Update script name

.gitignore

@@ -10,6 +10,10 @@ bootstrap/host/inventory/
 *.tar.gz
 *.zip
 infra/gitea/data/
+infra/youtube-backup/.env
+infra/youtube-backup/cookies.txt
+infra/youtube-backup/archive.txt
+infra/youtube-backup/logs/
 
 # Ignore decrypted secret material
 *.dec.yaml

bootstrap/host/README.md

@@ -28,6 +28,7 @@ The playbook:
 - configures apt repositories for Docker, Kubernetes, Helm, OpenTofu, and Brave
 - installs the captured Debian package set, filtering packages unavailable on
   the current Debian release
+- installs user-level pipx CLI tools such as `yt-dlp`
 - installs Zoom from the upstream `.deb` when requested on amd64
 - adds `jv` to expected local groups
 - enables core services such as Docker, containerd, kubelet, ssh, cron, and

bootstrap/host/group_vars/debian_pc.yml

@@ -27,6 +27,9 @@ debian_pc_enable_services:
   - kubelet
   - bluetooth
 
+debian_pc_pipx_packages:
+  - yt-dlp
+
 debian_pc_hold_packages:
   - containerd.io
   - kubeadm

bootstrap/host/playbook.yml

@@ -166,6 +166,25 @@
         - "'zoom' in debian_pc_apt_manual_packages"
         - ansible_facts.architecture == "x86_64"
 
+    - name: Ensure pipx binary path is configured for the homelab user
+      ansible.builtin.command:
+        cmd: python3 -m pipx ensurepath
+      become: true
+      become_user: "{{ debian_pc_user }}"
+      environment:
+        PATH: "{{ debian_pc_user_home }}/.local/bin:/usr/local/bin:/usr/bin:/bin"
+      changed_when: false
+
+    - name: Install user pipx CLI tools
+      ansible.builtin.command:
+        cmd: "python3 -m pipx install {{ item }}"
+        creates: "{{ debian_pc_user_home }}/.local/bin/{{ item }}"
+      become: true
+      become_user: "{{ debian_pc_user }}"
+      environment:
+        PATH: "{{ debian_pc_user_home }}/.local/bin:/usr/local/bin:/usr/bin:/bin"
+      loop: "{{ debian_pc_pipx_packages }}"
+
     - name: Hold Kubernetes and runtime packages
       ansible.builtin.dpkg_selections:
         name: "{{ item }}"

infra/arr-stack/.env.example

@@ -2,6 +2,8 @@ ARR_ROOT=/data/arr
 PUID=1000
 PGID=1000
 TZ=America/Mexico_City
+ARR_DNS_PRIMARY=1.1.1.1
+ARR_DNS_SECONDARY=8.8.8.8
 
 PROWLARR_PORT=9696
 RADARR_PORT=7878

infra/arr-stack/README.md

@@ -17,6 +17,10 @@ Services:
 
 Persistent storage defaults to `/data/arr`.
 
+Containers use explicit DNS servers from `.env` through `ARR_DNS_PRIMARY` and
+`ARR_DNS_SECONDARY`. Defaults are `1.1.1.1` and `8.8.8.8`; set them to your
+router, Pi-hole, or Tailscale DNS addresses if needed.
+
 ## Start
 
 ```bash

infra/arr-stack/docker-compose.yml

@@ -14,6 +14,9 @@ services:
     image: ${FLARESOLVERR_IMAGE:-ghcr.io/flaresolverr/flaresolverr:latest}
     container_name: ${FLARESOLVERR_CONTAINER_NAME:-arr-flaresolverr}
     restart: unless-stopped
+    dns:
+      - ${ARR_DNS_PRIMARY:-1.1.1.1}
+      - ${ARR_DNS_SECONDARY:-8.8.8.8}
     environment:
       LOG_LEVEL: ${FLARESOLVERR_LOG_LEVEL:-info}
       TZ: ${TZ:-America/Mexico_City}
@@ -26,6 +29,9 @@ services:
     <<: *linuxserver-common
     image: ${PROWLARR_IMAGE:-lscr.io/linuxserver/prowlarr:latest}
     container_name: ${PROWLARR_CONTAINER_NAME:-arr-prowlarr}
+    dns:
+      - ${ARR_DNS_PRIMARY:-1.1.1.1}
+      - ${ARR_DNS_SECONDARY:-8.8.8.8}
     ports:
       - "${PROWLARR_PORT:-9696}:9696"
     volumes:
@@ -35,6 +41,9 @@ services:
     <<: *linuxserver-common
     image: ${RADARR_IMAGE:-lscr.io/linuxserver/radarr:latest}
     container_name: ${RADARR_CONTAINER_NAME:-arr-radarr}
+    dns:
+      - ${ARR_DNS_PRIMARY:-1.1.1.1}
+      - ${ARR_DNS_SECONDARY:-8.8.8.8}
     ports:
       - "${RADARR_PORT:-7878}:7878"
     volumes:
@@ -45,6 +54,9 @@ services:
     <<: *linuxserver-common
     image: ${SONARR_IMAGE:-lscr.io/linuxserver/sonarr:latest}
     container_name: ${SONARR_CONTAINER_NAME:-arr-sonarr}
+    dns:
+      - ${ARR_DNS_PRIMARY:-1.1.1.1}
+      - ${ARR_DNS_SECONDARY:-8.8.8.8}
     ports:
       - "${SONARR_PORT:-8989}:8989"
     volumes:
@@ -55,6 +67,9 @@ services:
     <<: *linuxserver-common
     image: ${QBITTORRENT_IMAGE:-lscr.io/linuxserver/qbittorrent:latest}
     container_name: ${QBITTORRENT_CONTAINER_NAME:-arr-qbittorrent}
+    dns:
+      - ${ARR_DNS_PRIMARY:-1.1.1.1}
+      - ${ARR_DNS_SECONDARY:-8.8.8.8}
     environment:
       PUID: ${PUID:-1000}
       PGID: ${PGID:-1000}
@@ -73,6 +88,9 @@ services:
     image: ${KAPOWARR_IMAGE:-mrcas/kapowarr:latest}
     container_name: ${KAPOWARR_CONTAINER_NAME:-arr-kapowarr}
     restart: unless-stopped
+    dns:
+      - ${ARR_DNS_PRIMARY:-1.1.1.1}
+      - ${ARR_DNS_SECONDARY:-8.8.8.8}
     environment:
       PUID: ${PUID:-1000}
       PGID: ${PGID:-1000}
@@ -90,6 +108,9 @@ services:
     image: ${SUWAYOMI_IMAGE:-ghcr.io/suwayomi/suwayomi-server:preview}
     container_name: ${SUWAYOMI_CONTAINER_NAME:-arr-suwayomi}
     restart: unless-stopped
+    dns:
+      - ${ARR_DNS_PRIMARY:-1.1.1.1}
+      - ${ARR_DNS_SECONDARY:-8.8.8.8}
     environment:
       PUID: ${PUID:-1000}
       PGID: ${PGID:-1000}
@@ -106,6 +127,9 @@ services:
     image: ${MAINTAINERR_IMAGE:-ghcr.io/jorenn92/maintainerr:latest}
     container_name: ${MAINTAINERR_CONTAINER_NAME:-arr-maintainerr}
     restart: unless-stopped
+    dns:
+      - ${ARR_DNS_PRIMARY:-1.1.1.1}
+      - ${ARR_DNS_SECONDARY:-8.8.8.8}
     environment:
       PUID: ${PUID:-1000}
       PGID: ${PGID:-1000}

infra/youtube-backup/.env.example

@@ -0,0 +1,20 @@
+YOUTUBE_BACKUP_ROOT=/data/youtube-backup
+YOUTUBE_BACKUP_PLAYLISTS_FILE=/data/youtube-backup/playlists.txt
+YOUTUBE_BACKUP_ARCHIVE_FILE=/data/youtube-backup/archive.txt
+YOUTUBE_BACKUP_VIDEOS_DIR=/data/youtube-backup/videos
+YOUTUBE_BACKUP_LOG_DIR=/data/youtube-backup/logs
+
+# For private/unlisted uploads, prefer exported cookies on a headless server:
+# YOUTUBE_BACKUP_COOKIES_FILE=/data/youtube-backup/cookies.txt
+YOUTUBE_BACKUP_COOKIES_FILE=
+
+# Or use browser cookies when running interactively on a desktop:
+# YOUTUBE_BACKUP_COOKIES_FROM_BROWSER=firefox
+YOUTUBE_BACKUP_COOKIES_FROM_BROWSER=
+
+YOUTUBE_BACKUP_FORMAT=bv*+ba/best
+YOUTUBE_BACKUP_MERGE_FORMAT=mp4
+YOUTUBE_BACKUP_SUB_LANGS=all,-live_chat
+YOUTUBE_BACKUP_SLEEP_REQUESTS=1
+YOUTUBE_BACKUP_RATE_LIMIT=
+YOUTUBE_BACKUP_EXTRA_ARGS=

infra/youtube-backup/README.md

@@ -0,0 +1,65 @@
+# YouTube Backup
+
+Standalone helper for backing up your own uploaded YouTube videos with
+`yt-dlp`. It is intentionally outside `lab.sh`, OpenTofu, Argo CD, and the
+homelab deployment pipeline.
+
+The backup root defaults to `/data/youtube-backup`.
+
+## Install
+
+```bash
+pipx install yt-dlp
+```
+
+If thumbnail embedding fails, install `ffmpeg` on the host.
+
+## Configure
+
+```bash
+sudo mkdir -p /data/youtube-backup/{videos,logs}
+sudo chown -R "$USER:$USER" /data/youtube-backup
+cp infra/youtube-backup/playlists.example.txt /data/youtube-backup/playlists.txt
+cp infra/youtube-backup/.env.example infra/youtube-backup/.env
+```
+
+Edit `/data/youtube-backup/playlists.txt` and add one playlist, channel, or
+video URL per line.
+
+For private or unlisted uploads, export browser cookies and set:
+
+```bash
+YOUTUBE_BACKUP_COOKIES_FILE=/data/youtube-backup/cookies.txt
+```
+
+Alternatively, when running on a desktop with a browser profile:
+
+```bash
+YOUTUBE_BACKUP_COOKIES_FROM_BROWSER=firefox
+```
+
+## Run
+
+```bash
+infra/youtube-backup/backup-youtube.sh
+```
+
+The script uses:
+
+```text
+--download-archive /data/youtube-backup/archive.txt
+```
+
+so repeated runs skip videos that were already backed up.
+
+Downloaded videos and sidecar metadata are written under:
+
+```text
+/data/youtube-backup/videos
+```
+
+Each run also writes a timestamped log under:
+
+```text
+/data/youtube-backup/logs
+```

infra/youtube-backup/backup-youtube.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ENV_FILE="${YOUTUBE_BACKUP_ENV_FILE:-${SCRIPT_DIR}/.env}"
+
+if [[ -f "${ENV_FILE}" ]]; then
+    set -a
+    # shellcheck disable=SC1090
+    . "${ENV_FILE}"
+    set +a
+fi
+
+BACKUP_ROOT="${YOUTUBE_BACKUP_ROOT:-/data/youtube-backup}"
+PLAYLISTS_FILE="${YOUTUBE_BACKUP_PLAYLISTS_FILE:-${BACKUP_ROOT}/playlists.txt}"
+ARCHIVE_FILE="${YOUTUBE_BACKUP_ARCHIVE_FILE:-${BACKUP_ROOT}/archive.txt}"
+VIDEOS_DIR="${YOUTUBE_BACKUP_VIDEOS_DIR:-${BACKUP_ROOT}/videos}"
+LOG_DIR="${YOUTUBE_BACKUP_LOG_DIR:-${BACKUP_ROOT}/logs}"
+COOKIES_FILE="${YOUTUBE_BACKUP_COOKIES_FILE:-}"
+COOKIES_FROM_BROWSER="${YOUTUBE_BACKUP_COOKIES_FROM_BROWSER:-}"
+FORMAT="${YOUTUBE_BACKUP_FORMAT:-bv*+ba/best}"
+OUTPUT_TEMPLATE="${YOUTUBE_BACKUP_OUTPUT_TEMPLATE:-%(playlist_title)s/%(upload_date>%Y-%m-%d,release_date>%Y-%m-%d,epoch>%Y-%m-%d)s - %(title)s [%(id)s].%(ext)s}"
+SUB_LANGS="${YOUTUBE_BACKUP_SUB_LANGS:-all,-live_chat}"
+MERGE_FORMAT="${YOUTUBE_BACKUP_MERGE_FORMAT:-mp4}"
+RATE_LIMIT="${YOUTUBE_BACKUP_RATE_LIMIT:-}"
+SLEEP_REQUESTS="${YOUTUBE_BACKUP_SLEEP_REQUESTS:-1}"
+EXTRA_ARGS="${YOUTUBE_BACKUP_EXTRA_ARGS:-}"
+
+if ! command -v yt-dlp >/dev/null 2>&1; then
+    echo "yt-dlp is required. Install it with: pipx install yt-dlp" >&2
+    exit 1
+fi
+
+if [[ ! -f "${PLAYLISTS_FILE}" ]]; then
+    mkdir -p "$(dirname "${PLAYLISTS_FILE}")"
+    cat >"${PLAYLISTS_FILE}" <<'EOF'
+# Add one YouTube playlist/channel/video URL per line.
+# Examples:
+# https://www.youtube.com/playlist?list=YOUR_PLAYLIST_ID
+# https://www.youtube.com/@YOUR_CHANNEL/videos
+EOF
+    echo "Created ${PLAYLISTS_FILE}. Add your playlist URLs and rerun." >&2
+    exit 1
+fi
+
+if ! grep -Ev '^\s*($|#)' "${PLAYLISTS_FILE}" >/dev/null; then
+    echo "${PLAYLISTS_FILE} does not contain any playlist URLs." >&2
+    exit 1
+fi
+
+mkdir -p "${VIDEOS_DIR}" "${LOG_DIR}" "$(dirname "${ARCHIVE_FILE}")"
+touch "${ARCHIVE_FILE}"
+
+timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
+log_file="${LOG_DIR}/youtube-backup-${timestamp}.log"
+
+args=(
+    --batch-file "${PLAYLISTS_FILE}"
+    --download-archive "${ARCHIVE_FILE}"
+    --paths "home:${VIDEOS_DIR}"
+    --output "${OUTPUT_TEMPLATE}"
+    --format "${FORMAT}"
+    --merge-output-format "${MERGE_FORMAT}"
+    --ignore-errors
+    --continue
+    --no-overwrites
+    --restrict-filenames
+    --write-info-json
+    --write-description
+    --write-thumbnail
+    --write-subs
+    --write-auto-subs
+    --sub-langs "${SUB_LANGS}"
+    --embed-metadata
+    --embed-thumbnail
+    --sleep-requests "${SLEEP_REQUESTS}"
+)
+
+if [[ -n "${COOKIES_FILE}" ]]; then
+    args+=(--cookies "${COOKIES_FILE}")
+fi
+
+if [[ -n "${COOKIES_FROM_BROWSER}" ]]; then
+    args+=(--cookies-from-browser "${COOKIES_FROM_BROWSER}")
+fi
+
+if [[ -n "${RATE_LIMIT}" ]]; then
+    args+=(--limit-rate "${RATE_LIMIT}")
+fi
+
+if [[ -n "${EXTRA_ARGS}" ]]; then
+    # Intentionally split for operator-provided yt-dlp flags from a local .env.
+    # shellcheck disable=SC2206
+    extra_args_array=(${EXTRA_ARGS})
+    args+=("${extra_args_array[@]}")
+fi
+
+echo "Backing up YouTube playlists from ${PLAYLISTS_FILE}"
+echo "Videos:  ${VIDEOS_DIR}"
+echo "Archive: ${ARCHIVE_FILE}"
+echo "Log:     ${log_file}"
+
+yt-dlp "${args[@]}" 2>&1 | tee "${log_file}"

infra/youtube-backup/playlists.example.txt

@@ -0,0 +1,8 @@
+# Add one playlist/channel/video URL per line.
+# For backing up your uploaded videos, use your uploads playlist, a public
+# playlist you maintain, or the channel videos URL if yt-dlp can access it with
+# your cookies.
+#
+# Examples:
+# https://www.youtube.com/playlist?list=YOUR_PLAYLIST_ID
+# https://www.youtube.com/@YOUR_CHANNEL/videos