PR Testing/403 Errors with invidious-companion

[JerboaGobi]

Hopefully this is the correct place to reach out. I was doing some testing for PR#4985 on the invidious repository. I built the invidous-companion branch as well as the invidious-companion master branch.

Removed references to sig_helper in the invidious config.yml, adding the lines for the companion public/private urls as well as the secret key.

Updated my compose files to point to the local images and am getting the 403 errors when accessing videos. Not seeing any errors within the companion logs, all post requests return 200. Enabled trace logs invidious and I can see the video URLs being returned, seems that the *googlevideo.com urls are all returning a 403 error. This is a private non-public invidious instance, my home IP to the best of my knowledge hasn't been blocked. I was running sig_helper and invidious up until yesterday without 403 errors. Generally, anytime I get 403 errors rebuilding against master or latest resolves the issues, pretty sure that's a common task since youtube frequently makes changes breaking things.

The media could not be loaded, either because the server or network failed or because the format is not supported.

I can provide logs but I'm not completely sure what values might be considered private/secret and need to be masked.

[bbsixzz]

Could you please provide installation instructions?

This is my docker-compose:

services:

  invidious:
    image: quay.io/invidious/invidious:master
    dns:
      - 192.168.10.1
    ports:
      - 3000:3000
    environment:
      # Please read the following file for a comprehensive list of all available
      # configuration options and their associated syntax:
      # https://github.com/iv-org/invidious/blob/master/config/config.example.yml
      INVIDIOUS_CONFIG: |
        db:
          dbname: invidious
          user: kemal
          password: kemal
          host: invidious-db
          port: 5432
        check_tables: true
        signature_server: inv_sig_helper:12999
        visitor_data: foo
        po_token: foo
        external_port: 3000
        domain: 192.168.10.2
        # https_only: false
        # statistics_enabled: false
        hmac_key: foo
    healthcheck:
      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/api/v1/comments/jNQXAC9IVRw || exit 1
      interval: 30s
      timeout: 5s
      retries: 2
    logging:
      options:
        max-size: "1G"
        max-file: "4"
    depends_on:
      - invidious-db

  inv_sig_helper:
    image: quay.io/invidious/inv-sig-helper:latest
    command: ["--tcp", "0.0.0.0:12999"]
    environment:
      - RUST_LOG=info
    restart: unless-stopped
    cap_drop:
      - ALL
    read_only: true
    security_opt:
      - no-new-privileges:true

  invidious-db:
    image: docker.io/library/postgres:14
    restart: unless-stopped
    volumes:
      - postgresdata:/var/lib/postgresql/data
      - ./config/sql:/config/sql
      - ./docker/init-invidious-db.sh:/docker-entrypoint-initdb.d/init-invidious-db.sh
    environment:
      POSTGRES_DB: invidious
      POSTGRES_USER: kemal
      POSTGRES_PASSWORD: kemal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]

volumes:
  postgresdata:

Preferably I would like to run deno as a container as well in my other docker-compose.

I'm on debian.

Cheers

[unixfox]

Hello,
If you are not really tinkerer in mind, I would suggest refraining from testing the PR. There is a lack of docs which probably explain the various issues.

[rockerBOO]

I ran into the same issue but figured out the missing parts. Obviously these may change as this matures, with settings and documentation.

The companion needs to be available from your client (browser) as well as from invidious. You should see requests to the companion in the browser to confirm.

services:

  invidious-companion:
    image: quay.io/invidious/invidious-companion:latest # or build your invidious-companion container 
    restart: unless-stopped
    ports:
      - "127.0.0.1:8282:8282" 
    environment:
      - SERVER_SECRET_KEY=CHANGE_ME!!SAME_AS_INVIDIOUS_COMPANION_SECRET_KEY_FROM_INVIDIOUS_CONFIG
  
  invidious:
    environment:
      INVIDIOUS_CONFIG: |
        invidious_companion:
          - private_url: "http://invidious-companion:8282/"
            public_url: "http://localhost:8282/"
        invidious_companion_key: CHANGE_ME!!

Note that this works right now but I am seeing various configuration options that could change how this is working in the future.

Edit: Note the documentation has been updated so refer to it on setting up the companion appropriately.

[JerboaGobi]

@rockerBOO Thanks for those extra details. That was the missing piece that I wasn't aware of. I must not have looked to closely at the browser developer network logs as I didn't initially see the localhost:8282 requests but after your comment I noticed them plain as day.

I set SERVER_BASE_URL in my .env file along with the secret key since I'm running my setup behind a reverse proxy. That was the final prerequisite to get functional playback.