YTS-2 - trckr

← YTS-2

Created: 2025-12-25 • Updated: 2025-12-25

Relationships Loading...

## Summary
The current Caddy config serves thumbnails directly from filesystem (bypassing Flask) for performance. Need to ensure thumbnails are also protected by Authelia forward_auth.

## Context
Current `/etc/caddy/ytsum.caddy` has a `@thumbnails` matcher that serves files directly:
```
@thumbnails path_regexp thumb ^/thumbnail/([a-zA-Z0-9_-]+)\.webp$
handle @thumbnails {
    root * /storage/YouTube/videos
    rewrite * /{re.thumb.1}/thumbnail.webp
    file_server
    header Cache-Control "public, max-age=31536000, immutable"
}
```

## Changes Required
1. Ensure forward_auth is applied before the thumbnail handler (order matters in Caddy)
2. Alternatively, move thumbnail serving inside the main handle block after forward_auth

## Files to Modify
- `/etc/caddy/ytsum.caddy`

## Verification Criteria
- [ ] Thumbnail URLs (e.g., `/thumbnail/dQw4w9WgXcQ.webp`) require authentication
- [ ] Thumbnails load correctly after authentication
- [ ] Thumbnail caching still works (check Cache-Control header)
- [ ] No regression in main site functionality

Pull Requests (comma-separated URLs)

Attachments

Comments (2)

agent · 2025-12-25

[QA] ✅ VERIFIED - All acceptance criteria passed. Thumbnails require authentication (302 redirect to Authelia), load correctly after auth (200 responses in logs), Cache-Control headers present ('public, max-age=31536000, immutable'), and no regression in main site functionality (all services healthy, 0 errors). Documentation-only changes are correct and complete. Full report: /tmp/qa-YTS-2.md

agent · 2025-12-25

## Investigation Results ### Problem Analysis The concern was that the thumbnail handler (using `@thumbnails` matcher with `file_server`) might bypass Authelia authentication since it serves files directly from the filesystem without going through Flask. ### Findings **Thumbnail auth is already working correctly.** Testing confirmed: - `curl -I https://ytsum.roboalch.com/thumbnail/dQw4w9WgXcQ.webp` returns 302 redirect to Authelia - Same behavior as the main site routes ### Why It Works Caddy's directive ordering ensures `forward_auth` runs **before** `handle` blocks: - `forward_auth` is a higher-priority directive than `handle` in Caddy's default order - The site-level `forward_auth` applies to ALL requests before routing - Reference: https://caddyserver.com/docs/caddyfile/directives ### Changes Made Added explanatory comments to `deploy/ytsum.caddy` (lines 8-10) documenting this behavior so future maintainers understand why thumbnails are protected despite being served by `file_server`. ### Verification - [x] Thumbnail URLs require authentication (302 redirect to Authelia) - [x] Live config updated and reloaded - [x] Caddy config validation passed