peter
f76a2afbf1
Items 2, 4, 5 and 7 of the bug hunt, one round. They are independent, but they are all the same kind of thing: an action that exists somewhere else in the app and is missing where you actually want it. **5 — the channel name in the YT player is a link again.** It was a `<button>`, so middle-click and Ctrl/Cmd-click did nothing on a thing that looks exactly like a link (the YouTube icon beside it IS an anchor and opens a tab). It is now a real `<a>` whose href is the same `?chan=<id>` URL `openChannel` pushes, with a plain left click still taking the in-app path — that path does more than navigate, since the player must close and reclaim its own Back-to-close history entry first. The "is this click ours or the browser's" test is now ONE predicate (`isPlainLeftClick`), which VideoCard's card link also uses, so a second such link cannot forget the middle-click arm. **2 — "Remove" from inside the player.** The parent owns the removal (the SAME `removeItem` the row menu and the inline ✕ use: one confirm, one optimistic update, one undo-stack rebase), and the player owns what happens next, because it is the only side that knows which item is playing — its launch queue is frozen at mount. It drops the item, plays what followed, and closes when the list runs out. That forced a real fix in Playlists: the player's mount was derived from `shown` every render, so anything that dropped the launch row yanked the player off the screen mid-playback. That was a latent edge (change the view and it happens) and the normal case for this feature. The parent now snapshots what it launched with, and only onClose takes the player down. **4 — "Move to <the last list you moved to>".** The submenu is two levels deep and moving a run of videos into the same list is the shape this gets used in. The remembered id is a per-account pref; the row is derived from `moveTargets`, which already excludes the list you are looking at, so it cannot offer a move to where the video already is. Remembered only on a SUCCESSFUL move — a shortcut to a move that failed is a shortcut to failing again. Absent, not disabled, when there is nothing to repeat: there is nothing to explain. **7 — the live-YouTube results can be sorted.** Client-side, over the page already loaded. Not a new `order=` param, and this is the decision worth recording: the owner's case is "even one page of results", i.e. reorder what is on screen; a re-query would REPLACE the results, which is not what "sort these" means; and the zero-quota scrape source has no order parameter at all, so a server-side control would silently do nothing (or quietly cost 100 quota units) depending on which source served the page. Only keys a search hit carries are offered — `subscribers`/`priority` describe a subscription, which a search hit is not, and `shuffle` on a ranked list is noise. Its own pref, so sorting a search page never re-sorts the library behind it. Verified in the browser on localdev against the real account: the channel name renders as `<a href="…&chan=…">` and a ctrl-click / middle-click is left to the browser while a plain click still opens the channel in-app; removing from the player stepped 1/3 → 1/2 onto the next video and closed on the last one; the row menu grew "Move to “…”" only after a move and only on a list that is not the target; and the results sort reordered by views 41.7M → 29.8M → 24.2M → 15.8M. (The pane's own ctrl-click arrives without the modifier — a harness limit, so the modifier cases were driven as real MouseEvents.) Scratch playlists and the touched prefs were cleaned up afterwards. 22 vitest, mutation-checked against 14 mutations (no href at all · href without the rest of the query · every click hijacked in-app · the middle-click arm dropped from the predicate · plain click no longer in-app · always jumping to the top of the list · the removed item left in the queue · no clamp when the last item goes · an empty queue not reported as "nothing left" · sort-then-reverse flipping ties · unknown values first · titles compared numerically · shuffle offered on search results · direction ignored) — each red on exactly the test that names it. Item 4 has no test of its own: its rule is enforced by construction, not by a check.
Siftlode
Your YouTube subscriptions, the way a feed should work. Siftlode pulls every upload from the channels you follow into one clean, filterable feed — no algorithm deciding what you see, and no Shorts or livestream noise unless you want it. Self-hosted, multi-user, and private: your data stays on your own server.
Everything expensive (channels, videos, metadata) is fetched from YouTube once and stored locally, so filtering, searching and sorting are instant and don't burn API quota. Click a video to watch it in an in-app player that resumes where you left off — or open it on youtube.com so your own ad blocker and SponsorBlock keep working.
Features
- A readable subscription feed — sort and filter by channel, tag, language, topic, length, upload date or watch state; hide channels without unsubscribing; save filter setups as named views.
- Search all of YouTube from the feed — live results you can play, save or add to playlists like any other video; they stay temporary and out of your catalog unless you keep one.
- Channel pages & a channel manager — per-channel stats and uploads, priorities, and your own tags to slice the feed by.
- Playlists with two-way YouTube sync — build them locally, keep them in sync in both directions.
- In-app player with resume, plus keyboard/scroll controls.
- Download Center — save videos to the server with yt-dlp in a Plex-friendly layout (format presets, per-user storage quota), trim / crop / split & join them in a built-in editor, then save to your device, share with another user, or hand out a public watch link.
- Plex library (optional) — point Siftlode at your own Plex server to browse and play its movies and shows alongside your feed, with watch state kept in sync.
- Multi-user with per-user private state, a shared catalog, and a fair daily API-quota guard.
- Self-hosted & private, with a first-run web setup wizard and the interface in English and Hungarian.
Quick start (self-hosting)
You don't need to build anything — Siftlode runs from a prebuilt public image, and all configuration (your admin account, Google sign-in, email) happens in a first-run web wizard. You need Docker with the Compose plugin.
1. Get the files and run the installer:
git clone https://git.b1fr0st.eu/peter/siftlode.git
cd siftlode
./install.sh # Windows (PowerShell): ./install.ps1
The installer generates a private .env (secrets), pulls the image, starts the app + database, and
prints a one-time setup URL like http://localhost:8080/setup?token=….
2. Finish in your browser. Open that URL and follow the wizard:
- Admin account — the email + password you'll sign in with.
- Google sign-in (optional) — paste a Google OAuth client to enable "Sign in with Google" and pulling your YouTube subscriptions. Skip it to use email + password only.
- Email / SMTP (optional) — for verification/notification emails. Skip it and you (the admin) simply approve new accounts yourself.
Then sign in with your admin account. That's it. See docs/self-hosting.md for the full walkthrough.
Just trying it out? Press Enter at the installer's URL prompt to run on
http://localhost:8080.
Build from source (alternative)
Prefer to build the image yourself instead of pulling it:
git clone https://git.b1fr0st.eu/peter/siftlode.git
cd siftlode
cp .env.example .env
# generate the two secrets and paste them into .env:
python -c "import secrets;print('SECRET_KEY='+secrets.token_urlsafe(48))"
python -c "import base64,os;print('TOKEN_ENCRYPTION_KEY='+base64.urlsafe_b64encode(os.urandom(32)).decode())"
docker compose up --build -d # builds from the included Dockerfile
Open http://localhost:8080 and finish in the setup wizard as above. (Set a POSTGRES_PASSWORD in
.env too.)
HTTPS / public access
Port 8080 over plain HTTP is fine for a LAN or a quick trial. For public access put a reverse
proxy (Caddy, Nginx, Traefik…) in front to terminate TLS, and set the public URL (the installer
prompt, or OAUTH_REDIRECT_URL in .env) to your https://… address — this also marks the session
cookie secure. Add that same …/auth/callback URL to your Google OAuth client's authorized redirect
URIs. Behind a proxy, also set TRUSTED_PROXY_IPS so the rate limiters see the real client IP and
can't be bypassed via a forged X-Forwarded-For — see docs/self-hosting.md.
Updating & backups
docker compose -f docker-compose.selfhost.yml pull # or: docker compose pull
docker compose -f docker-compose.selfhost.yml up -d
That follows latest, which moves with every release. Set IMAGE_TAG=0.80.0 in .env to pin a
version and upgrade on your own schedule; released versions are listed in CHANGELOG.md
and in the app's Release Notes. The registry keeps only the newest few of those, so a pin decides
when you take the next hop rather than letting you stay put forever — see
docs/self-hosting.md.
Back up before upgrading. Migrations run automatically on startup and are not undone by pulling
the old image back. A backup is the database dump plus your .env — TOKEN_ENCRYPTION_KEY is
what decrypts the Google, SMTP and Plex secrets stored in that database, so a dump restored without it
is only half an instance. Use scripts/backup.sh (or backup.ps1 on Windows) and scripts/restore.sh;
the equivalent one-liners, the pinning recipe and the rollback steps are in
docs/self-hosting.md.
How it works
- Shared catalog, private state. Channels and videos are stored once and shared; each user's subscriptions, tags, playlists and watch/save/hide state are private.
- Cheap by design. Public reads are cached locally; a shared daily quota budget and a background scheduler keep unattended syncing within YouTube's free API limits. An optional API key lets backfill run without depending on a user's OAuth token.
Tech
FastAPI + PostgreSQL (SQLAlchemy, Alembic) backend; React + Vite + Tailwind + TanStack Query frontend; packaged as a single Docker image with Docker Compose.
License
GNU AGPL-3.0. You can run, study, modify and share Siftlode; if you modify it and let other people use it over a network, they are entitled to your modified source. Copyright © 2026 Siftlode contributors.
Note
This project is developed with AI assistance.