use remote cipher, disable oauth, rename lavalink config to .yaml

.gitea/workflows/ci-cd.yaml

@@ -52,13 +52,13 @@ jobs:
           # Ship the compose file and Lavalink config to the server. .env and
           # catchphrases.txt live on the server and are intentionally not copied.
           # Plugins live in a named Docker volume (see docker-compose.yaml), so
-          # only the lavalink/ dir for application.yml is needed here.
+          # only the lavalink/ dir for application.yaml is needed here.
           ssh -i ~/.ssh/key $HOST "mkdir -p $DIR/lavalink"
           scp -i ~/.ssh/key docker-compose.yaml $HOST:"$DIR/docker-compose.yaml"
-          scp -i ~/.ssh/key lavalink/application.yml $HOST:"$DIR/lavalink/application.yml"
+          scp -i ~/.ssh/key lavalink/application.yaml $HOST:"$DIR/lavalink/application.yaml"
 
           # Lavalink's config is a bind mount, and compose only recreates a
           # service when its own config changes — not when a mounted file's
-          # contents do. Restart it explicitly so application.yml is re-read.
+          # contents do. Restart it explicitly so application.yaml is re-read.
           ssh -i ~/.ssh/key $HOST \
             "cd $DIR && docker compose pull && docker compose up -d && docker compose restart lavalink"

README.md

@@ -24,7 +24,7 @@ bot with a few fun slash commands and music playback powered by
 
 The bot is just a **Lavalink client** — actual audio is streamed by a separate
 **Lavalink v4 server** that runs alongside it (started with Docker). YouTube support
-comes from the `youtube-plugin`, configured in `lavalink/application.yml`.
+comes from the `youtube-plugin`, configured in `lavalink/application.yaml`.
 
 - Bot: Java + Gradle (JDA 6, `lavalink-client`)
 - Music server: Lavalink v4 via `docker-compose.yaml`
@@ -120,7 +120,7 @@ you don't set `LAVALINK_URI` yourself here.
 Some tracks — age-restricted ones, and anything YouTube decides to gate behind
 "Sign in to confirm you're not a bot" — won't load on the anonymous clients. The
 `TV` client can play them, but only with a linked Google account, so
-`lavalink/application.yml` enables the plugin's OAuth flow. **Use a throwaway
+`lavalink/application.yaml` enables the plugin's OAuth flow. **Use a throwaway
 Google account: Google does ban accounts for this.**
 
 One-time setup:
@@ -154,4 +154,4 @@ in the client list and only gets used when the others are refused.
 
 - Queue state is kept in memory, so it resets if the bot restarts.
 - YouTube occasionally breaks playback when Google changes its player. The fix is usually
-  bumping the `youtube-plugin` version in `lavalink/application.yml` and restarting the server.
+  bumping the `youtube-plugin` version in `lavalink/application.yaml` and restarting the server.

docker-compose.yaml

@@ -34,11 +34,11 @@ services:
       - .env
     environment:
       - _JAVA_OPTIONS=-Xmx1G
-      # Lavalink reads this for lavalink.server.password in application.yml.
+      # Lavalink reads this for lavalink.server.password in application.yaml.
       # Keep it equal to LAVALINK_PASSWORD (what the bot uses to connect).
       - LAVALINK_SERVER_PASSWORD=${LAVALINK_PASSWORD}
     volumes:
-      - ./lavalink/application.yml:/opt/Lavalink/application.yml:ro
+      - ./lavalink/application.yaml:/opt/Lavalink/application.yaml:ro
       # Named volume (managed by Docker) rather than a host bind mount. Docker
       # initializes it from the image, so it's owned by Lavalink's container user
       # and the plugin jars download without permission errors. No root-owned (or

lavalink/application.yaml

@@ -32,9 +32,9 @@ plugins:
     enabled: true
     allowSearch: true     # enables the "ytsearch:" queries the bot falls back to
     # Tried in order; the first one that can load the track wins. TV is last
-    # because it needs a signed-in account (see oauth below), but it's the only
-    # client that plays age-restricted / "sign in to confirm you're not a bot"
-    # tracks, so it's the fallback when the others get rejected.
+    # because it's the heaviest option, but it's the only client that plays
+    # age-restricted / "sign in to confirm you're not a bot" tracks, so it's
+    # the fallback when the others get rejected.
     clients:
       - MUSIC
       - WEB
@@ -50,7 +50,18 @@ plugins:
       # so the device flow is skipped on every later start.
       #
       # Use a throwaway Google account. Google does ban accounts for this.
-      enabled: true
+      #
+      # Off for now: TV clears the login check anonymously for ordinary tracks,
+      # so a token only buys age-restricted ones. Flip to true (and do the
+      # device flow) if those turn out to matter.
+      enabled: false
+
+    # YouTube serves some regions a localized player script the plugin can't
+    # parse, which fails playback with "must find sig function". Hand the
+    # deciphering to a cipher server instead of doing it locally.
+    remoteCipher:
+      url: "https://cipher.kikkia.dev"
+      userAgent: "botinator"
 
 logging:
   level: