analysis-dy

中文 | English

中文

analysis-dy 是一个自托管工具, 用于整理 Douyin 和 X 上由内容发布者主动公开的链接内容: 解析, 预览, 下载, 归档和 append-only 快照.

它的出发点很简单: 当与在意的人因为现实走散, 仍想知道对方过得怎样时, 只整理 TA 主动公开的生活片段. 不打扰, 不越界, 不把好奇变成追踪.

边界与隐私

• 只处理公开可访问的内容. 不绕过登录, 付费墙, 地域限制或任何访问控制.
• 不追踪账号, 不向内容发布者发送通知, 不尝试识别或联系对方.
• 请先取得必要授权, 遵守平台条款和当地法律, 并尊重删除请求与版权.
• 不要把平台账号, Cookie, .env 或下载内容提交到 Git. .env 仅应保留在部署机器上.

初始化认证

登录默认开启. 用户名默认是 admin (直接回车采用), 但没有默认密码. 初始化程序要求输入并确认至少 12 位的新密码, 写入 bcrypt hash 与随机 AUTH_SECRET; 明文密码不会写入文件.

Linux/macOS 先安装后端依赖, 再创建本地配置:

cd media-drop-backend
python3 -m venv .venv
.venv/bin/pip install -r requirements.txt
cd ..
./setup-auth.sh

Windows PowerShell:

py -3 -m venv media-drop-backend\.venv
media-drop-backend\.venv\Scripts\python.exe -m pip install -r media-drop-backend\requirements.txt
media-drop-backend\.venv\Scripts\python.exe setup_auth.py

脚本会原子更新 .env 中的 AUTH_* 配置, 保留 DB_* 和其他设置. 如果已存在任何 AUTH_* 配置, 会先要求确认覆盖. Linux/macOS 会尽力把 .env 设为 600; Windows 不会虚假修改 ACL, 请自行限制该文件的访问权限.

配置与启动

在 .env 填写所有 REPLACE_* placeholder, 尤其是 DB_HOST, DB_USER, DB_PASSWORD 和 DB_NAME. favorites 与 snapshot 依赖 MySQL; schema 位于 media-drop-backend/sql/snapshot_tables.sql.

Docker Compose:

docker compose up -d --build backend web

Compose 会在内置 web -> backend 拓扑中默认启用 AUTH_TRUST_PROXY_HEADERS=1, 并假定 80/443 前还有一个受信的公网反向代理. 外层反代必须覆盖单值 X-Real-IP, 不能追加或保留客户端提供的值; 内置 Nginx 再将该值转为 backend 的 X-Forwarded-For, 供登录限流识别真实客户端 IP. 若 backend 直连公网, 没有可信外层反代, 或无法保证该覆盖行为, 请保持 AUTH_TRUST_PROXY_HEADERS=0 (应用默认值).

本地开发可分别启动后端和前端:

cd media-drop-backend
.venv/bin/uvicorn app.main:app --reload --port 8001

cd ../web
corepack enable
pnpm install --frozen-lockfile
pnpm run dev

生产环境应使用 HTTPS, 并保持 AUTH_COOKIE_SECURE=1, 以便会话 Cookie 使用 Secure, HttpOnly, SameSite=Strict 与 __Host- 前缀. 仅在可信本地开发且没有 HTTPS 时, 才临时设置 AUTH_COOKIE_SECURE=0; 不要把这个设置用于公网.

Cookie opt-in

默认不会读取本机浏览器 Cookie:

• DOUYIN_BROWSER_COOKIES=0 禁用 browser-cookie3 读取.
• YTDLP_COOKIES_AUTO=0 禁用 yt-dlp 自动检测浏览器.

只有在本人可控且可信的机器上, 因公开内容确实需要时, 才显式把相应值设为 1. 浏览器 Cookie 可能代表登录会话, 不适合共享服务器, 容器镜像或多人环境. 这不是绕过平台权限的手段.

存储与检查

• archive 默认写入 ./archives.
• snapshot 默认使用 local backend, 写入 ./snapshot_objects; 可通过 SNAPSHOT_STORAGE=minio 配置外部 MinIO.
• local MinIO profile 需要显式填写强 MINIO_ROOT_USER 与 MINIO_ROOT_PASSWORD.

cd media-drop-backend && python -m unittest discover -s tests -v
cd ../web && pnpm install --frozen-lockfile && pnpm run build

GPL Notice

Douyin 后端包含基于 GPL-3.0 上游项目的派生请求签名逻辑. 归属和上游链接见 media-drop-backend/NOTICE.md, 完整许可证见 media-drop-backend/LICENSE.

English

analysis-dy is a self-hosted tool for organizing links that their publishers have made public on Douyin and X: resolve, preview, download, archive, and append-only snapshots.

It is for the quiet situation where people who matter drift apart because of life, yet you still hope to know how they are doing. It only organizes the fragments they chose to make public: no interruption, no crossing boundaries, and no turning curiosity into tracking.

Boundaries and privacy

• Process public content only. Do not bypass login, paywalls, regional restrictions, or any access control.
• Do not track accounts, notify publishers, identify them, or attempt contact.
• Obtain any necessary permission and follow platform terms, local law, deletion requests, and copyright.
• Never commit platform accounts, cookies, .env, or downloaded media to Git. Keep .env only on the deployment machine.

Authentication setup

Authentication is enabled by default. The default username is admin (press Enter to accept it), but there is no default password. The initializer requires and confirms a new password of at least 12 characters, then writes a bcrypt hash and random AUTH_SECRET; it never writes the plaintext password.

On Linux/macOS, install the backend dependencies and create local configuration:

cd media-drop-backend
python3 -m venv .venv
.venv/bin/pip install -r requirements.txt
cd ..
./setup-auth.sh

On Windows PowerShell:

py -3 -m venv media-drop-backend\.venv
media-drop-backend\.venv\Scripts\python.exe -m pip install -r media-drop-backend\requirements.txt
media-drop-backend\.venv\Scripts\python.exe setup_auth.py

It atomically updates AUTH_* entries in .env while retaining DB_* and other settings, and asks before replacing any existing authentication entry. Linux/macOS attempts to set .env to mode 600. Windows does not claim to change ACLs; restrict access to the file yourself.

Configure and run

Replace every REPLACE_* placeholder in .env, especially DB_HOST, DB_USER, DB_PASSWORD, and DB_NAME. Favorites and snapshots use MySQL; the schema is at media-drop-backend/sql/snapshot_tables.sql.

docker compose up -d --build backend web

Compose enables AUTH_TRUST_PROXY_HEADERS=1 by default for its built-in web -> backend topology and assumes a trusted public reverse proxy sits in front of ports 80/443. That outer proxy must overwrite the single X-Real-IP value, never append or preserve a client-supplied one. The bundled Nginx turns it into backend X-Forwarded-For for login rate limiting. Keep AUTH_TRUST_PROXY_HEADERS=0 (the application default) when the backend is directly exposed, no trusted outer proxy exists, or that overwrite guarantee cannot be made.

Use HTTPS in production and keep AUTH_COOKIE_SECURE=1, so the session Cookie can use Secure, HttpOnly, SameSite=Strict, and the __Host- prefix. Set AUTH_COOKIE_SECURE=0 only for trusted local development without HTTPS, never for a public deployment.

Cookie opt-in

Browser Cookie access is off by default:

• DOUYIN_BROWSER_COOKIES=0 disables browser-cookie3 access.
• YTDLP_COOKIES_AUTO=0 disables automatic browser detection by yt-dlp.

Set either value to 1 only when a publicly available link genuinely requires it on a trusted, personally controlled machine. Browser cookies may grant an authenticated session, so they do not belong on shared servers, container images, or multi-user hosts. They are not a way to bypass platform permissions.

Storage, checks, and GPL notice

Archives default to ./archives; snapshots default to ./snapshot_objects. Set SNAPSHOT_STORAGE=minio and configure MINIO_* for external MinIO. The local MinIO Compose profile requires strong, explicit root credentials.

cd media-drop-backend && python -m unittest discover -s tests -v
cd ../web && pnpm install --frozen-lockfile && pnpm run build

The Douyin backend includes request-signing logic derived from GPL-3.0 upstream code. Attribution and the upstream link are in media-drop-backend/NOTICE.md; the full license is media-drop-backend/LICENSE.