mathias/tapir
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(homelab): note YouTube secret-ref is parameterized + captions.download owner-only caveat

Browse Source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
mathias
2026-06-02 17:06:40 +02:00
co-authored by Claude Opus 4.8
parent 9a7ba3a346
commit 39e8756e77
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/homelab-integration.md
+16 -1
View File
@@ -63,6 +63,11 @@ This maps directly onto the copied `llm` package: `Client` is the OpenAI-compati
- **Exact ref format / vault item naming for Tapir:** **confirm / decide during build.** Follow - **Exact ref format / vault item naming for Tapir:** **confirm / decide during build.** Follow
the pattern existing services use (e.g. how `gitea-mcp` references `GITEA_MCP_DEFAULT_TOKEN`) the pattern existing services use (e.g. how `gitea-mcp` references `GITEA_MCP_DEFAULT_TOKEN`)
rather than inventing a new scheme. rather than inventing a new scheme.
- **Adapter status (YouTube):** the YouTube `VideoSource` adapter does **not** assume a scheme.
The OAuth refresh-token reference is an opaque `Config.TokenSecretRef` resolved through the
`SecretStore` port (`youtube.New(cfg, secrets)`). Pinning the actual vault-item name only
changes wiring/config, not the adapter — so this `confirm` does not block the adapter. Decide
the name when wiring the live connection and record it here.
## Hosts (for reference) ## Hosts (for reference)
@@ -100,7 +105,17 @@ homelab's actual `GOPROXY`/`GONOSUMCHECK` policy here once known would remove th
- `koala:4000` (or the NodePort / post-relocation address) — LiteLLM gateway, the Primary. - `koala:4000` (or the NodePort / post-relocation address) — LiteLLM gateway, the Primary.
- brain-mcp host (`*-mcp.d-ma.be`, **confirm**) — only when the brain sink is enabled. - brain-mcp host (`*-mcp.d-ma.be`, **confirm**) — only when the brain sink is enabled.
- `www.googleapis.com` / YouTube Data API + `oauth2.googleapis.com` (token exchange/refresh) — - `www.googleapis.com` / YouTube Data API + `oauth2.googleapis.com` (token exchange/refresh) —
the YouTube provider adapter. the YouTube provider adapter (`internal/adapters/youtube`). OAuth is hand-rolled on
`golang.org/x/oauth2` (ADR-006); the Google token endpoint is hardcoded inline to avoid the
heavy `golang.org/x/oauth2/google` dependency.
- **`confirm` — captions.download ownership limitation.** The Data API `captions.download`
endpoint only authorizes the *owner* of the video; for arbitrary subscribed channels it
typically returns `403`. The adapter lists tracks via `captions.list` (no track → `SourceNone`,
ADR-007) and downloads the selected track as WebVTT; a download failure surfaces as an error
(retryable), not a silent skip. If the owner-only limit proves blocking in practice, the
fallback is the unofficial `timedtext` endpoint or the deferred STT path (ADR-007) — a new
ADR, not a default. Verify against a real non-owned video before relying on live caption
download.
- `api.vimeo.com` — the Vimeo provider adapter. - `api.vimeo.com` — the Vimeo provider adapter.
- BYO-AI endpoints, per configured provider and **only when a user opts in**: - BYO-AI endpoints, per configured provider and **only when a user opts in**:
`api.anthropic.com`, `api.openai.com`, `generativelanguage.googleapis.com`. `api.anthropic.com`, `api.openai.com`, `generativelanguage.googleapis.com`.