CI: Fix build-docker job not checking if Invidious starts successfully or not

Dockerfile and Dockerfile.arm64 already build Invidious without release mode if
`release` argument is not present.

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "docker"
+    directory: "/docker"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: "weekly"

.github/workflows/build-nightly-container.yml

@@ -17,17 +17,27 @@ on:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-latest
+            platform: linux/amd64
+            name: "AMD64"
+            dockerfile: "docker/Dockerfile"
+            tag_suffix: ""
+            # GitHub doesn't have a ubuntu-latest-arm runner
+          - os: ubuntu-24.04-arm
+            platform: linux/arm64/v8
+            name: "ARM64"
+            dockerfile: "docker/Dockerfile.arm64"
+            tag_suffix: "-arm64"
+
+    runs-on: ${{ matrix.os }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-        with:
-          platforms: arm64
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -43,45 +53,22 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: quay.io/invidious/invidious
+          flavor: |
+            suffix=${{ matrix.tag_suffix }}
           tags: |
             type=sha,format=short,prefix={{date 'YYYY.MM.DD'}}-,enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
             type=raw,value=master,enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
           labels: |
             quay.expires-after=12w
 
-      - name: Build and push Docker AMD64 image for Push Event
+      - name: Build and push Docker ${{ matrix.name }} image for Push Event
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
-          file: docker/Dockerfile
+          file:  ${{ matrix.dockerfile }}
-          platforms: linux/amd64
+          platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           build-args: |
             "release=1"
-
-      - name: Docker meta
-        id: meta-arm64
-        uses: docker/metadata-action@v5
-        with:
-          images: quay.io/invidious/invidious
-          flavor: |
-            suffix=-arm64
-          tags: |
-            type=sha,format=short,prefix={{date 'YYYY.MM.DD'}}-,enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
-            type=raw,value=master,enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
-          labels: |
-            quay.expires-after=12w
-
-      - name: Build and push Docker ARM64 image for Push Event
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: docker/Dockerfile.arm64
-          platforms: linux/arm64/v8
-          labels: ${{ steps.meta-arm64.outputs.labels }}
-          push: true
-          tags: ${{ steps.meta-arm64.outputs.tags }}
-          build-args: |
-            "release=1"

.github/workflows/build-stable-container.yml

@@ -8,17 +8,27 @@ on:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-latest
+            platform: linux/amd64
+            name: "AMD64"
+            dockerfile: "docker/Dockerfile"
+            tag_suffix: ""
+            # GitHub doesn't have a ubuntu-latest-arm runner
+          - os: ubuntu-24.04-arm
+            platform: linux/arm64/v8
+            name: "ARM64"
+            dockerfile: "docker/Dockerfile.arm64"
+            tag_suffix: "-arm64"
+
+    runs-on: ${{ matrix.os }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-        with:
-          platforms: arm64
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -36,46 +46,21 @@ jobs:
           images: quay.io/invidious/invidious
           flavor: |
             latest=false
+            suffix=${{ matrix.tag_suffix }}
           tags: |
             type=semver,pattern={{version}}
             type=raw,value=latest
           labels: |
             quay.expires-after=12w
 
-      - name: Build and push Docker AMD64 image for Push Event
+      - name: Build and push Docker ${{ matrix.name }} image for Push Event
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
-          file: docker/Dockerfile
+          file:  ${{ matrix.dockerfile }}
-          platforms: linux/amd64
+          platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           build-args: |
             "release=1"
-
-      - name: Docker meta
-        id: meta-arm64
-        uses: docker/metadata-action@v5
-        with:
-          images: quay.io/invidious/invidious
-          flavor: |
-            latest=false
-            suffix=-arm64
-          tags: |
-            type=semver,pattern={{version}}
-            type=raw,value=latest
-          labels: |
-            quay.expires-after=12w
-
-      - name: Build and push Docker ARM64 image for Push Event
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: docker/Dockerfile.arm64
-          platforms: linux/arm64/v8
-          labels: ${{ steps.meta-arm64.outputs.labels }}
-          push: true
-          tags: ${{ steps.meta-arm64.outputs.tags }}
-          build-args: |
-            "release=1"

.github/workflows/ci.yml

@@ -38,10 +38,11 @@ jobs:
       matrix:
         stable: [true]
         crystal:
-          - 1.12.1
+          - 1.12.2
-          - 1.13.2
+          - 1.13.3
-          - 1.14.0
+          - 1.14.1
-          - 1.15.0
+          - 1.15.1
+          - 1.16.3
         include:
           - crystal: nightly
             stable: false
@@ -57,12 +58,12 @@ jobs:
         shell: bash
 
       - name: Install Crystal
-        uses: crystal-lang/install-crystal@v1.8.0
+        uses: crystal-lang/install-crystal@v1.8.2
         with:
           crystal: ${{ matrix.crystal }}
 
       - name: Cache Shards
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ./lib
@@ -82,46 +83,43 @@ jobs:
         run: crystal build --warnings all --error-on-warnings --error-trace src/invidious.cr
 
   build-docker:
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-latest
+            name: "AMD64"
+            # GitHub doesn't have a ubuntu-latest-arm runner
+          - os: ubuntu-24.04-arm
+            name: "ARM64"
 
-    runs-on: ubuntu-latest
+    name: Test ${{ matrix.name }} Docker build
+    runs-on: ${{ matrix.os }}
 
     steps:
       - uses: actions/checkout@v4
 
+      - name: Use ARM64 Dockerfile if ARM64
+        if: ${{ matrix.name }} == "ARM64"
+        run: sed -i 's/Dockerfile/Dockerfile.arm64/' docker-compose.yml
+
       - name: Build Docker
-        run: docker compose build --build-arg release=0
+        run: docker compose build
+
+      - name: Change hmac_key on docker-compose.yml
+        run: sed -i '/hmac_key/s/CHANGE_ME!!/docker-build-hmac-key/' docker-compose.yml
 
       - name: Run Docker
         run: docker compose up -d
 
       - name: Test Docker
-        run: while curl -Isf http://localhost:3000; do sleep 1; done
+        id: test
+        run: curl -If http://localhost:3000 --retry 5 --retry-delay 1 --retry-all-errors
 
-  build-docker-arm64:
+      - name: Print Invidious container logs
-
+        # Tells Github Actions to always run this step regardless of whether the previous step has failed
-    runs-on: ubuntu-latest
+        # Without this expression this step would simply be skipped when the previous step fails.
-
+        if: success() || steps.test.conclusion == 'failure'
-    steps:
+        run: docker compose logs
-      - uses: actions/checkout@v4
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-        with:
-          platforms: arm64
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build Docker ARM64 image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: docker/Dockerfile.arm64
-          platforms: linux/arm64/v8
-          build-args: release=0
-
-      - name: Test Docker
-        run: while curl -Isf http://localhost:3000; do sleep 1; done
 
   lint:
 
@@ -136,12 +134,12 @@ jobs:
 
       - name: Install Crystal
         id: lint_step_install_crystal
-        uses: crystal-lang/install-crystal@v1.8.0
+        uses: crystal-lang/install-crystal@v1.8.2
         with:
           crystal: latest
 
       - name: Cache Shards
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ./lib

.github/workflows/stale.yml

@@ -10,7 +10,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/stale@v8
+    - uses: actions/stale@v9
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         days-before-stale: 730

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## vX.Y.0 (future)
 
+## v2.20250504.0
+
+Small release with quick workaround fix for issue #4251 (Nil assertion failed).
+
+PR: https://github.com/iv-org/invidious/issues/5263
+
 ## v2.20250314.0
 
 ### Wrap-up

README.md

@@ -81,9 +81,9 @@
 - [Available in many languages](locales/), thanks to [our translators](#contribute)
 
 **Data import/export**
-- Import subscriptions from YouTube, NewPipe and Freetube
+- Import subscriptions from YouTube, NewPipe and FreeTube
 - Import watch history from YouTube and NewPipe
-- Export subscriptions to NewPipe and Freetube
+- Export subscriptions to NewPipe and FreeTube
 - Import/Export Invidious user data
 
 **Technical features**
@@ -95,11 +95,11 @@
 
 ## Quick start
 
-**Using invidious:**
+**Using Invidious:**
 
 - [Select a public instance from the list](https://instances.invidious.io) and start watching videos right now!
 
-**Hosting invidious:**
+**Hosting Invidious:**
 
 - [Follow the installation instructions](https://docs.invidious.io/installation/)
 
@@ -114,8 +114,8 @@ https://github.com/iv-org/documentation
 ### Extensions
 
 We highly recommend the use of [Privacy Redirect](https://github.com/SimonBrazell/privacy-redirect#get),
-a browser extension that automatically redirects Youtube URLs to any Invidious instance and replaces
+a browser extension that automatically redirects YouTube URLs to any Invidious instance and replaces
-embedded youtube videos on other websites with invidious.
+embedded YouTube videos on other websites with Invidious.
 
 The documentation contains a list of browser extensions that we recommended to use along with Invidious.
 
@@ -140,7 +140,7 @@ We use [Weblate](https://weblate.org) to manage Invidious translations.
 You can suggest new translations and/or correction here: https://hosted.weblate.org/engage/invidious/.
 
 Creating an account is not required, but recommended, especially if you want to contribute regularly.
-Weblate also allows you to log-in with major SSO providers like Github, Gitlab, BitBucket, Google, ...
+Weblate also allows you to log-in with major SSO providers like GitHub, GitLab, BitBucket, Google, ...
 
 
 ## Projects using Invidious

config/config.example.yml

@@ -54,6 +54,53 @@ db:
 ##
 #signature_server:
 
+##
+## Invidious companion is an external program
+## for loading the video streams from YouTube servers.
+##
+## When this setting is commented out, Invidious companion is not used.
+## Otherwise, Invidious will proxy the requests to Invidious companion.
+## 
+## Note: multiple URL can be configured. In this case, invidious will
+## randomly pick one every time video data needs to be retrieved. This
+## URL is then kept in the video metadata cache to allow video playback
+## to work. Once said cache has expired, requesting that video's data
+## again will cause a new companion URL to be picked.
+##
+## The parameter private_url needs to be configured for the internal
+## communication between the companion and Invidious.
+## And public_url is the public URL from which companion is listening
+## to the requests from the user(s).
+##
+## If you are using a reverse proxy then you will probably need to
+## configure the public_url to be the same as the domain used for Invidious.
+## Also apply when used from an external IP address (without a domain).
+## Examples: https://MYINVIDIOUSDOMAIN or http://192.168.1.100:8282
+##
+## Both parameter can have identical URL when Invidious is hosted in
+## an internal network or at home or locally (localhost).
+##
+## Accepted values: "http(s)://<IP-HOSTNAME>:<Port>"
+## Default: <none>
+##
+#invidious_companion:
+#  - private_url: "http://localhost:8282"
+#    public_url: "http://localhost:8282"
+
+##
+## API key for Invidious companion, used for securing the communication
+## between Invidious and Invidious companion.
+## The key needs to be exactly 16 characters long.
+##
+## Note: This parameter is mandatory when Invidious companion is enabled
+## and should be a random string.
+## Such random string can be generated on linux with the following
+## command: `pwgen 16 1`
+##
+## Accepted values: a string (of length 16)
+## Default: <none>
+##
+#invidious_companion_key: "CHANGE_ME!!"
 
 #########################################
 #
@@ -811,9 +858,9 @@ default_user_preferences:
   ## Default video quality.
   ##
   ## Accepted values: dash, hd720, medium, small
-  ## Default: hd720
+  ## Default: dash
   ##
-  #quality: hd720
+  #quality: dash
 
   ##
   ## Default dash video quality.

docker-compose.yml

@@ -14,6 +14,10 @@ services:
     restart: unless-stopped
     ports:
       - "127.0.0.1:3000:3000"
+    depends_on:
+      invidious-db:
+        condition: service_healthy
+        restart: true
     environment:
       # Please read the following file for a comprehensive list of all available
       # configuration options and their associated syntax:

docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM crystallang/crystal:1.12.2-alpine AS builder
+FROM crystallang/crystal:1.16.3-alpine AS builder
 
 RUN apk add --no-cache sqlite-static yaml-static
 
@@ -32,7 +32,7 @@ RUN --mount=type=cache,target=/root/.cache/crystal if [[ "${release}" == 1 ]] ;
         --link-flags "-lxml2 -llzma"; \
     fi
 
-FROM alpine:3.20
+FROM alpine:3.21
 RUN apk add --no-cache rsvg-convert ttf-opensans tini tzdata
 WORKDIR /invidious
 RUN addgroup -g 1000 -S invidious && \

docker/Dockerfile.arm64

@@ -1,5 +1,5 @@
-FROM alpine:3.20 AS builder
+FROM alpine:3.21 AS builder
-RUN apk add --no-cache 'crystal=1.12.2-r0' shards sqlite-static yaml-static yaml-dev libxml2-static \
+RUN apk add --no-cache 'crystal=1.14.0-r0' shards sqlite-static yaml-static yaml-dev libxml2-static \
        zlib-static openssl-libs-static openssl-dev musl-dev xz-static
 
 ARG release
@@ -33,7 +33,7 @@ RUN --mount=type=cache,target=/root/.cache/crystal if [[ "${release}" == 1 ]] ;
         --link-flags "-lxml2 -llzma"; \
     fi
 
-FROM alpine:3.20
+FROM alpine:3.21
 RUN apk add --no-cache rsvg-convert ttf-opensans tini tzdata
 WORKDIR /invidious
 RUN addgroup -g 1000 -S invidious && \

shard.yml

@@ -1,5 +1,5 @@
 name: invidious
-version: 2.20250314.0
+version: 2.20250314.0-dev
 
 authors:
   - Invidious team <contact@invidious.io>

src/invidious.cr

@@ -97,6 +97,10 @@ YT_POOL = YoutubeConnectionPool.new(YT_URL, capacity: CONFIG.pool_size)
 
 GGPHT_POOL = YoutubeConnectionPool.new(URI.parse("https://yt3.ggpht.com"), capacity: CONFIG.pool_size)
 
+COMPANION_POOL = CompanionConnectionPool.new(
+  capacity: CONFIG.pool_size
+)
+
 # CLI
 Kemal.config.extra_options do |parser|
   parser.banner = "Usage: invidious [arguments]"
@@ -167,16 +171,9 @@ DECRYPT_FUNCTION =
   if sig_helper_address = CONFIG.signature_server.presence
     IV::DecryptFunction.new(sig_helper_address)
   else
-    LOGGER.warn("WARNING: inv-sig-helper is required for video playback. For more information see https://docs.invidious.io/installation")
     nil
   end
 
-{% for field in %w(po_token visitor_data) %}
-  if !CONFIG.{{field.id}}
-    LOGGER.warn("WARNING: {{field.id}} is required to view and playback videos. For more information see https://docs.invidious.io/installation")
-  end
-{% end %}
-
 # Start jobs
 
 if CONFIG.channel_threads > 0

src/invidious/config.cr

@@ -35,7 +35,7 @@ struct ConfigPreferences
   property max_results : Int32 = 40
   property notifications_only : Bool = false
   property player_style : String = "invidious"
-  property quality : String = "hd720"
+  property quality : String = "dash"
   property quality_dash : String = "auto"
   property default_home : String? = "Popular"
   property feed_menu : Array(String) = ["Popular", "Trending", "Subscriptions", "Playlists"]
@@ -74,6 +74,16 @@ end
 class Config
   include YAML::Serializable
 
+  class CompanionConfig
+    include YAML::Serializable
+
+    @[YAML::Field(converter: Preferences::URIConverter)]
+    property private_url : URI = URI.parse("")
+
+    @[YAML::Field(converter: Preferences::URIConverter)]
+    property public_url : URI = URI.parse("")
+  end
+
   # Number of threads to use for crawling videos from channels (for updating subscriptions)
   property channel_threads : Int32 = 1
   # Time interval between two executions of the job that crawls channel videos (subscriptions update).
@@ -160,6 +170,12 @@ class Config
   # poToken for passing bot attestation
   property po_token : String? = nil
 
+  # Invidious companion
+  property invidious_companion : Array(CompanionConfig) = [] of CompanionConfig
+
+  # Invidious companion API key
+  property invidious_companion_key : String = ""
+
   # Saved cookies in "name1=value1; name2=value2..." format
   @[YAML::Field(converter: Preferences::StringToCookies)]
   property cookies : HTTP::Cookies = HTTP::Cookies.new
@@ -240,6 +256,27 @@ class Config
         end
     {% end %}
 
+    if config.invidious_companion.present?
+      # invidious_companion and signature_server can't work together
+      if config.signature_server
+        puts "Config: You can not run inv_sig_helper and invidious_companion at the same time."
+        exit(1)
+      elsif config.invidious_companion_key.empty?
+        puts "Config: Please configure a key if you are using invidious companion."
+        exit(1)
+      elsif config.invidious_companion_key == "CHANGE_ME!!"
+        puts "Config: The value of 'invidious_companion_key' needs to be changed!!"
+        exit(1)
+      elsif config.invidious_companion_key.size != 16
+        puts "Config: The value of 'invidious_companion_key' needs to be a size of 16 characters."
+        exit(1)
+      end
+    elsif config.signature_server
+      puts("WARNING: inv-sig-helper is deprecated. Please switch to Invidious companion: https://docs.invidious.io/companion-installation/")
+    else
+      puts("WARNING: Invidious companion is required to view and playback videos. For more information see https://docs.invidious.io/companion-installation/")
+    end
+
     # HMAC_key is mandatory
     # See: https://github.com/iv-org/invidious/issues/3854
     if config.hmac_key.empty?

src/invidious/frontend/watch_page.cr

@@ -23,10 +23,16 @@ module Invidious::Frontend::WatchPage
       return "<p id=\"download\">#{translate(locale, "Download is disabled")}</p>"
     end
 
+    url = "/download"
+    if (CONFIG.invidious_companion.present?)
+      invidious_companion = CONFIG.invidious_companion.sample
+      url = "#{invidious_companion.public_url}/download?check=#{invidious_companion_encrypt(video.id)}"
+    end
+
     return String.build(4000) do |str|
       str << "<form"
       str << " class=\"pure-form pure-form-stacked\""
-      str << " action='/download'"
+      str << " action='#{url}'"
       str << " method='post'"
       str << " rel='noopener'"
       str << " target='_blank'>"

src/invidious/helpers/utils.cr

@@ -383,3 +383,22 @@ def parse_link_endpoint(endpoint : JSON::Any, text : String, video_id : String)
   end
   return text
 end
+
+def encrypt_ecb_without_salt(data, key)
+  cipher = OpenSSL::Cipher.new("aes-128-ecb")
+  cipher.encrypt
+  cipher.key = key
+
+  io = IO::Memory.new
+  io.write(cipher.update(data))
+  io.write(cipher.final)
+  io.rewind
+
+  return io
+end
+
+def invidious_companion_encrypt(data)
+  timestamp = Time.utc.to_unix
+  encrypted_data = encrypt_ecb_without_salt("#{timestamp}|#{data}", CONFIG.invidious_companion_key)
+  return Base64.urlsafe_encode(encrypted_data)
+end

src/invidious/routes/api/manifest.cr

@@ -8,6 +8,11 @@ module Invidious::Routes::API::Manifest
     id = env.params.url["id"]
     region = env.params.query["region"]?
 
+    if CONFIG.invidious_companion.present?
+      invidious_companion = CONFIG.invidious_companion.sample
+      return env.redirect "#{invidious_companion.public_url}/api/manifest/dash/id/#{id}?#{env.params.query}"
+    end
+
     # Since some implementations create playlists based on resolution regardless of different codecs,
     # we can opt to only add a source to a representation if it has a unique height within that representation
     unique_res = env.params.query["unique_res"]?.try { |q| (q == "true" || q == "1").to_unsafe }

src/invidious/routes/embed.cr

@@ -203,6 +203,14 @@ module Invidious::Routes::Embed
       return env.redirect url
     end
 
+    if CONFIG.invidious_companion.present?
+      invidious_companion = CONFIG.invidious_companion.sample
+      env.response.headers["Content-Security-Policy"] =
+        env.response.headers["Content-Security-Policy"]
+          .gsub("media-src", "media-src #{invidious_companion.public_url}")
+          .gsub("connect-src", "connect-src #{invidious_companion.public_url}")
+    end
+
     rendered "embed"
   end
 end

src/invidious/routes/video_playback.cr

@@ -21,7 +21,7 @@ module Invidious::Routes::VideoPlayback
     end
 
     # Sanity check, to avoid being used as an open proxy
-    if !host.matches?(/[\w-]+.googlevideo.com/)
+    if !host.matches?(/[\w-]+\.(?:googlevideo|c\.youtube)\.com/)
       return error_template(400, "Invalid \"host\" parameter.")
     end
 
@@ -37,7 +37,8 @@ module Invidious::Routes::VideoPlayback
 
     # See: https://github.com/iv-org/invidious/issues/3302
     range_header = env.request.headers["Range"]?
-    if range_header.nil?
+    sq = query_params["sq"]?
+    if range_header.nil? && sq.nil?
       range_for_head = query_params["range"]? || "0-640"
       headers["Range"] = "bytes=#{range_for_head}"
     end
@@ -256,6 +257,11 @@ module Invidious::Routes::VideoPlayback
   # YouTube /videoplayback links expire after 6 hours,
   # so we have a mechanism here to redirect to the latest version
   def self.latest_version(env)
+    if CONFIG.invidious_companion.present?
+      invidious_companion = CONFIG.invidious_companion.sample
+      return env.redirect "#{invidious_companion.public_url}/latest_version?#{env.params.query}"
+    end
+
     id = env.params.query["id"]?
     itag = env.params.query["itag"]?.try &.to_i?
 

src/invidious/routes/watch.cr

@@ -192,6 +192,14 @@ module Invidious::Routes::Watch
       captions: video.captions
     )
 
+    if CONFIG.invidious_companion.present?
+      invidious_companion = CONFIG.invidious_companion.sample
+      env.response.headers["Content-Security-Policy"] =
+        env.response.headers["Content-Security-Policy"]
+          .gsub("media-src", "media-src #{invidious_companion.public_url}")
+          .gsub("connect-src", "connect-src #{invidious_companion.public_url}")
+    end
+
     templated "watch"
   end
 
@@ -285,6 +293,9 @@ module Invidious::Routes::Watch
     if CONFIG.disabled?("downloads")
       return error_template(403, "Administrator has disabled this endpoint.")
     end
+    if CONFIG.invidious_companion.present?
+      return error_template(403, "Downloads should be routed through Companion when present")
+    end
 
     title = env.params.body["title"]? || ""
     video_id = env.params.body["id"]? || ""
@@ -314,10 +325,9 @@ module Invidious::Routes::Watch
       env.params.query["label"] = URI.decode_www_form(label.as_s)
 
       return Invidious::Routes::API::V1::Videos.captions(env)
-    elsif itag = download_widget["itag"]?.try &.as_i
+    elsif itag = download_widget["itag"]?.try &.as_i.to_s
       # URL params specific to /latest_version
       env.params.query["id"] = video_id
-      env.params.query["itag"] = itag.to_s
       env.params.query["title"] = filename
       env.params.query["local"] = "true"
 

src/invidious/videos.cr

@@ -15,7 +15,7 @@ struct Video
   # NOTE: don't forget to bump this number if any change is made to
   # the `params` structure in videos/parser.cr!!!
   #
-  SCHEMA_VERSION = 2
+  SCHEMA_VERSION = 3
 
   property id : String
 

src/invidious/videos/parser.cr

@@ -108,27 +108,22 @@ def extract_video_info(video_id : String)
   params = parse_video_info(video_id, player_response)
   params["reason"] = JSON::Any.new(reason) if reason
 
-  new_player_response = nil
+  if !CONFIG.invidious_companion.present?
-
+    if player_response["streamingData"]? && player_response.dig?("streamingData", "adaptiveFormats", 0, "url").nil?
-  # Don't use Android test suite client if po_token is passed because po_token doesn't
+      LOGGER.warn("Missing URLs for adaptive formats, falling back to other YT clients.")
-  # work for Android test suite client.
+      players_fallback = [YoutubeAPI::ClientType::TvHtml5, YoutubeAPI::ClientType::WebMobile]
-  if reason.nil? && CONFIG.po_token.nil?
+      players_fallback.each do |player_fallback|
-    # Fetch the video streams using an Android client in order to get the
+        client_config.client_type = player_fallback
-    # decrypted URLs and maybe fix throttling issues (#2194). See the
+        player_fallback_response = try_fetch_streaming_data(video_id, client_config)
-    # following issue for an explanation about decrypted URLs:
+        if player_fallback_response && player_fallback_response["streamingData"]? &&
-    # https://github.com/TeamNewPipe/NewPipeExtractor/issues/562
+           player_fallback_response.dig?("streamingData", "adaptiveFormats", 0, "url")
-    client_config.client_type = YoutubeAPI::ClientType::AndroidTestSuite
+          streaming_data = player_response["streamingData"].as_h
-    new_player_response = try_fetch_streaming_data(video_id, client_config)
+          streaming_data["adaptiveFormats"] = player_fallback_response["streamingData"]["adaptiveFormats"]
-  end
+          player_response["streamingData"] = JSON::Any.new(streaming_data)
-
+          break
-  # Replace player response and reset reason
+        end
-  if !new_player_response.nil?
+      end
-    # Preserve captions & storyboard data before replacement
+    end
-    new_player_response["storyboards"] = player_response["storyboards"] if player_response["storyboards"]?
-    new_player_response["captions"] = player_response["captions"] if player_response["captions"]?
-
-    player_response = new_player_response
-    params.delete("reason")
   end
 
   {"captions", "playabilityStatus", "playerConfig", "storyboards"}.each do |f|

src/invidious/views/components/player.ecr

@@ -22,6 +22,8 @@
                audio_streams.each_with_index do |fmt, i|
                 src_url  = "/latest_version?id=#{video.id}&itag=#{fmt["itag"]}"
                 src_url += "&local=true" if params.local
+                src_url = invidious_companion.public_url.to_s + src_url + 
+                            "&check=#{invidious_companion_encrypt(video.id)}" if (invidious_companion)
 
                 bitrate = fmt["bitrate"]
                 mimetype = HTML.escape(fmt["mimeType"].as_s)
@@ -34,8 +36,12 @@
                 <% end %>
             <% end %>
         <% else %>
-            <% if params.quality == "dash" %>
+            <% if params.quality == "dash"
-                <source src="/api/manifest/dash/id/<%= video.id %>?local=true&unique_res=1" type='application/dash+xml' label="dash">
+               src_url = "/api/manifest/dash/id/" + video.id + "?local=true&unique_res=1"
+               src_url = invidious_companion.public_url.to_s + src_url +
+                            "&check=#{invidious_companion_encrypt(video.id)}" if (invidious_companion)
+            %>
+                <source src="<%= src_url %>" type='application/dash+xml' label="dash">
             <% end %>
 
             <%
@@ -44,6 +50,8 @@
             fmt_stream.each_with_index do |fmt, i|
                 src_url  = "/latest_version?id=#{video.id}&itag=#{fmt["itag"]}"
                 src_url += "&local=true" if params.local
+                src_url = invidious_companion.public_url.to_s + src_url +
+                            "&check=#{invidious_companion_encrypt(video.id)}" if (invidious_companion)
 
                 quality = fmt["quality"]
                 mimetype = HTML.escape(fmt["mimeType"].as_s)

src/invidious/yt_backend/connection_pool.cr

@@ -46,6 +46,43 @@ struct YoutubeConnectionPool
   end
 end
 
+struct CompanionConnectionPool
+  property pool : DB::Pool(HTTP::Client)
+
+  def initialize(capacity = 5, timeout = 5.0)
+    options = DB::Pool::Options.new(
+      initial_pool_size: 0,
+      max_pool_size: capacity,
+      max_idle_pool_size: capacity,
+      checkout_timeout: timeout
+    )
+
+    @pool = DB::Pool(HTTP::Client).new(options) do
+      companion = CONFIG.invidious_companion.sample
+      next make_client(companion.private_url, use_http_proxy: false)
+    end
+  end
+
+  def client(&)
+    conn = pool.checkout
+
+    begin
+      response = yield conn
+    rescue ex
+      conn.close
+
+      companion = CONFIG.invidious_companion.sample
+      conn = make_client(companion.private_url, use_http_proxy: false)
+
+      response = yield conn
+    ensure
+      pool.release(conn)
+    end
+
+    response
+  end
+end
+
 def add_yt_headers(request)
   request.headers.delete("User-Agent") if request.headers["User-Agent"] == "Crystal"
   request.headers["User-Agent"] ||= "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
@@ -61,9 +98,9 @@ def add_yt_headers(request)
   end
 end
 
-def make_client(url : URI, region = nil, force_resolve : Bool = false, force_youtube_headers : Bool = false)
+def make_client(url : URI, region = nil, force_resolve : Bool = false, force_youtube_headers : Bool = false, use_http_proxy : Bool = true)
   client = HTTP::Client.new(url)
-  client.proxy = make_configured_http_proxy_client() if CONFIG.http_proxy
+  client.proxy = make_configured_http_proxy_client() if CONFIG.http_proxy && use_http_proxy
 
   # Force the usage of a specific configured IP Family
   if force_resolve
@@ -78,8 +115,8 @@ def make_client(url : URI, region = nil, force_resolve : Bool = false, force_you
   return client
 end
 
-def make_client(url : URI, region = nil, force_resolve : Bool = false, &)
+def make_client(url : URI, region = nil, force_resolve : Bool = false, use_http_proxy : Bool = true, &)
-  client = make_client(url, region, force_resolve: force_resolve)
+  client = make_client(url, region, force_resolve: force_resolve, use_http_proxy: use_http_proxy)
   begin
     yield client
   ensure

src/invidious/yt_backend/youtube_api.cr

@@ -500,7 +500,11 @@ module YoutubeAPI
       data["params"] = params
     end
 
-    return self._post_json("/youtubei/v1/player", data, client_config)
+    if CONFIG.invidious_companion.present?
+      return self._post_invidious_companion("/youtubei/v1/player", data)
+    else
+      return self._post_json("/youtubei/v1/player", data, client_config)
+    end
   end
 
   ####################################################################
@@ -666,6 +670,49 @@ module YoutubeAPI
     return initial_data
   end
 
+  ####################################################################
+  # _post_invidious_companion(endpoint, data)
+  #
+  # Internal function that does the actual request to Invidious companion
+  # and handles errors.
+  #
+  # The requested data is an endpoint (URL without the domain part)
+  # and the data as a Hash object.
+  #
+  def _post_invidious_companion(
+    endpoint : String,
+    data : Hash,
+  ) : Hash(String, JSON::Any)
+    headers = HTTP::Headers{
+      "Content-Type"  => "application/json; charset=UTF-8",
+      "Authorization" => "Bearer #{CONFIG.invidious_companion_key}",
+    }
+
+    # Logging
+    LOGGER.debug("Invidious companion: Using endpoint: \"#{endpoint}\"")
+    LOGGER.trace("Invidious companion: POST data: #{data}")
+
+    # Send the POST request
+
+    begin
+      response = COMPANION_POOL.client &.post(endpoint, headers: headers, body: data.to_json)
+      body = response.body
+      if (response.status_code != 200)
+        raise Exception.new(
+          "Error while communicating with Invidious companion: \
+          status code: #{response.status_code} and body: #{body.dump}"
+        )
+      end
+    rescue ex
+      raise InfoException.new("Error while communicating with Invidious companion: " + (ex.message || "no extra info found"))
+    end
+
+    # Convert result to Hash
+    initial_data = JSON.parse(body).as_h
+
+    return initial_data
+  end
+
   ####################################################################
   # _decompress(body_io, headers)
   #