidious_tor {
-	server 192.42.6.8:3000;
-	keepalive 2;
-}
-
-upstream ryd_proxy {
-		server 192.42.6.14:3000;
-	keepalive 3;
-}
-
-upstream invidious_sync {
-	server 192.42.6.15:80;
-	keepalive 3;
-}
-
-upstream invidious_peer {
-	server 192.42.6.19:9000;
-	keepalive 3;
 }
 
 map $upstream_addr $server_instance {
-	default 		"invidious";
+	default                 "invidious";
-	192.42.6.2:3000 	"invidious_1";
-	192.42.6.3:3000 	"invidious_2";
-	192.42.6.4:3000 	"invidious_3";
-	192.42.6.5:3000 	"invidious_4";
-	192.42.6.6:3000 	"invidious_5";
-	192.42.6.7:3000 	"invidious_6";
 }
 
-# I use this line to switch to a testing instance of invidious when I test a new docker image
 geo $upstream_server {
-	default 		invidious;
+	default                 invidious;
 }
 
-# Toggle to switch between using team piped ytproxy or invidious to server google asssets and video stream
+map "$http_origin" $cors {
-geo $ivproxy_server {
+	default '';
-	default			invidious_proxy;
-	#default		invidious;
 }
 
-# The api is for internal access only
-geo $api_invidious_access {
-	default 0;
-	
-	# locahost
-	127.0.0.1/32 1;
-	
-	# Docker network
-	192.42.0.0/16 1;
-}
-
-# Access to feeds is rate limited except for google ips
 geo $feeds_whitelist {
 	default 0;
 	# CIDR in the list below are not limited
-	
+
 	# Google
 	8.34.208.0/20 1;
-		8.35.192.0/20 1;
+	8.35.192.0/20 1;
-		23.236.48.0/20 1;
+	23.236.48.0/20 1;
-		23.251.128.0/19 1;
+	23.251.128.0/19 1;
-		34.0.0.0/15 1;
+	34.0.0.0/15 1;
-		34.2.0.0/16 1;
+	34.2.0.0/16 1;
-		34.3.0.0/23 1;
+	34.3.0.0/23 1;
-		34.3.3.0/24 1;
+	34.3.3.0/24 1;
-		34.3.4.0/24 1;
+	34.3.4.0/24 1;
-		34.3.8.0/21 1;
+	34.3.8.0/21 1;
-		34.3.16.0/20 1;
+	34.3.16.0/20 1;
-		34.3.32.0/19 1;
+	34.3.32.0/19 1;
-		34.3.64.0/18 1;
+	34.3.64.0/18 1;
-		34.4.0.0/14 1;
+	34.4.0.0/14 1;
-		34.8.0.0/13 1;
+	34.8.0.0/13 1;
-		34.16.0.0/12 1;
+	34.16.0.0/12 1;
-		34.32.0.0/11 1;
+	34.32.0.0/11 1;
-		34.64.0.0/10 1;
+	34.64.0.0/10 1;
-		34.128.0.0/10 1;
+	34.128.0.0/10 1;
-		35.184.0.0/13 1;
+	35.184.0.0/13 1;
-		35.192.0.0/14 1;
+	35.192.0.0/14 1;
-		35.196.0.0/15 1;
+	35.196.0.0/15 1;
-		35.198.0.0/16 1;
+	35.198.0.0/16 1;
-		35.199.0.0/17 1;
+	35.199.0.0/17 1;
-		35.199.128.0/18 1;
+	35.199.128.0/18 1;
-		35.200.0.0/13 1;
+	35.200.0.0/13 1;
-		35.208.0.0/12 1;
+	35.208.0.0/12 1;
-		35.224.0.0/12 1;
+	35.224.0.0/12 1;
-		35.240.0.0/13 1;
+	35.240.0.0/13 1;
-		64.15.112.0/20 1;
+	64.15.112.0/20 1;
-		64.233.160.0/19 1;
+	64.233.160.0/19 1;
-		66.22.228.0/23 1;
+	66.22.228.0/23 1;
-		66.102.0.0/20 1;
+	66.102.0.0/20 1;
-		66.249.64.0/19 1;
+	66.249.64.0/19 1;
-		70.32.128.0/19 1;
+	70.32.128.0/19 1;
-		72.14.192.0/18 1;
+	72.14.192.0/18 1;
-		74.125.0.0/16 1;
+	74.125.0.0/16 1;
-		104.154.0.0/15 1;
+	104.154.0.0/15 1;
-		104.196.0.0/14 1;
+	104.196.0.0/14 1;
-		104.237.160.0/19 1;
+	104.237.160.0/19 1;
-		107.167.160.0/19 1;
+	107.167.160.0/19 1;
-		107.178.192.0/18 1;
+	107.178.192.0/18 1;
-		108.59.80.0/20 1;
+	108.59.80.0/20 1;
-		108.170.192.0/18 1;
+	108.170.192.0/18 1;
-		108.177.0.0/17 1;
+	108.177.0.0/17 1;
-		130.211.0.0/16 1;
+	130.211.0.0/16 1;
-		142.250.0.0/15 1;
+	142.250.0.0/15 1;
-		146.148.0.0/17 1;
+	146.148.0.0/17 1;
-		162.216.148.0/22 1;
+	162.216.148.0/22 1;
-		162.222.176.0/21 1;
+	162.222.176.0/21 1;
-		172.110.32.0/21 1;
+	172.110.32.0/21 1;
-		172.217.0.0/16 1;
+	172.217.0.0/16 1;
-		172.253.0.0/16 1;
+	172.253.0.0/16 1;
-		173.194.0.0/16 1;
+	173.194.0.0/16 1;
-		173.255.112.0/20 1;
+	173.255.112.0/20 1;
-		193.186.4.0/24 1;
+	193.186.4.0/24 1;
-		199.36.154.0/23 1;
+	199.36.154.0/23 1;
-		199.36.156.0/24 1;
+	199.36.156.0/24 1;
-		199.192.112.0/22 1;
+	199.192.112.0/22 1;
-		199.223.232.0/21 1;
+	199.223.232.0/21 1;
-		207.223.160.0/20 1;
+	207.223.160.0/20 1;
-		208.65.152.0/22 1;
+	208.65.152.0/22 1;
-		208.68.108.0/22 1;
+	208.68.108.0/22 1;
-		208.81.188.0/22 1;
+	208.81.188.0/22 1;
-		208.117.224.0/19 1;
+	208.117.224.0/19 1;
-		209.85.128.0/17 1;
+	209.85.128.0/17 1;
-		216.58.192.0/19 1;
+	216.58.192.0/19 1;
-		216.73.80.0/20 1;
+	216.73.80.0/20 1;
-		216.239.32.0/19 1;
+	216.239.32.0/19 1;
-		2001:4860::/32 1;
+	2001:4860::/32 1;
-		2404:6800::/32 1;
+	2404:6800::/32 1;
-		2404:f340::/32 1;
+	2404:f340::/32 1;
-		2600:1900::/28 1;
+	2600:1900::/28 1;
-		2606:73c0::/32 1;
+	2606:73c0::/32 1;
-		2607:f8b0::/32 1;
+	2607:f8b0::/32 1;
-		2620:11a:a000::/40 1;
+	2620:11a:a000::/40 1;
-		2620:120:e000::/40 1;
+	2620:120:e000::/40 1;
-		2800:3f0::/32 1;
+	2800:3f0::/32 1;
-		2a00:1450::/32 1;
+	2a00:1450::/32 1;
-		2c0f:fb50::/32 1;
+	2c0f:fb50::/32 1;
 }
 
 map $feeds_whitelist $feeds_limit {
-		0	 "";
+	0     "";
-	1	 $binary_remote_addr;
+	1     $binary_remote_addr;
 }
 
-# Limit login to prevent bruteforce
-limit_req_zone $binary_remote_addr zone=invidious_login:5m rate=2r/s;
 
-# Limit global requests to prevent DoS
+limit_req_zone $binary_remote_addr zone=invidious_login:5m rate=5r/m;
 limit_req_zone $binary_remote_addr zone=invidious_requests:5m rate=5r/s;
-
-# Limit webfeed hook
 limit_req_zone $feeds_limit zone=invidious_feeds:5m rate=3r/s;
 
-#######
-# HTTP
-#######
-
 server {
-		listen 80;
+	listen 80;
-		listen [::]:80;
+	listen [::]:80;
 
-		server_name invidious.nerdvpn.de www.invidious.nerdvpn.de;
+	server_name invidious.nerdvpn.de www.invidious.nerdvpn.de;
 	root /srv/nginx/public/invidious;
 
-	location /.well-known/acme-challenge/ {
+	include snippets/malicious.conf;
-				allow all;
-				default_type "text/plain";
-				alias /srv/nginx/public/acme/;
-		}	
-
-		location / {
-				return 301 https://invidious.nerdvpn.de$request_uri;
-		}
-}
-server {
-		listen 80;
-		listen [::]:80;
-
-		server_name api.invidious.nerdvpn.de;
-	root /srv/nginx/public/invidious;
 
 	location /.well-known/acme-challenge/ {
-				allow all;
+		allow all;
-				default_type "text/plain";
+		default_type "text/plain";
-				alias /srv/nginx/public/acme/;
+		alias /srv/nginx/public/acme/;
-		}	
+	}
 
-		location / {
+	location / {
-				return 301 https://$host$request_uri;
+		return 301 https://invidious.nerdvpn.de$request_uri;
-		}
+	}
 }
-server {
-		listen 80;
-		listen [::]:80;
-
-		server_name ryd.invidious.nerdvpn.de;
-	root /srv/nginx/public/invidious;
-
-	location /.well-known/acme-challenge/ {
-				allow all;
-				default_type "text/plain";
-				alias /srv/nginx/public/acme/;
-		}	
-
-		location / {
-				return 301 https://$host$request_uri;
-		}
-}
-server {
-		listen 80;
-		listen [::]:80;
-
-		server_name sync.invidious.nerdvpn.de;
-	root /srv/nginx/public/invidious;
-
-	location /.well-known/acme-challenge/ {
-				allow all;
-				default_type "text/plain";
-				alias /srv/nginx/public/acme/;
-		}	
-
-		location / {
-				return 301 https://$host$request_uri;
-		}
-}
-server {
-		listen 80;
-		listen [::]:80;
-
-		server_name peer.invidious.nerdvpn.de;
-	root /srv/nginx/public/invidious;
-
-	location /.well-known/acme-challenge/ {
-				allow all;
-				default_type "text/plain";
-				alias /srv/nginx/public/acme/;
-		}	
-
-		location / {
-				return 301 https://$host$request_uri;
-		}
-}
-
-########
-# HTTPS
-########
 
 server {
 	listen 443 ssl;
-		listen [::]:443 ssl;
+	listen [::]:443 ssl;
-	
-	http2 on;
-	
-	server_name api.invidious.nerdvpn.de;
-	root /srv/nginx/public/invidious;
-	
-	ssl_session_cache shared:nginx_TLS_api_invidious:5m;
-
-	add_header X-Robots-Tag "none";
-
-		ssl_certificate		 /srv/letsencrypt/certs/api.invidious.nerdvpn.de/fullchain.pem;
-		ssl_certificate_key	 /srv/letsencrypt/certs/api.invidious.nerdvpn.de/privkey.pem;
-	include snippets/htst.conf;
-
-		access_log off;
-	error_log /dev/null emerg;
-	
-	include	snippets/malicious.conf;
-
-	proxy_hide_header Access-Control-Allow-Origin;
-	add_header Access-Control-Allow-Credentials true;
-	add_header Access-Control-Allow-Origin "https://materialious.nerdvpn.de" always;
-	add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, HEAD, PATCH, PUT, DELETE" always;
-	add_header Access-Control-Allow-Headers "User-Agent, Authorization, Content-Type" always;
-	
-	location = /favicon.ico {
-		allow all;
-	}
-
-	location = /robots.txt {
-		add_header Content-Type text/plain;
-		return 200 "User-agent: *\nDisallow: /";
-	}
-
-	location = /css/default.css { 
-		root /srv/nginx/public/invidious;
-	}
-	
-	limit_rate 6000k;
-
-	location / {
-		if ($api_invidious_access != 1) { 
-			return 302 "https://invidious.nerdvpn.de$request_uri";
-		} 
-		
-		if ($request_method = OPTIONS) {
-				return 204;
-			}
-		proxy_http_version 1.1;
-		proxy_set_header "Connection" "";
-	
-		proxy_pass http://$upstream_server;
-		proxy_set_header Host $host;
-				proxy_set_header X-Real-IP $remote_addr;
-				proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-				proxy_set_header X-Forwarded-Proto $scheme;
-		}
-	location ~ /(css|js|fonts|login|authorize_token|api) {	
-		if ($request_method = OPTIONS) {
-				return 204;
-			}
-		proxy_http_version 1.1;
-		proxy_set_header "Connection" "";
-	
-		proxy_pass http://$upstream_server;
-		proxy_set_header Host $host;
-				proxy_set_header X-Real-IP $remote_addr;
-				proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-				proxy_set_header X-Forwarded-Proto $scheme;
-	}
-}
-server {
-		listen 443 ssl;
-		listen [::]:443 ssl;
-
-		http2 on;
-
-		server_name ryd.invidious.nerdvpn.de;
-		root /srv/nginx/public/invidious;
-
-		ssl_session_cache shared:nginx_TLS_ryd:5m;
-
-		add_header X-Robots-Tag "none";
-
-		ssl_certificate		 /srv/letsencrypt/certs/ryd.invidious.nerdvpn.de/fullchain.pem;
-		ssl_certificate_key	 /srv/letsencrypt/certs/ryd.invidious.nerdvpn.de/privkey.pem;
-	include snippets/htst.conf;
-
-		access_log off;
-	error_log /dev/null emerg;
-
-		include snippets/malicious.conf;
-
-		location = /favicon.ico {
-				allow all;
-		}
-
-		location = /robots.txt {
-				add_header Content-Type text/plain;
-				return 200 "User-agent: *\nDisallow: /";
-		}
-	
-	limit_rate 6000k;
-
-		location / {
-		add_header Access-Control-Allow-Origin "https://materialious.nerdvpn.de" always;
-				add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
-		proxy_set_header Host $host;
-				proxy_set_header X-Real-IP $remote_addr;
-				proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-				proxy_set_header X-Forwarded-Proto $scheme;
-		proxy_http_version 1.1;
-		proxy_set_header "Connection" "";
-				proxy_pass http://ryd_proxy;
-		}
-}
-server {
-		listen 443 ssl;
-		listen [::]:443 ssl;
-
-		http2 on;
-
-		server_name sync.invidious.nerdvpn.de;
-		root /srv/nginx/public/invidious;
-
-		ssl_session_cache shared:nginx_TLS_sync:5m;
-
-		add_header X-Robots-Tag "none";
-
-		ssl_certificate		 /srv/letsencrypt/certs/sync.invidious.nerdvpn.de/fullchain.pem;
-		ssl_certificate_key	 /srv/letsencrypt/certs/sync.invidious.nerdvpn.de/privkey.pem;
-	include snippets/htst.conf;
-
-		access_log off;
-	error_log /dev/null emerg;
-
-		include snippets/malicious.conf;
-
-		location = /favicon.ico {
-				allow all;
-		}
-
-		location = /robots.txt {
-				add_header Content-Type text/plain;
-				return 200 "User-agent: *\nDisallow: /";
-		}
-
-	limit_rate 6000k;
-		
-	location / {
-		proxy_set_header Host $host;
-				proxy_set_header X-Real-IP $remote_addr;
-				proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-				proxy_set_header X-Forwarded-Proto $scheme;
-		proxy_http_version 1.1;
-		proxy_set_header "Connection" "";
-				proxy_pass http://invidious_sync;
-		}
-}
-server {
-		listen 443 ssl;
-		listen [::]:443 ssl;
-
-		http2 on;
-
-		server_name peer.invidious.nerdvpn.de;
-		root /srv/nginx/public/invidious;
-
-		ssl_session_cache shared:nginx_TLS_peer:5m;
-
-		add_header X-Robots-Tag "none";
-
-		ssl_certificate		 /srv/letsencrypt/certs/peer.invidious.nerdvpn.de/fullchain.pem;
-		ssl_certificate_key	 /srv/letsencrypt/certs/peer.invidious.nerdvpn.de/privkey.pem;
-	include snippets/htst.conf;
-
-		access_log off;
-	error_log /dev/null emerg;
-
-		include snippets/invidious-errorpages.conf;
-
-		location = /favicon.ico {
-				allow all;
-		}
-
-		location = /robots.txt {
-				add_header Content-Type text/plain;
-				return 200 "User-agent: *\nDisallow: /";
-		}
-
-	limit_rate 6000k;
-		
-	location / {
-		proxy_http_version 1.1;
-			proxy_set_header Upgrade $http_upgrade;
-		proxy_set_header "Connection" "";
-
-		proxy_set_header Host $host;
-				proxy_set_header X-Real-IP $remote_addr;
-				proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-				proxy_set_header X-Forwarded-Proto $scheme;
-				proxy_pass http://invidious_peer;
-		}
-}
-
-server {
-		listen 443 ssl;
-		listen [::]:443 ssl;
 
 	http2 on;
 
 	server_name www.invidious.nerdvpn.de;
 	root /srv/nginx/public/invidious;
-	
+
-		ssl_certificate		 /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem;
+	include snippets/malicious.conf;
-		ssl_certificate_key	 /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem;
+
+	ssl_certificate         /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem;
+	ssl_certificate_key     /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem;
 	include snippets/htst.conf;
 
 	access_log off;
 	error_log /dev/null emerg;
-	
+
-		location / {
+	location / {
-				return 301 https://invidious.nerdvpn.de$request_uri;
+		return 301 https://invidious.nerdvpn.de$request_uri;
-		}
+	}
 }
 
 server {
-		listen 443 ssl;
+	listen 443 ssl;
 	listen 443 default_server quic reuseport;
-		listen [::]:443 ssl;
+	listen [::]:443 ssl;
 	listen [::]:443 default_server quic reuseport;
 
 	http2 on;
@@ -508,7 +172,7 @@ server {
 
 	server_name invidious.nerdvpn.de;
 	root /srv/nginx/public/invidious;
-	
+
 	add_header Alt-Svc 'h3=":443"; ma=86400';
 	add_header X-server-instance $server_instance always;
 	add_header X-server-proto $server_protocol always;
@@ -516,213 +180,132 @@ server {
 
 	ssl_session_cache shared:nginx_TLS_invidious:10m;
 
-	add_header X-Robots-Tag "noindex, nofollow, noai, noimageai";
+	add_header X-Robots-Tag "index, follow, noai, noimageai";
 
-		ssl_certificate		 /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem;
+	ssl_certificate         /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem;
-		ssl_certificate_key	 /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem;
+	ssl_certificate_key     /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem;
 	include snippets/htst.conf;
 
 	access_log off;
 	error_log /dev/null emerg;
+		
+	include snippets/invidious_errorpages.conf;
+	include snippets/malicious.conf;
 
-	include	snippets/malicious.conf;
+	limit_rate 4000k;
-	
-	limit_rate 6000k;
 
-	location = /favicon.ico {
+    	include snippets/favicon.conf;
-			include /etc/nginx/bots.d/ddos.conf;
+    	include snippets/robots.conf;
-		allow all;
+		
-	}
+	error_page 503 @maintenance;
-
-	location = /robots.txt {
-		add_header Content-Type text/plain;
-		return 200 "User-agent: GPTBot\nDisallow: /\nUser-agent: ChatGPT-User\nDisallow: /\nUser-agent: FacebookBot\nDisallow: /\nUser-agent: archive.org_bot\nDisallow: /\nUser-agent: Amazonbot\nDisallow: /\nUser-agent: *\nDisallow:";
-	}
-
-		error_page 503 @maintenance;
 	location @maintenance {
-			root /srv/nginx/public/maintenance/;
+		auth_request off;
-			rewrite ^ "/index.html" break;
+		root /srv/nginx/public/maintenance/;
-	}
+		rewrite ^ "/index.html" break;
-
+	}	
-	location /api/v1/stats {
+	location = /css/default.css {
-		proxy_http_version 1.1;
+		auth_request off;
-		proxy_set_header "Connection" "";
+		root /srv/nginx/public/invidious;
-		proxy_pass http://invidious/api/v1/stats;
-				proxy_set_header Host $host;
-				proxy_set_header X-Real-IP $remote_addr;
-				proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-				proxy_set_header X-Forwarded-Proto $scheme;
 	}
 	location ~ (^/feed/webhook) {
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+
+		auth_request off;
 		limit_req zone=invidious_feeds burst=240 delay=80;
+		#access_log /var/log/nginx/access/invidious.webfeed.log;
+		#error_log /var/log/nginx/errors/invidious.webfeed.log error;
 		proxy_http_version 1.1;
-		proxy_set_header "Connection" "";
+		proxy_set_header Connection "";
-		proxy_pass http://invidious_worker;
+		proxy_pass http://invidious;
-				proxy_set_header Host $host;
+	}
-				proxy_set_header X-Real-IP $remote_addr;
+	location /.within.website/ {
-				proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header Host $host;
-				proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+
+		proxy_pass http://anubis;
+		proxy_pass_request_body off;
+		proxy_set_header content-length "";
+		auth_request off;
+	}
+	location @redirectToAnubis {
+		return 307 /.within.website/?redir=$request_uri;
+		auth_request off;
 	}
 	location / {
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+
 		limit_req zone=invidious_requests burst=240 delay=80;
-		
+
-		if ($invidious_access != 1) {					
+		if ($invidious_access != 1) {
-					return 503;
+				return 503;
-		  	}   
+		}
 		if ($request_method = OPTIONS) {
 				return 204;
-			}
-		
-		proxy_http_version 1.1;
-		proxy_set_header "Connection" "";
-		proxy_pass http://$upstream_server;
-		proxy_set_header Host $host;
-				proxy_set_header X-Real-IP $remote_addr;
-				proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-				proxy_set_header X-Forwarded-Proto $scheme;
 		}
-	# video streaming and downloads
 
-	location ~ (^/videoplayback) {
+		auth_request /.within.website/x/cmd/anubis/api/check;
-		limit_req zone=invidious_requests burst=240 delay=80;
+		error_page 401 = @redirectToAnubis;
 		
-		# Limit user video streaming to 32 MBit/s
+		#error_page 503 = @maintenance;
-		limit_rate 4000k;
-		
-			proxy_set_header X-Forwarded-For "";
-		proxy_set_header CF-Connecting-IP "";
-			proxy_hide_header "alt-svc";
-	
-		sendfile on;
-			sendfile_max_chunk 512k;
-		  	tcp_nopush on;
-			aio threads=default;
-		aio_write on;
-		directio 16m;
-		   
-		proxy_hide_header Cache-Control;
-		  	proxy_hide_header etag;
-		proxy_set_header Connection keep-alive;
-			proxy_max_temp_file_size 32m;
-		   
-		proxy_http_version 1.1;
-		proxy_pass http://$ivproxy_server;
-		  	add_header Cache-Control private always;
-	}
-	# static assets from yt
-	location ~ (^/vi/|^/ggpht/) {
-		limit_req zone=invidious_requests burst=240 delay=80;
-		limit_rate 8000k;
-		
-			proxy_set_header X-Forwarded-For "";
-		proxy_set_header CF-Connecting-IP "";
-			proxy_hide_header "alt-svc";
-	
-		sendfile on;
-			sendfile_max_chunk 512k;
-		  	tcp_nopush on;
-			aio threads=default;
-		aio_write on;
-		directio 16m;
-		   
-		proxy_hide_header Cache-Control;
-		  	proxy_hide_header etag;
-		proxy_set_header Connection keep-alive;
-			proxy_max_temp_file_size 32m;
-		   
-		proxy_http_version 1.1;
-		proxy_pass http://$ivproxy_server;
-		  	add_header Cache-Control private always;
-	}
-	location ~ /(login) {
-		limit_req zone=invidious_login burst=4 nodelay;
 
 		proxy_http_version 1.1;
-		proxy_set_header "Connection" "";
+		proxy_set_header Connection "";
 		proxy_pass http://$upstream_server;
-		proxy_set_header Host $host;
-				proxy_set_header X-Real-IP $remote_addr;
-				proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-				proxy_set_header X-Forwarded-Proto $scheme;
 	}
-	location ~ /(css|js|fonts|delete_account|data_control|subscription_manager) {
+	
-		limit_req zone=invidious_requests burst=240 delay=80;
+	# Maintenance routes
-		proxy_http_version 1.1;
+	#location ~ /(login) {
-		proxy_set_header "Connection" "";
+	#		auth_request off;
-		proxy_pass http://$upstream_server;
+	#        limit_req zone=invidious_login burst=4 nodelay;
+	#        proxy_http_version 1.1;
+	#        proxy_set_header Connection "";
+	#        proxy_pass http://invidious_zero;
+	#}
+	#location ~ /(css|js|fonts|delete_account|data_control|subscription_manager|signout) {
+	#	auth_request off;
+	#        limit_req zone=invidious_requests burst=240 delay=80;
+	#        proxy_http_version 1.1;
+	#        proxy_set_header Connection "";
+	#        proxy_pass http://invidious_zero;
+	#}
+	
+	# Companion routes
+	location /latest_version {
 		proxy_set_header Host $host;
-				proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Real-IP $remote_addr;
-				proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-				proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_set_header X-Forwarded-Proto $scheme;
-	}
+
-}
+	 	proxy_pass http://invidious_companion;
-
+		proxy_http_version 1.1;
-server {
+		proxy_set_header Connection "";
-		listen unix:/var/run/invidious-tor.sock;
+	}
-
+	location /api/manifest/dash/id/ {
-	server_name nerdvpneaggggfdiurknszkbmhvjndks5z5k3g5yp4nhphflh3n3boad.onion;
+		proxy_set_header Host $host;
-	root /srv/nginx/public/invidious;
+		proxy_set_header X-Real-IP $remote_addr;
-
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-	add_header X-server-instance $server_instance always;
+		proxy_set_header X-Forwarded-Proto $scheme;
-
+
-	access_log off;
+		proxy_pass http://invidious_companion;
-	error_log /dev/null emerg;
+		proxy_http_version 1.1;
-
+		proxy_set_header Connection "";
-		error_page 503 @maintenance;
+	}
-	location @maintenance {
+	location /videoplayback {
-			root /srv/nginx/public/maintenance/;
+		proxy_set_header Host $host;
-			rewrite ^ "/index.html" break;
+		proxy_set_header X-Real-IP $remote_addr;
-	}
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
+		proxy_set_header X-Forwarded-Proto $scheme;
-	location / {
+
-		proxy_http_version 1.1;
+		proxy_pass http://invidious_companion;
-		proxy_set_header "Connection" "";
+		proxy_http_version 1.1;
-		proxy_pass http://invidious_tor;
+		proxy_set_header Connection "";
-		proxy_set_header Host $host;
-		}
-	# video streaming
-	location ~ (^/videoplayback) {
-			proxy_set_header X-Forwarded-For "";
-			proxy_set_header CF-Connecting-IP "";
-			proxy_hide_header "alt-svc";
-			
-		sendfile on;
-			sendfile_max_chunk 512k;
-			tcp_nopush on;
-			aio threads=default;
-			aio_write on;
-		directio 16m;
-			
-		proxy_hide_header Cache-Control;
-			proxy_hide_header etag;
-			proxy_set_header Connection keep-alive;
-			proxy_max_temp_file_size 32m;
-			
-		proxy_http_version 1.1;
-		proxy_pass http://$ivproxy_server;
-			add_header Cache-Control private always;
-	}
-	# assets from yt
-	location ~ (^/vi/|^/ggpht/) {
-			proxy_set_header X-Forwarded-For "";
-			proxy_set_header CF-Connecting-IP "";
-			proxy_hide_header "alt-svc";
-			
-		sendfile on;
-			sendfile_max_chunk 512k;
-			tcp_nopush on;
-			aio threads=default;
-			aio_write on;
-		directio 16m;
-			
-		proxy_hide_header Cache-Control;
-			proxy_hide_header etag;
-			proxy_set_header Connection keep-alive;
-			proxy_max_temp_file_size 32m;
-			
-		proxy_http_version 1.1;
-		proxy_pass http://$ivproxy_server;
-			add_header Cache-Control private always;
 	}
 }

patches/001-nerdvpn-branding.patch

@@ -1,5 +1,5 @@
 diff --git a/src/invidious.cr b/src/invidious.cr
-index e0bd0101..bf1a46d1 100644
+index 3804197e..0e051080 100644
 --- a/src/invidious.cr
 +++ b/src/invidious.cr
 @@ -75,9 +75,9 @@ REQUEST_HEADERS_WHITELIST  = {"accept", "accept-encoding", "cache-control", "con
@@ -15,10 +15,19 @@ index e0bd0101..bf1a46d1 100644
  # This is used to determine the `?v=` on the end of file URLs (for cache busting). We
  # only need to expire modified assets, so we can use this to find the last commit that changes
 diff --git a/src/invidious/views/template.ecr b/src/invidious/views/template.ecr
-index 9904b4fc..14170acd 100644
+index 9904b4fc..769ab1e2 100644
 --- a/src/invidious/views/template.ecr
 +++ b/src/invidious/views/template.ecr
-@@ -147,7 +147,7 @@
+@@ -142,12 +142,16 @@
+                             <i class="icon ion-ios-paper"></i>
+                             <a href="/privacy"><%= translate(locale, "View privacy policy.") %></a>
+                         </span>
++                        <span>
++                            <i class="icon ion-ios-paper"></i>
++                            <a href="https://nerdvpn.de/terms"><%= translate(locale, "View terms of use.") %></a>
++                        </span>
+                     </div>
+ 
                      <div class="pure-u-1 pure-u-md-1-3">
                          <span>
                              <i class="icon ion-ios-wallet"></i>

patches/003-proxy-csp.patch

@@ -1,37 +0,0 @@
-From 236a2c70d3974f5a1fc55a5bc8047ff24d94bce2 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=C3=89milien=20Devos?= <github@emiliendevos.be>
-Date: Tue, 16 Aug 2022 06:51:52 +0000
-Subject: [PATCH] more csp
-
----
- src/invidious/routes/before_all.cr | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/invidious/routes/before_all.cr b/src/invidious/routes/before_all.cr
-index 8e2a253f..5c7cc959 100644
---- a/src/invidious/routes/before_all.cr
-+++ b/src/invidious/routes/before_all.cr
-@@ -23,9 +23,9 @@ module Invidious::Routes::BeforeAll
-     # Allow media resources to be loaded from google servers
-     # TODO: check if *.youtube.com can be removed
-     if CONFIG.disabled?("local") || !preferences.local
--      extra_media_csp = " https://*.googlevideo.com:443 https://*.youtube.com:443"
-+      extra_media_csp = " https://*.googlevideo.com:443 https://*.youtube.com:443 https://*.invidious.nerdvpn.de:443"
-     else
--      extra_media_csp = ""
-+      extra_media_csp = " https://*.invidious.nerdvpn.de:443"
-     end
- 
-     # Only allow the pages at /embed/* to be embedded
-@@ -43,7 +43,7 @@ module Invidious::Routes::BeforeAll
-       "style-src 'self' 'unsafe-inline'",
-       "img-src 'self' data:",
-       "font-src 'self' data:",
--      "connect-src 'self'",
-+      "connect-src 'self' https://*.invidious.nerdvpn.de:443",
-       "manifest-src 'self'",
-       "media-src 'self' blob:" + extra_media_csp,
-       "child-src 'self' blob:",
--- 
-2.36.1
-

patches/004-donate-page.patch

@@ -64,8 +64,8 @@ index 00000000..0c7deecc
 +<div class="h-box">
 +    <h2>Donate to NerdVPN.de</h2>
 +    <h3>Why donating?</h3>
-+    <p>In order to provide the best Invidious experience possible, I have rented a very powerful dedicated server with 16 cores, 48 GiB RAM and a 2 GBit/s unmetered network connection. I also use 3 different, fully e2e-encrypted backup locations with live replication and a zero-dataloss backup strategy. All of this has its cost.</p>
++    <p>In order to provide the best Invidious experience possible, I have rented a very powerful dedicated server with 16 cores, 48 GiB RAM and a 2 GBit/s unmetered network connection. On top of that are the multiple backends required to bypass blockage from YouTube. I also use 3 different, fully e2e-encrypted backup locations with live replication and a zero-dataloss backup strategy. All of this has a high cost.</p>
-+    <p>All donations will go directly into paying my monthly infrastructure costs (server, domain, backups).</p>
++    <p>All donations will go directly into paying my monthly infrastructure costs (server, domain, backends, backups).</p>
 +    <p>Should the donations at any point fully cover the costs, I will invest the remaining directly into improving my infrastructure and thus improving the user experience.</p>
 +    <p>Every little bit helps. Thank you very much for considering to donate!</p>
 +    <h3>Payment methods</h3>
@@ -81,7 +81,7 @@ index 00000000..0c7deecc
 +    <li>Ethereum (ETH): <a href="ethereum:0xD1F7E3Bfb19Ee5a52baED396Ad34717aF18d995B">0xD1F7E3Bfb19Ee5a52baED396Ad34717aF18d995B</a></li>
 +    <li>Litecoin (LTC): <a href="litecoin:ltc1q8787aq2xrseq5yx52axx8c4fqks88zj5vr0zx9">ltc1q8787aq2xrseq5yx52axx8c4fqks88zj5vr0zx9</a><//li>
 +    </ul>
-+    <p>If you have any questions, feel free to contact me via matrix at: <i>@weidenwiesel:matrix.org</i></p>
++    <p>If you have any questions, feel free to contact me via matrix at: <i>@weidenwiesel:nerdvpn.de</i></p>
 +</div>
 \ No newline at end of file
 -- 

patches/010-use-redis-for-video-cache.patch

@@ -1,151 +0,0 @@
-From 7c4c24f829b4eeb8ca035b4a9d77eef53ca8aefa Mon Sep 17 00:00:00 2001
-From: Emilien Devos <contact@emiliendevos.be>
-Date: Sat, 10 Jun 2023 22:21:38 +0200
-Subject: [PATCH 1/1] use redis for video cache
-
----
- shard.lock                       |  8 ++++++++
- shard.yml                        |  2 ++
- src/invidious.cr                 |  8 +++++++-
- src/invidious/config.cr          |  3 +++
- src/invidious/database/videos.cr | 16 +++++++++++++---
- src/invidious/videos.cr          |  2 +-
- 6 files changed, 34 insertions(+), 5 deletions(-)
-
-diff --git a/shard.lock b/shard.lock
-index 397bd8bc..8c599d1b 100644
---- a/shard.lock
-+++ b/shard.lock
-@@ -32,6 +32,10 @@ shards:
-     git: https://github.com/will/crystal-pg.git
-     version: 0.24.0
- 
-+  pool:
-+    git: https://github.com/ysbaddaden/pool.git
-+    version: 0.2.4
-+
-   protodec:
-     git: https://github.com/iv-org/protodec.git
-     version: 0.1.5
-@@ -40,6 +44,10 @@ shards:
-     git: https://github.com/luislavena/radix.git
-     version: 0.4.1
- 
-+  redis:
-+    git: https://github.com/stefanwille/crystal-redis.git
-+    version: 2.9.1
-+
-   spectator:
-     git: https://github.com/icy-arctic-fox/spectator.git
-     version: 0.10.4
-diff --git a/shard.yml b/shard.yml
-index 367f7c73..c46e1c42 100644
---- a/shard.yml
-+++ b/shard.yml
-@@ -28,6 +28,8 @@ dependencies:
-   athena-negotiation:
-     github: athena-framework/negotiation
-     version: ~> 0.1.1
-+  redis:
-+    github: stefanwille/crystal-redis
- 
- development_dependencies:
-   spectator:
-diff --git a/src/invidious.cr b/src/invidious.cr
-index 3804197e..e2d40597 100644
---- a/src/invidious.cr
-+++ b/src/invidious.cr
-@@ -31,6 +31,7 @@ require "xml"
- require "yaml"
- require "compress/zip"
- require "protodec/utils"
-+require "redis"
- 
- require "./invidious/database/*"
- require "./invidious/database/migrations/*"
-@@ -60,7 +61,12 @@ alias IV = Invidious
- CONFIG   = Config.load
- HMAC_KEY = CONFIG.hmac_key
- 
--PG_DB       = DB.open CONFIG.database_url
-+PG_DB    = DB.open CONFIG.database_url
-+REDIS_DB = Redis::PooledClient.new(unixsocket: CONFIG.redis_socket || nil, url: CONFIG.redis_url || nil, database: CONFIG.redis_db || 0, password: CONFIG.redis_auth || nil)
-+
-+if REDIS_DB.ping
-+  puts "Connected to redis"
-+end
- ARCHIVE_URL = URI.parse("https://archive.org")
- PUBSUB_URL  = URI.parse("https://pubsubhubbub.appspot.com")
- REDDIT_URL  = URI.parse("https://www.reddit.com")
-diff --git a/src/invidious/config.cr b/src/invidious/config.cr
-index c4ddcdb3..5b6c576c 100644
---- a/src/invidious/config.cr
-+++ b/src/invidious/config.cr
-@@ -77,6 +77,11 @@ class Config
-   # Used for crawling channels: threads should check all videos uploaded by a channel
-   property full_refresh : Bool = false
- 
-+  property redis_url : String?
-+  property redis_socket : String?
-+  property redis_auth : String?
-+  property redis_db : Int32?
-+
-   # Jobs config structure. See jobs.cr and jobs/base_job.cr
-   property jobs = Invidious::Jobs::JobsConfig.new
- 
-diff --git a/src/invidious/database/videos.cr b/src/invidious/database/videos.cr
-index 695f5b33..776ef5b1 100644
---- a/src/invidious/database/videos.cr
-+++ b/src/invidious/database/videos.cr
-@@ -10,7 +10,8 @@ module Invidious::Database::Videos
-       ON CONFLICT (id) DO NOTHING
-     SQL
- 
--    PG_DB.exec(request, video.id, video.info.to_json, video.updated)
-+    REDIS_DB.set(video.id, video.info.to_json, ex: 3600)
-+    REDIS_DB.set(video.id + ":time", video.updated, ex: 3600)
-   end
- 
-   def delete(id)
-@@ -19,7 +20,8 @@ module Invidious::Database::Videos
-       WHERE id = $1
-     SQL
- 
--    PG_DB.exec(request, id)
-+    REDIS_DB.del(id)
-+    REDIS_DB.del(id + ":time")
-   end
- 
-   def delete_expired
-@@ -47,6 +49,14 @@ module Invidious::Database::Videos
-       WHERE id = $1
-     SQL
- 
--    return PG_DB.query_one?(request, id, as: Video)
-+    if ((info = REDIS_DB.get(id)) && (time = REDIS_DB.get(id + ":time")))
-+      return Video.new({
-+        id:      id,
-+        info:    JSON.parse(info).as_h,
-+        updated: Time.parse(time, "%Y-%m-%d %H:%M:%S %z", Time::Location::UTC),
-+      })
-+    else
-+      return nil
-+    end
-   end
- end
-diff --git a/src/invidious/videos.cr b/src/invidious/videos.cr
-index 6d0cf9ba..dde35291 100644
---- a/src/invidious/videos.cr
-+++ b/src/invidious/videos.cr
-@@ -400,7 +400,7 @@ def get_video(id, refresh = true, region = nil, force_refresh = false)
-        video.schema_version != Video::SCHEMA_VERSION # cache control
-       begin
-         video = fetch_video(id, region)
--        Invidious::Database::Videos.update(video)
-+        Invidious::Database::Videos.insert(video)
-       rescue ex
-         Invidious::Database::Videos.delete(id)
-         raise ex
--- 
-2.46.0
-

patches/014-rewrite-obnoxious-blocked-message.patch

@@ -7,8 +7,8 @@ index b2df682d..7534ef31 100644
    locale = env.get("preferences").as(Preferences).locale
  
 -  error_message = translate(locale, message)
-+  if message == "This helps protect our community. Learn more"
++  if message.includes?("This helps protect our community") || message.includes?("Watch on the latest version of YouTube") || message.includes?("Sign in to confirm you’re not a bot") || message.includes?("Please sign in") || message.includes?("This content isn't available, try again later")
-+    error_message = "<h2>Instance is blocked temporarily</h2><p>This instance uses proxies to bypass blockage from YouTube.<br/>Right now, all of those proxies are blocked.</p><p>Please <b>wait for up to two minutes</b> until the automated background script has sucessfully rotated the proxies and refresh this site afterwards.</p><p>Please don't spam the refresh button, this won't make the process faster.</p><p><b>Please don't report this issue on github, we already know.</b></p>"
++    error_message = "<h2>Error loading video</h2><p style='font-size: 0.8em; margin: -20px 0 20px 0;'>Received error from YouTube: " + message + "<br /><br />Please try reloading the page or try switching to another backend.</p>"
 +  else
 +    error_message = translate(locale, message)
 +  end

scripts/deploy-database.sh

@@ -18,7 +18,7 @@ sudo systemctl start postgresql.service
 sudo systemctl enable postgresql.service
 
 #
-# Create databse and user
+# Create database and user
 #
 
 if [ "$interactive" = "true" ]; then
@@ -56,5 +56,6 @@ if [ "$interactive" = "true" ]; then
 	echo
 	echo "host  invidious  invidious  127.0.0.1/32  md5"
 	echo "host  invidious  invidious  ::1/128       md5"
+	echo "host  invidious  invidious  192.42.6.0/24 md5"
 	echo
 fi