superconfig/2configs/dns/ at 6c344c555a4feaf36327cd56db2ed8dd91e42683 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / 2configs / dns

2 files

at 6c344c555a4feaf36327cd56db2ed8dd91e42683

lassulus 2configs/services/invidious: youtube frontend on neoprism (yt.lassul.us) 2mo ago

knot: refresh stale robotns2.second-ns.de NOTIFY targets Hetzner rotated robotns2.second-ns.de's addresses on 2023-12-04; the acl block was updated then but the remote/NOTIFY targets were missed, so pushes to that slave were going to dead IPs.

5 months ago

2configs/services/invidious: youtube frontend on neoprism (yt.lassul.us) invidious plus invidious-companion, with every request to YouTube going out through the residential exits on styx (primary) and coaxmetal (backup). An nginx stream block fans 127.0.0.1:8118 into the two tinyproxies; failover rather than round-robin, because YouTube binds po_tokens and videoplayback URLs to the requesting address. The companion key is generated once into a clan var and handed to invidious as a systemd credential (the config script runs as the DynamicUser, which cannot read /run/secrets) and to the container as an EnvironmentFile. default_user_preferences.local is forced on: upstream defaults it off, which makes invidious hand the browser raw googlevideo URLs that are minted for the exit's address, so they 403 for the client and leak the exit IP. Playback paths additionally require a real session via auth_request, since the bytes come off a residential line. invidious is pinned one release ahead of our nixpkgs for the comments parser fix; drop the override once the pin catches up. Livestreams do not play: YouTube serves them SABR-only or with HLS segments that 403 without a po_token, and invidious' HLS path bypasses companion. Upstream gap, tracked in iv-org/invidious#3811 and iv-org/invidious-companion#7.

2 months ago