forked from
lass.pds.lassul.us/superconfig
This repository has no description
2configs/residential-exit: forward proxy for youtube traffic on styx + coaxmetal
YouTube throttles and blocks Hetzner ranges, so neoprism cannot talk to
it directly. tinyproxy listens on the retiolum address of each box and
only accepts neoprism, giving invidious a residential exit.
author
lassulus
date
(Aug 6, 2026, 2:08 PM CEST)
commit
9ad8a2b4
9ad8a2b437f9b0e38793459556b062e2a2016111
parent
16fbb947
16fbb947662def7b5e80f24a0ffe52c06e61bf83
+47
+45
2configs/residential-exit.nix
+45
2configs/residential-exit.nix
···
1
+
{ config, ... }:
2
+
3
+
let
4
+
self = config.krebs.build.host.nets.retiolum;
5
+
neoprism = config.krebs.hosts.neoprism.nets.retiolum;
6
+
port = 8118;
7
+
in
8
+
{
9
+
# Forward proxy that lets neoprism push YouTube traffic out over this box's
10
+
# residential line. YouTube throttles and captchas Hetzner ranges hard, so
11
+
# invidious (2configs/services/invidious.nix) tunnels every innertube call
12
+
# and video stream through here instead of using neoprism's own address.
13
+
services.tinyproxy = {
14
+
enable = true;
15
+
settings = {
16
+
Listen = self.ip4.addr;
17
+
Port = port;
18
+
# never an open proxy: only neoprism may use this exit
19
+
Allow = neoprism.ip4.addr;
20
+
# everything invidious does is https, so CONNECT needs nothing else
21
+
ConnectPort = 443;
22
+
# video streams are long-lived; the default 600s is plenty per request
23
+
Timeout = 600;
24
+
MaxClients = 128;
25
+
DisableViaHeader = true;
26
+
# one line per proxied request would be pure noise at video chunk rates
27
+
LogLevel = "Warning";
28
+
};
29
+
};
30
+
31
+
# Listen binds a retiolum address, which only exists once tinc is up. Retry
32
+
# forever instead of hitting the default start limit and staying dead.
33
+
systemd.services.tinyproxy = {
34
+
after = [ "tinc.retiolum.service" ];
35
+
unitConfig.StartLimitIntervalSec = 0;
36
+
serviceConfig.RestartSec = "5s";
37
+
};
38
+
39
+
krebs.iptables.tables.filter.INPUT.rules = [
40
+
{
41
+
predicate = "-i retiolum -p tcp --dport ${toString port}";
42
+
target = "ACCEPT";
43
+
}
44
+
];
45
+
}
+1
machines/coaxmetal/config.nix
+1
machines/coaxmetal/config.nix