The workaround

Quit using YouTube directly and proxy your request through an Invidious instance.

Your requests are mixed in with everyone else’s, ad’s are blocked and most importantly only 1 machine touches YouTube directly and that’s the server hosting Invidious.

Okay so going at it again, i think i now understand the reason for the Docker label now, here is my current docker-compose.yml i made some tweaks to the one from your github but i can't seem to get a log file to generate.

I suspected it was a permissions issue on the volume mount so i ran chmod 777 on the ./config/csp directory but still wont get a log file.

Volume directory permissions:

    
user@debian:~/compose$ ls config/ | grep csp; ls config/csp/; ls config/csp/logs/
drwxrwxrwx  3 user user 4096 Aug  9 09:11 csp
total 12
drwxrwxrwx  3 user user 4096 Aug  9 09:11 .
drwxr-xr-x 44 user user 4096 Aug  8 16:41 ..
drwxrwxrwx  2 user user 4096 Aug  9 09:04 logs
total 8
drwxrwxrwx 2 user user 4096 Aug  9 09:04 .
drwxrwxrwx 3 user user 4096 Aug  9 09:11 ..

docker-compose.yml:

    
  csp-report:
    image: mhzawadi/csp-report
    networks:
      main:
        ipv4_address: 172.18.0.38
    #ports:
     # - "8432:8080"
    ports:
      - target: 8080
        published: 8432
        mode: host
    container_name: csp-report
    environment:
      - TZ=America/Vancouver
    labels:
      - "csp_report.url=192.168.1.199:3000"
    volumes:
      - ./config/csp/logs:/var/www/html/logs

Logs from the docker container:

    
user@debian:~/compose$ sudo docker compose up -d csp-report --force-recreate; sudo docker logs csp-report -f
WARN[0000] The "POSTGRES_DB" variable is not set. Defaulting to a blank string. 
[+] Running 1/1
 ✔ Container csp-report  Started                                                                                                             0.5s 
/config/start.sh: Launching Unit daemon to perform initial configuration...
2025/08/09 16:21:18 [info] 12#12 unit 1.34.1 started
2025/08/09 16:21:18 [info] 14#14 discovery started
BusyBox v1.37.0 (2025-08-05 16:42:11 UTC) multi-call binary.

Usage: seq [-w] [-s SEP] [FIRST [INC]] LAST

Print numbers from FIRST to LAST, in steps of INC.
FIRST, INC default to 1.

        -w      Pad with leading zeros
        -s SEP  String separator
2025/08/09 16:21:18 [notice] 14#14 module: php 8.4.2 "/usr/lib/unit/modules/php84.unit.so"
2025/08/09 16:21:18 [info] 13#13 controller started
2025/08/09 16:21:18 [notice] 13#13 process 14 exited with code 0
2025/08/09 16:21:18 [info] 18#18 router started
2025/08/09 16:21:18 [info] 18#18 OpenSSL 3.3.4 1 Jul 2025, 30300040
{
        "certificates": {},
        "config": {
                "listeners": {},
                "routes": [],
                "applications": {}
        },

        "status": {
                "modules": {
                        "php": {
                                "version": "8.4.2",
                                "lib": "/usr/lib/unit/modules/php84.unit.so"
                        }
                },

                "connections": {
                        "accepted": 0,
                        "active": 0,
                        "idle": 0,
                        "closed": 0
                },

                "requests": {
                        "total": 0
                },

                "applications": {}
        }
}
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
2025/08/09 16:21:18 [info] 20#20 "csp_report" prototype started
2025/08/09 16:21:18 [info] 21#21 "csp_report" application started
{
        "success": "Reconfiguration done."
}
100   413  100    43  100   370   2808  24162 --:--:-- --:--:-- --:--:-- 27533
/config/start.sh: Stopping Unit daemon after initial configuration...
2025/08/09 16:21:18 [notice] 13#13 process 17 exited with code 0
2025/08/09 16:21:18 [notice] 20#20 app process 21 exited with code 0
2025/08/09 16:21:18 [alert] 20#20 sendmsg(13, -1, -1, 2) failed (32: Broken pipe)
2025/08/09 16:21:18 [notice] 13#13 process 18 exited with code 0
2025/08/09 16:21:18 [notice] 13#13 process 20 exited with code 0
BusyBox v1.37.0 (2025-08-05 16:42:11 UTC) multi-call binary.

Usage: seq [-w] [-s SEP] [FIRST [INC]] LAST

Print numbers from FIRST to LAST, in steps of INC.
FIRST, INC default to 1.


/config/start.sh: Unit initial configuration complete; ready for start up...

        -w      Pad with leading zeros
        -s SEP  String separator
2025/08/09 16:21:18 [info] 1#1 unit 1.34.1 started
2025/08/09 16:21:18 [info] 31#31 discovery started
2025/08/09 16:21:18 [notice] 31#31 module: php 8.4.2 "/usr/lib/unit/modules/php84.unit.so"
2025/08/09 16:21:18 [info] 1#1 controller started
2025/08/09 16:21:18 [notice] 1#1 process 31 exited with code 0
2025/08/09 16:21:18 [info] 33#33 router started
2025/08/09 16:21:18 [info] 33#33 OpenSSL 3.3.4 1 Jul 2025, 30300040
2025/08/09 16:21:18 [info] 34#34 "csp_report" prototype started
2025/08/09 16:21:18 [info] 35#35 "csp_report" application started
127.0.0.1 - - [09/Aug/2025:16:21:23 +0000] "POST / HTTP/1.1" 200 7 "-" "curl/8.12.1"

Most folks here seem to lean to a moderate left also, Conservatives are apparently grouped in with Republicans an MAGA.

While it’s nice to see the community grow there really isn’t any diversity, for lack of a better word, in the political discussions made here.

Hey there! Following up on this, i got your application started however, it seems that this is more for folks who actually know PHP an HTML and less for folks like myself who just find Docker applications (Invidious, Homepage, RedLib) spin them up and rig them to work with one another so i don't think this will work for me personally at the moment in time regardless seems like a great tool nonetheless!

Thanks again!

Is there any special configuration needed for it? Env variables, network interface, volumes & config files, etc?

I plan to set this up in a docker-compose file later this afternoon once I get some free time.

Ah bless!

I’ve been using Firefox extensions to make up my CSP’s and so far it’s been an absolute nightmare! Thank you for this tool!

Debian - I've put Debian with KDE on the mini PC server.

Save your resources on the mini pc by getting rid of KDE, desktops can take quite a lot of resources to run!

If you aren’t familiar with the BASH shell it’s essentially the heart of every Linux/GNU based operating systems, no need for a clunky GUi on a server.

Key commands:

cd == Change Directory
sudo == Root privileges
mkdir == Make directory
rm -f == Remove file/directory with force
touch == Make a new file
nano == Text/File editor
cat == Read file contents and print to shell

Commands don’t need to be complicated! For example nano /home/SomeUser/Downloads/SomeRandom.txt will open the text editor to SomeRandom.txt in the /Downloads directory of SomeUser

(It's an Asus RT-AX86U Pro - so fairly chunky in terms of spec)

I have your exact router make and model! I self host my own server with a domain on my home network and make use of the built in DDNS feature.

My domain registrar is Cloudflare so I have to use a custom script for DDNS, if you’re in the same boat I can provide the script.

I would suggest looking into Asus WRT Merlin Firmware, the custom firmware enables more functionality to your router.

Docker containers for

Ghost
Nginx Proxy Manager

When hosting a reverse proxy like Nginx, Traefik, SWAG, Pangolin, etc keep in mind you 80:80 and 443:443 ports need to be exposed to the host machine then you will forward those ports on your router. This will allow your reverse proxy to communicate with Lets Encrypt generating and verifying your SSL certificates.

First have a look at the report header Content-Security-Policy-Report-Only add things you know about, as that will allow you to log what you need to have setup. Then once you have a list of things you know you need, add them and what the logs again. adding in things as you see and verify them.

Thank you for this! I feel as if I got the idea however, failed on the execution. I added this to my routers.yml -

    
        contentSecurityPolicyReportOnly: "child-src; connect-src; default-src; font-src; frame-src; img-src; manifest-src; media-src; object-src; script-src; script-src-elem; script-src-attr; style-src; style-src-elem; style-src-attr; worker-src; report-to csp-report"

To my understanding the report-to directive at the end adds a endpoint called /csp-report yet in my testing it doesn’t appear to exist and just leads to 403, I’m likely doing something totally wrong but I appreciate you pointing me in the right direction!

Also dont just add things in without checking that its in your code, you dont want to add hack-me.com by mistake.

That’s fair, I’m certainly no wiz at programming and this is just self-hosted docker applications that I’ve jerry-rigged to work with one another.

Just get yourself a 2.5’x3.5’x5/16” steel plate, accomplishing the same thing.

Not the first time for the very neutral state

According to a Swiss parliamentary investigation, "Swiss intelligence service were aware of and benefited from the Zug-based firm Crypto AG’s involvement in the US-led spying".

If your concern is that the CIA owns Crypto AG you should take into consideration what their focus is on, are they focused on child predators and gangs or people torrenting movies and music?

Crypto AG and Proton have clashed in the past resulting in this article from Proton;

https://proton.me/blog/is-protonmail-trustworthy

Transparency: You know who runs the company, where they run it from, how they run it, what data they have, how they interact with law enforcement, and much more.

Business model: Their business model (how they make money) is simply having paid users that pay for the service. If they were to breach that trust, then they would no longer be able to sustain themselves.

Competence: They have a team of highly competent people. Most people in their management level have Ph. Ds and they are trusted by many users with heightened security needs. These users includeHKMaps.live, Bellingcat etc.

Verified By Third Parties: Proton is still in the process of getting all their apps audited and open sourced. Currently, the ProtonMail iOS app, OpenPGP.js, GoOpenPGP and all the ProtonVPN apps have been audited by Cure53 or SEC Consult and the reports publically available with the source code on github with android and bridge on the way. Furthermore, they have been checked over by the EU and given a 2 million euros of funding that can be used on anything to further their mission with no other obligations.

Legal guarantees: Proton is based in Switzerland, a country with strong privacy protections, and outside the 14 eyes surveillance network. Under Swiss law, they are only permitted to reveal user data if served with a binding legal order from the Swiss government. Sharing data without a legal order is a criminal offense under Article 271 of the Swiss Criminal Code.

Track record: ProtonMail’s creation by scientists who met at CERN (the European Organization for Nuclear Research) is well documented, including on the CERN website. The scientific background of their leadership team can be easily verified by looking at their academic careers and scientific publications.

More info

On a related note, we have also had people ask us about Proton Mail’s official position regarding the ongoing Palestinian-Israeli conflict and whether working with an Israeli company means we are taking sides in this conflict. The answer is NO. As a Swiss company, we adhere to a policy of strict neutrality

In the header of this article you seemed to have glossed over:

UPDATE April 3, 2020: The information in this article is outdated. As of last year, we no longer have any contract with Radware.

Ehm… you guys know that behind all major VPN companies there’s the isræli government right?

Okay. proceeds to check article

Kape Technologies

This is why you research the VPN provider prior to making your purchase, read their privacy policies, their EULA, their TOS, the companies history.

If it reads like the Bible skip over it.

ProtonVPN, iVPN and Mullvad have no association with this article whatsoever.

A dev with some sense.

I mean, you’re not wrong. The dev does have some sense, not a lot, not a little, just some a very broad some.

Fuck Linux.

Bonus points if you can route your personal VPN server through your VPN provider, the flow looks a little like this:

Client <—> Personal VPN server <—> VPN Provider

For the folks saying install Linux keep in mind you can indirectly be captured by this feature.

For example if you’re playing an online video game you’ll be captured or your chat messages in your messaging app.

Probably force an insecure or outdated protocol and market it as “top of the line”.

Not a single soul asked for it, waste of company resources.

If your reverse proxy is Traefik I would suggest This plugin which pulls the robot.txt from This GitHub repository.

I honestly should’ve setup a robots.txt a long time ago.

ohshit604

@ ohshit604 @sh.itjust.works

Posts

5
Comments

327
Joined

2 yr. ago

ohshit604

YouTube just quietly blocked Adblock Plus — the internet hasn't noticed yet, but I've found a workaround

How do you configure CSP headers on 20+ applications ?

Volume directory permissions:

docker-compose.yml:

Logs from the docker container:

What are the biases of Lemmy?

What are the biases of Lemmy?

How do you configure CSP headers on 20+ applications ?

How do you configure CSP headers on 20+ applications ?

How do you configure CSP headers on 20+ applications ?

Your favourite piece of selfhosting - Part 1 - Operating System

Self-hosted blog - do I need a static IP address?

Self-hosted blog - do I need a static IP address?

How do you configure CSP headers on 20+ applications ?

Amusement

Proton releases a new app for two-factor authentication

Proton releases a new app for two-factor authentication

Duckstation(one of the most popular PS1 Emulators) dev plans on eventually dropping Linux support due to Linux users, especially Arch Linux users.

UK households could face VPN 'ban' after use skyrockets following Online Safety Bill

How to disable Microsoft Recall & stop the AI from taking screenshots of your desktop.

UK households could face VPN 'ban' after use skyrockets following Online Safety Bill

Proton freezes Swiss investment over surveillance fears

New Executive Order:AI must agree on the Administration views on Sex,Race, cant mention what they deem to be Critical Race Theory,Unconscious Bias,Intersectionality,Systemic Racism or "Transgenderism