fix: enable yt-dlp browser impersonation for TikTok

TikTok now answers requests without a real browser TLS fingerprint with a
page yt-dlp cannot parse, so every TikTok extraction failed at the metadata
step. yt-dlp can impersonate browsers, but only when curl_cffi is installed
on the interpreter it runs on, which the image never provided.

Dockerfile

@@ -1,35 +1,35 @@
+# syntax=docker/dockerfile:1
 FROM python:3.12-slim-bookworm
 
-# Install system dependencies (ffmpeg required by yt-dlp for audio extraction)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ffmpeg \
-    curl \
-    gosu \
-    && rm -rf /var/lib/apt/lists/*
+ARG TARGETARCH
 
-# Install yt-dlp (standalone binary, always up-to-date)
-RUN curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp \
-    -o /usr/local/bin/yt-dlp && \
-    chmod +x /usr/local/bin/yt-dlp
+# ffmpeg + ffprobe as static binaries (yt-dlp needs both for audio extraction).
+# The Debian package pulls in ~400 MB of X11/desktop dependencies that dpkg then
+# unpacks file by file — on an SD card that alone dominates the build time.
+COPY --from=mwader/static-ffmpeg:7.1 /ffmpeg /ffprobe /usr/local/bin/
+
+# gosu drops privileges in the entrypoint; the binary avoids an apt transaction
+ADD --chmod=755 https://github.com/tianon/gosu/releases/download/1.17/gosu-${TARGETARCH} /usr/local/bin/gosu
 
 WORKDIR /app
 
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install --prefer-binary -r requirements.txt
 
+# Placed after pip: the "latest" URL changes with every yt-dlp release and would
+# otherwise invalidate the dependency layer on each build
+ADD --chmod=755 https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp /usr/local/bin/yt-dlp
+
+COPY --chmod=755 entrypoint.sh /entrypoint.sh
 COPY . .
 
-RUN mkdir -p /app/tmp /app/data
-
 ENV APP_HOST=0.0.0.0
 ENV APP_PORT=8000
 ENV TMP_DIR=/app/tmp
 
 EXPOSE 8000
 
-COPY entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
-
 ENTRYPOINT ["/entrypoint.sh"]
 # Single worker to stay within Pi 3's memory budget
 CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"]

app/extractors/base.py

@@ -3,6 +3,8 @@ import re
 
 VIDEO_PATTERNS = [
     r"youtube\.com/watch",
+    r"youtube\.com/shorts/",
+    r"youtube\.com/live/",
     r"youtu\.be/",
     r"tiktok\.com/",
     r"instagram\.com/reel",

entrypoint.sh

@@ -4,7 +4,9 @@ set -e
 APP_UID=${APP_UID:-1000}
 APP_GID=${APP_GID:-1000}
 
-# Fix ownership of mounted volumes so the app user can write to them
+# Mounted volumes start out empty on a fresh host, and a mount hides anything the
+# image created at these paths — so create the directories here, not at build time
+mkdir -p /app/tmp /app/data/images
 chown "${APP_UID}:${APP_GID}" /app/tmp /app/data /app/data/images
 
 # Self-update yt-dlp on every container start (Instagram/TikTok break old versions).

requirements.txt

@@ -1,12 +1,18 @@
-fastapi>=0.115
-uvicorn>=0.30
-pydantic>=2.9
-pydantic-settings>=2.5
-httpx>=0.27
-python-multipart>=0.0.18
-recipe-scrapers>=15.0
-beautifulsoup4>=4.12
-lxml>=5.2
-openai>=1.50
-python-dotenv>=1.0
-aiofiles>=23.0
+# Pinned to the versions verified on the Pi. Bump deliberately, not implicitly:
+# an unpinned rebuild months later resolves different versions than the running
+# container and breaks in ways the diff cannot explain.
+fastapi==0.139.2
+uvicorn==0.51.0
+pydantic==2.13.4
+pydantic-settings==2.14.2
+httpx==0.28.1
+python-multipart==0.0.32
+recipe-scrapers==15.11.0
+beautifulsoup4==4.15.0
+lxml==6.1.1
+openai==2.46.0
+python-dotenv==1.2.2
+aiofiles==25.1.0
+# Not imported by the app: the yt-dlp binary runs on this interpreter and needs
+# curl_cffi for browser impersonation, without which TikTok rejects requests
+curl_cffi==0.16.3