peter
7c0647f87a
Deep-review round 2, on round 1's own fix commit. It found MORE than round 1 did (28 raw, against 13), and most of it was mine -- a new piece of UI attracts findings a backend-only diff never does. The pattern in almost all of them is the same: a principle applied to the site that prompted it and not to its siblings. * `display_text` reached three of the FIVE writers of a user-supplied name. `POST /api/downloads` and `POST /api/downloads/edit` still handed Postgres an unbounded string, so a 300-character name pasted into the Add-download dialog or the editor was a bare 500 (main.py re-raises every DataError but the NUL case). Four of the seven reviewers found it independently. The bound now lives in `models.py`, the three columns are DECLARED with it, and the guard for the next writer is parsed rather than remembered: every `display_name` / `display_uploader` assignment under `app/routes/` must go through the helper. That guard immediately found two more -- the Google sign-in callback writes the profile name into the same 255-wide column -- so it is six, not five. * The connection release reached one of the THREE routes that read their own body. The screenshot route (10 MiB, from a phone) and the client log sink both still held a pooled connection idle-in-transaction for the length of the upload, which is the invariant db.py sizes the pool on. All three now call `db.release_read_connection`, whose precondition -- nothing pending on the shared session -- is CHECKED rather than described, because a whole-session rollback discarding a caller's staged write is a mistake this repo has already made once. `test_body_limit.py` holds the rule for the next such route. * The AST drift registry keyed its sites by (module, limit expression), so a second route copied from the first collapsed onto the same entry and went uncovered -- the exact hole the registry exists to close. Keyed per call site now, and it carries the release requirement too. * The dialog's own refusal was announced once and never again: two over-cap picks leave an identical node with identical text, and an untouched live region says nothing. It is keyed per pick now, the drop zone reads as invalid and points at the sentence, and the reason is reachable from the control rather than only from a one-shot announcement. * Two tests rebuilt the blind spot they were written to remove: the dialog's cap test sat nowhere near the boundary (a `>` loosened to `>=` survived it, which is the mutation round 1 fixed on the server side), and the header-precedence test only covered an exact-case duplicate while a differently-cased one would have been COMBINED onto the wire rather than replaced. Both fixed, and the merge now dedupes case-insensitively because header names are. Also: the upload dialog's unstubbed usage query was firing a real request from jsdom in a neighbouring suite and leaking a delayed "connection lost" toast across test boundaries; `GET /api/downloads/usage` had no test at all though the whole client-side check hangs off it; and the comment claiming the edge 413 is readable now says what was measured -- readable to 200 MiB over loopback, a bare `onerror` through a proxy -- so the pre-send check is named as the mechanism and that branch as the backstop it is. Every test added or changed here was mutation-checked. One mutation SURVIVED and is recorded rather than papered over: the `tooBig` term inside `submit()` cannot be reached, because `ui/Button` swallows the activation itself, so it is marked as belt and braces instead of being described as the guard.
Siftlode
Your YouTube subscriptions, the way a feed should work. Siftlode pulls every upload from the channels you follow into one clean, filterable feed — no algorithm deciding what you see, and no Shorts or livestream noise unless you want it. Self-hosted, multi-user, and private: your data stays on your own server.
Everything expensive (channels, videos, metadata) is fetched from YouTube once and stored locally, so filtering, searching and sorting are instant and don't burn API quota. Click a video to watch it in an in-app player that resumes where you left off — or open it on youtube.com so your own ad blocker and SponsorBlock keep working.
Features
- A readable subscription feed — sort and filter by channel, tag, language, topic, length, upload date or watch state; hide channels without unsubscribing; save filter setups as named views.
- Search all of YouTube from the feed — live results you can play, save or add to playlists like any other video; they stay temporary and out of your catalog unless you keep one.
- Channel pages & a channel manager — per-channel stats and uploads, priorities, and your own tags to slice the feed by.
- Playlists with two-way YouTube sync — build them locally, keep them in sync in both directions.
- In-app player with resume, plus keyboard/scroll controls.
- Download Center — save videos to the server with yt-dlp in a Plex-friendly layout (format presets, per-user storage quota), trim / crop / split & join them in a built-in editor, then save to your device, share with another user, or hand out a public watch link.
- Plex library (optional) — point Siftlode at your own Plex server to browse and play its movies and shows alongside your feed, with watch state kept in sync.
- Multi-user with per-user private state, a shared catalog, and a fair daily API-quota guard.
- Self-hosted & private, with a first-run web setup wizard and the interface in English and Hungarian.
Quick start (self-hosting)
You don't need to build anything — Siftlode runs from a prebuilt public image, and all configuration (your admin account, Google sign-in, email) happens in a first-run web wizard. You need Docker with the Compose plugin.
1. Get the files and run the installer:
git clone https://git.b1fr0st.eu/peter/siftlode.git
cd siftlode
./install.sh # Windows (PowerShell): ./install.ps1
The installer generates a private .env (secrets), pulls the image, starts the app + database, and
prints a one-time setup URL like http://localhost:8080/setup?token=….
2. Finish in your browser. Open that URL and follow the wizard:
- Admin account — the email + password you'll sign in with.
- Google sign-in (optional) — paste a Google OAuth client to enable "Sign in with Google" and pulling your YouTube subscriptions. Skip it to use email + password only.
- Email / SMTP (optional) — for verification/notification emails. Skip it and you (the admin) simply approve new accounts yourself.
Then sign in with your admin account. That's it. See docs/self-hosting.md for the full walkthrough.
Just trying it out? Press Enter at the installer's URL prompt to run on
http://localhost:8080.
Build from source (alternative)
Prefer to build the image yourself instead of pulling it:
git clone https://git.b1fr0st.eu/peter/siftlode.git
cd siftlode
cp .env.example .env
# generate the two secrets and paste them into .env:
python -c "import secrets;print('SECRET_KEY='+secrets.token_urlsafe(48))"
python -c "import base64,os;print('TOKEN_ENCRYPTION_KEY='+base64.urlsafe_b64encode(os.urandom(32)).decode())"
docker compose up --build -d # builds from the included Dockerfile
Open http://localhost:8080 and finish in the setup wizard as above. (Set a POSTGRES_PASSWORD in
.env too.)
HTTPS / public access
Port 8080 over plain HTTP is fine for a LAN or a quick trial. For public access put a reverse
proxy (Caddy, Nginx, Traefik…) in front to terminate TLS, and set the public URL (the installer
prompt, or OAUTH_REDIRECT_URL in .env) to your https://… address — this also marks the session
cookie secure. Add that same …/auth/callback URL to your Google OAuth client's authorized redirect
URIs. Behind a proxy, also set TRUSTED_PROXY_IPS so the rate limiters see the real client IP and
can't be bypassed via a forged X-Forwarded-For — see docs/self-hosting.md.
Updating & backups
docker compose -f docker-compose.selfhost.yml pull # or: docker compose pull
docker compose -f docker-compose.selfhost.yml up -d
That follows latest, which moves with every release. Set IMAGE_TAG=0.80.0 in .env to pin a
version and upgrade on your own schedule; released versions are listed in CHANGELOG.md
and in the app's Release Notes. The registry keeps only the newest few of those, so a pin decides
when you take the next hop rather than letting you stay put forever — see
docs/self-hosting.md.
Back up before upgrading. Migrations run automatically on startup and are not undone by pulling
the old image back. A backup is the database dump plus your .env — TOKEN_ENCRYPTION_KEY is
what decrypts the Google, SMTP and Plex secrets stored in that database, so a dump restored without it
is only half an instance. Use scripts/backup.sh (or backup.ps1 on Windows) and scripts/restore.sh;
the equivalent one-liners, the pinning recipe and the rollback steps are in
docs/self-hosting.md.
How it works
- Shared catalog, private state. Channels and videos are stored once and shared; each user's subscriptions, tags, playlists and watch/save/hide state are private.
- Cheap by design. Public reads are cached locally; a shared daily quota budget and a background scheduler keep unattended syncing within YouTube's free API limits. An optional API key lets backfill run without depending on a user's OAuth token.
Tech
FastAPI + PostgreSQL (SQLAlchemy, Alembic) backend; React + Vite + Tailwind + TanStack Query frontend; packaged as a single Docker image with Docker Compose.
License
GNU AGPL-3.0. You can run, study, modify and share Siftlode; if you modify it and let other people use it over a network, they are entitled to your modified source. Copyright © 2026 Siftlode contributors.
Note
This project is developed with AI assistance.