From 24a727e464ba4ec4f3b574f024241c23915bc09f Mon Sep 17 00:00:00 2001 From: Situla <196762523+Aquarius-Situla@users.noreply.github.com> Date: Sat, 26 Sep 2026 20:16:36 +0800 Subject: [PATCH 1/4] feat: add BILIBILI_SESSION_ENCRYPTION_KEY to .env.example --- .env.example | 1 + 1 file changed, 1 insertion(+) diff --git a/.env.example b/.env.example index 9f2eb13..c864d8a 100644 --- a/.env.example +++ b/.env.example @@ -51,6 +51,7 @@ YOUTUBE_REMOTE_LOGIN_ENABLED=false YOUTUBE_OUTBOUND_PROXY_URL= YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN=SET_ME_YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN YOUTUBE_SESSION_ENCRYPTION_KEY=SET_ME_YOUTUBE_SESSION_ENCRYPTION_KEY +BILIBILI_SESSION_ENCRYPTION_KEY=SET_ME_BILIBILI_SESSION_ENCRYPTION_KEY YOUTUBE_REMOTE_LOGIN_CALLBACK_ORIGIN=http://typetype-server:8080 YOUTUBE_REMOTE_LOGIN_TTL_MS=480000 YOUTUBE_REMOTE_LOGIN_MAX_SESSIONS=2 From 6d6c6824f724a8b484e8b66a7b91f1fc8ed0e07f Mon Sep 17 00:00:00 2001 From: Situla <196762523+Aquarius-Situla@users.noreply.github.com> Date: Sat, 26 Sep 2026 20:18:35 +0800 Subject: [PATCH 2/4] feat: add BILIBILI_SESSION_ENCRYPTION_KEY to docker-compose.yml --- docker-compose.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 7f745e6..6c7dc3a 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -41,6 +41,7 @@ services: YOUTUBE_REMOTE_LOGIN_CALLBACK_BASE_URL: ${YOUTUBE_REMOTE_LOGIN_CALLBACK_BASE_URL:-http://typetype-server:8080} YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN_FILE: /run/typetype-secrets/youtube_remote_login_internal_token YOUTUBE_SESSION_ENCRYPTION_KEY_FILE: /run/typetype-secrets/youtube_session_encryption_key + BILIBILI_SESSION_ENCRYPTION_KEY: ${BILIBILI_SESSION_ENCRYPTION_KEY:-} YOUTUBE_REMOTE_LOGIN_TTL_MS: ${YOUTUBE_REMOTE_LOGIN_TTL_MS:-480000} YOUTUBE_REMOTE_LOGIN_MAX_SESSIONS: ${YOUTUBE_REMOTE_LOGIN_MAX_SESSIONS:-2} YOUTUBE_REMOTE_LOGIN_MAX_FRAME_BYTES: ${YOUTUBE_REMOTE_LOGIN_MAX_FRAME_BYTES:-524288} @@ -54,7 +55,7 @@ services: typetype-downloader: condition: service_started healthcheck: - test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:8080/health"] + test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/8080/health"] restart: unless-stopped typetype-downloader: @@ -139,6 +140,7 @@ services: PGPASSWORD: ${POSTGRES_PASSWORD:-typetype} YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN: ${YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN:-} YOUTUBE_SESSION_ENCRYPTION_KEY: ${YOUTUBE_SESSION_ENCRYPTION_KEY:-} + BILIBILI_SESSION_ENCRYPTION_KEY: ${BILIBILI_SESSION_ENCRYPTION_KEY:-} command: ["/bin/sh", "/usr/local/bin/initialize-stack.sh"] volumes: - typetype_secrets:/run/typetype-secrets From b7f0a47d062609780008871bd9817d33090ff422 Mon Sep 17 00:00:00 2001 From: Situla <196762523+Aquarius-Situla@users.noreply.github.com> Date: Sat, 26 Sep 2026 20:18:55 +0800 Subject: [PATCH 3/4] feat: add BILIBILI_SESSION_ENCRYPTION_KEY to docker-compose.dev.yml --- docker-compose.dev.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml index a6fa0d9..1c95d3d 100644 --- a/docker-compose.dev.yml +++ b/docker-compose.dev.yml @@ -51,6 +51,7 @@ services: YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN_FILE: /run/typetype-secrets/youtube_remote_login_internal_token YOUTUBE_SESSION_ENCRYPTION_KEY: "" YOUTUBE_SESSION_ENCRYPTION_KEY_FILE: /run/typetype-secrets/youtube_session_encryption_key + BILIBILI_SESSION_ENCRYPTION_KEY: ${BILIBILI_SESSION_ENCRYPTION_KEY:-} YOUTUBE_REMOTE_LOGIN_TTL_MS: ${YOUTUBE_REMOTE_LOGIN_TTL_MS:-480000} YOUTUBE_REMOTE_LOGIN_MAX_SESSIONS: ${YOUTUBE_REMOTE_LOGIN_MAX_SESSIONS:-2} YOUTUBE_REMOTE_LOGIN_MAX_FRAME_BYTES: ${YOUTUBE_REMOTE_LOGIN_MAX_FRAME_BYTES:-524288} @@ -158,6 +159,7 @@ services: PGPASSWORD: ${POSTGRES_PASSWORD:-typetype} YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN: ${YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN:-} YOUTUBE_SESSION_ENCRYPTION_KEY: ${YOUTUBE_SESSION_ENCRYPTION_KEY:-} + BILIBILI_SESSION_ENCRYPTION_KEY: ${BILIBILI_SESSION_ENCRYPTION_KEY:-} command: ["/bin/sh", "/usr/local/bin/initialize-stack.sh"] volumes: - typetype_secrets:/run/typetype-secrets From b740118413cd1d19e3f6887f32cc29915be9e96b Mon Sep 17 00:00:00 2001 From: Priveetee Date: Sat, 26 Sep 2026 19:19:03 +0000 Subject: [PATCH 4/4] fix: harden BiliBili session key provisioning --- docker-compose.dev.yml | 1 - docker-compose.yml | 3 +-- scripts/bootstrap-env.sh | 2 ++ scripts/install-stack.test.sh | 2 ++ 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml index 1c95d3d..339c237 100644 --- a/docker-compose.dev.yml +++ b/docker-compose.dev.yml @@ -159,7 +159,6 @@ services: PGPASSWORD: ${POSTGRES_PASSWORD:-typetype} YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN: ${YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN:-} YOUTUBE_SESSION_ENCRYPTION_KEY: ${YOUTUBE_SESSION_ENCRYPTION_KEY:-} - BILIBILI_SESSION_ENCRYPTION_KEY: ${BILIBILI_SESSION_ENCRYPTION_KEY:-} command: ["/bin/sh", "/usr/local/bin/initialize-stack.sh"] volumes: - typetype_secrets:/run/typetype-secrets diff --git a/docker-compose.yml b/docker-compose.yml index 6c7dc3a..1544506 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -55,7 +55,7 @@ services: typetype-downloader: condition: service_started healthcheck: - test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/8080/health"] + test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:8080/health"] restart: unless-stopped typetype-downloader: @@ -140,7 +140,6 @@ services: PGPASSWORD: ${POSTGRES_PASSWORD:-typetype} YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN: ${YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN:-} YOUTUBE_SESSION_ENCRYPTION_KEY: ${YOUTUBE_SESSION_ENCRYPTION_KEY:-} - BILIBILI_SESSION_ENCRYPTION_KEY: ${BILIBILI_SESSION_ENCRYPTION_KEY:-} command: ["/bin/sh", "/usr/local/bin/initialize-stack.sh"] volumes: - typetype_secrets:/run/typetype-secrets diff --git a/scripts/bootstrap-env.sh b/scripts/bootstrap-env.sh index c9fbcd0..460a642 100755 --- a/scripts/bootstrap-env.sh +++ b/scripts/bootstrap-env.sh @@ -7,6 +7,7 @@ ENV_FILE="${ENV_FILE:-${ROOT_DIR}/.env}" REMOTE_LOGIN_PLACEHOLDER="SET_ME_YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN" REMOTE_LOGIN_LEGACY_PLACEHOLDER="SET_ME_SHARED_SECRET" SESSION_KEY_PLACEHOLDER="SET_ME_YOUTUBE_SESSION_ENCRYPTION_KEY" +BILIBILI_SESSION_KEY_PLACEHOLDER="SET_ME_BILIBILI_SESSION_ENCRYPTION_KEY" GARAGE_RPC_PLACEHOLDER="SET_ME_GARAGE_RPC_SECRET" GARAGE_RPC_STATIC_DEFAULT="f4db2c1d5aef1dce278d4315b80425e98831714a48c059e22c2a39001b15ca89" @@ -86,4 +87,5 @@ ensure_hex_secret() { ensure_env_file ensure_secret "YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN" "${REMOTE_LOGIN_PLACEHOLDER}" ensure_secret "YOUTUBE_SESSION_ENCRYPTION_KEY" "${SESSION_KEY_PLACEHOLDER}" +ensure_secret "BILIBILI_SESSION_ENCRYPTION_KEY" "${BILIBILI_SESSION_KEY_PLACEHOLDER}" ensure_hex_secret "GARAGE_RPC_SECRET" "${GARAGE_RPC_PLACEHOLDER}" diff --git a/scripts/install-stack.test.sh b/scripts/install-stack.test.sh index 38243b5..2fbcab5 100755 --- a/scripts/install-stack.test.sh +++ b/scripts/install-stack.test.sh @@ -58,9 +58,11 @@ test ! -e "$python_log" downloader_access_key="$(grep '^DOWNLOADER_S3_ACCESS_KEY=' "${install_dir}/.env" | cut -d= -f2-)" downloader_secret_key="$(grep '^DOWNLOADER_S3_SECRET_KEY=' "${install_dir}/.env" | cut -d= -f2-)" remote_login_token="$(grep '^YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN=' "${install_dir}/.env" | cut -d= -f2-)" +bilibili_session_key="$(grep '^BILIBILI_SESSION_ENCRYPTION_KEY=' "${install_dir}/.env" | cut -d= -f2-)" [[ "$downloader_access_key" =~ ^GK[0-9a-f]{24}$ ]] [[ "$downloader_secret_key" =~ ^[0-9a-f]{64}$ ]] [[ "$remote_login_token" =~ ^[A-Za-z0-9_-]{64}$ ]] +[[ "$bilibili_session_key" =~ ^[A-Za-z0-9_-]{64}$ ]] beta_install_dir="${temporary}/beta-stack" PATH="${fake_bin}:${PATH}" \