From 8fc2dc2427b29b0ca01eac0f4254bb29908718bc Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 30 Mar 2026 13:32:36 +0200
Subject: [PATCH] fix(tubearchivist): fix nginx auth_request for cache/media
 files

The auth_request subrequest to /api/ping/ through the generic /api
location block doesn't properly forward cookies to the Django backend,
causing 403 for all /cache/ and /media/ requests.

Use a dedicated internal /_auth location that explicitly proxies to
/api/ping/ with Cookie header forwarding.
---
 install/tubearchivist-install.sh | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/install/tubearchivist-install.sh b/install/tubearchivist-install.sh
index 3cdca92b..a3819e5c 100644
--- a/install/tubearchivist-install.sh
+++ b/install/tubearchivist-install.sh
@@ -115,23 +115,33 @@ cat <<'EOF' >/etc/nginx/sites-available/default
 server {
     listen 8000;
 
+    location = /_auth {
+        internal;
+        proxy_pass http://localhost:8080/api/ping/;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header Host $http_host;
+        proxy_set_header Cookie $http_cookie;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
     location /cache/videos/ {
-        auth_request /api/ping/;
+        auth_request /_auth;
         alias /opt/tubearchivist/cache/videos/;
     }
 
     location /cache/channels/ {
-        auth_request /api/ping/;
+        auth_request /_auth;
         alias /opt/tubearchivist/cache/channels/;
     }
 
     location /cache/playlists/ {
-        auth_request /api/ping/;
+        auth_request /_auth;
         alias /opt/tubearchivist/cache/playlists/;
     }
 
     location /media/ {
-        auth_request /api/ping/;
+        auth_request /_auth;
         alias /opt/tubearchivist/media/;
         types {
             text/vtt vtt;
@@ -139,7 +149,7 @@ server {
     }
 
     location /youtube/ {
-        auth_request /api/ping/;
+        auth_request /_auth;
         alias /opt/tubearchivist/media/;
         types {
             video/mp4 mp4;