* fix(peertube): drain admin-ops results to a separate dir (fixes start-limit loop, ref #798)
The root peertube-ops.path watches OPS_DIR with DirectoryNotEmpty=. process-ops
wrote each <id>.result.json back into OPS_DIR, so the directory was never empty
after draining a request → the .path re-triggered peertube-ops.service in a tight
loop until systemd killed it with start-limit-hit, after which the mechanism died
after the first op.
Write results to a dedicated /run/secubox/peertube/results/ instead; process-ops
rm's the request, leaving OPS_DIR empty so the watcher goes idle. The API's
_read_op_result now polls RESULTS_DIR. tmpfiles + postinst create the dir
(0750 secubox:secubox); peertubectl honors SECUBOX_PEERTUBE_RESULTS_DIR.
test_process_ops.sh asserts results land in results/ and OPS_DIR is empty after
draining (regression guard); test_ops_api monkeypatches both dirs.
Verified live on gk2: two consecutive pings drain cleanly, NRestarts=0, no
start-limit-hit, results root:secubox 0640 (secubox-readable).
* fix(peertube): upgrade CWD must be peertube-latest/scripts + surface the error (ref #798)
The webui upgrade button failed with a generic "upgrade script failed" and no detail.
Two bugs in cmd_upgrade:
1. Wrong CWD. PeerTube's v8 shim peertube-latest/scripts/upgrade.sh execs
`../dist/scripts/upgrade.sh` relative to CWD, and that dist script runs
`node -e "require('js-yaml')…"` whose resolution is also CWD-relative. Running from
`cd /var/www/peertube` made `../dist` → /var/www/dist (missing) → "cannot open
../dist/scripts/upgrade.sh"; a neutral CWD instead fails "Cannot find module
'js-yaml'". Fix: cd /var/www/peertube/peertube-latest/scripts (../dist resolves,
and require() walks up to peertube-latest/node_modules).
2. Error was discarded to /dev/null, so the result only said "upgrade script failed".
Now capture to /run/secubox/peertube/upgrade-<id>.log and fold the last lines into
the error detail.
Verified live: with the corrected CWD, 8.2.0 → 8.2.2 upgraded cleanly (download + deps
+ migrations), service restarted, /api/v1/config 200, serverVersion 8.2.2.
---------
Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
YouTube hard-blocks server IPs ("Sign in to confirm you're not a bot") — no
yt-dlp version or player_client bypass works (tested); cookies from a logged-in
browser are the only reliable fix. New verb installs a Netscape cookies.txt into
the LXC at storage/tmp-persistent/youtube-cookies.txt (where PeerTube's
wrapWithCookiesOptions reads it), enables import.videos.http.cookies.enabled,
and restarts. Operator: export cookies.txt → scp to board →
`peertubectl set-youtube-cookies cookies.txt`.
Aligns the package with what's actually deployed on gk2 (validated live at
https://peertube.gk2.secubox.in/, upload confirmed) and adds yt-dlp URL import.
- lib/peertube/install-lxc.sh (NEW): idempotent native PeerTube install in a
dedicated Debian LXC (10.100.0.120 on br-lxc), mirroring grafana/yacy. Bakes
in every fix from the live bring-up: Node 22 via signed NodeSource repo (8.x
needs >=22, no curl|bash); pnpm with MSGPACKR_NATIVE_ACCELERATION_DISABLED=1
(arm64); debian.common.conf template (postgres-15 needs it); bind mounts
/data/peertube/{storage,config,postgres,redis} chown'd to LXC root UID;
production.yaml patch (listen 0.0.0.0:9000, https/hostname/443, secret, db,
admin email, import.videos.http.enabled=true); captures first-boot root
password to /etc/secubox/secrets/peertube-admin.
- sbin/peertubectl (NEW): install/status/start/stop/restart/logs/reload.
- conf/peertube.nginx.conf (folds #390, port corrected to LXC :9000 not the
stale 127.0.0.1:9001 Docker-on-host plan): public vhost :9080 -> 10.100.0.120
:9000, 8G uploads, 7d streaming timeouts, WS, ACME; WAF-bypass (gitea pattern).
- api/main.py: talk to the native instance over HTTP at <lxc_ip>:<http_port>
with Host: <public_hostname> header (PeerTube 403s on raw-IP Host) instead of
podman/docker exec; status reports real LXC state + reachability; /container/*
drive the LXC via peertubectl; NEW POST /import + GET /imports.
- www/peertube/index.html: new "Import" tab (URL + channel + privacy + recent
imports); status/labels/links corrected for native-LXC.
- debian/control + service: reframe Docker/Podman -> native-LXC; drop
Wants=podman/docker. conf/peertube.toml.example (NEW). README + changelog 1.1.0.
