siftlode/backend/app/downloads
npeter83 03a1865aa8 feat(downloads): automatic PO-token provider (bgutil sidecar) to beat YouTube bot-detection
YouTube increasingly demands a Proof-of-Origin token (or shows 'confirm you're not a bot').
Instead of manual cookies, run the bgutil POT provider as a sidecar that mints tokens on demand:
- compose: bgutil-pot service (brainicism/bgutil-ytdlp-pot-provider:1.3.1, port 4416, init)
- requirements: bgutil-ytdlp-pot-provider==1.3.1 plugin (version pinned to the image)
- config: DOWNLOAD_POT_BASE_URL (http://bgutil-pot:4416) + DOWNLOAD_PLAYER_CLIENTS
  (web_safari,web,tv — POT-capable; the default android_vr client never requests a token)
- formats.build_ydl_opts wires extractor_args youtube:player_client + youtubepot-bgutilhttp:base_url

Verified: the sidecar mints a valid PO token (BotGuard challenge solved) and yt-dlp fetches it
from the provider. NOTE: end-to-end download couldn't be confirmed here because the test IP got
hard-flagged by YouTube from heavy testing (~16 GB + dozens of extractions) — a hard abuse block
needs cooldown/cookies, which POT doesn't lift; POT bypasses the normal soft bot-check.
2026-07-03 04:40:10 +02:00
..
__init__.py fix(downloads): add the downloads package (was wrongly gitignored) + robust sanitizer 2026-07-03 00:19:22 +02:00
formats.py feat(downloads): automatic PO-token provider (bgutil sidecar) to beat YouTube bot-detection 2026-07-03 04:40:10 +02:00
gc.py feat(downloads): M3 — per-user quota + retention GC 2026-07-03 00:26:40 +02:00
quota.py feat(downloads): M4 — REST API (enqueue, manage, file-serve, sharing, admin) 2026-07-03 00:34:08 +02:00
service.py fix(downloads): show real title + thumbnail while queued/downloading 2026-07-03 02:23:21 +02:00
storage.py fix(downloads): strip emoji from device filename + free disk when a download is deleted 2026-07-03 02:16:36 +02:00