Skip to content

Releases: fabwaseem/snagbox

Release list

v2.0.0

v2.0.0 Latest
Latest

Choose a tag to compare

View all tags
@cursor cursor released this 14 Oct 11:22
v2.0.0
55d2e2d

Snagbox 2.0.0 is the first release under this name. Paste a public link and the API queues a download, reports progress, and hands back a signed file link.

Snagbox

  • The product, npm packages (snagbox, @snagbox/shared), Docker labels, Compose project, and docs are Snagbox.
  • Arrow-into-tray mark, with the ember-to-magenta gradient (#FF5E3A to #FF2D87).
  • Browser playground at /, with the logo, favicon, and the same palette.
  • New API keys use the sb_ prefix. Environment variable names are unchanged.

Platforms and generic mode

First-class support for YouTube, Instagram, TikTok, X, Facebook, Reddit, Vimeo, Bluesky, Threads, Pinterest, Twitch, SoundCloud, and Snapchat.

Set ALLOW_GENERIC_URLS=true to accept any other public http(s) URL that yt-dlp supports.

Queue

Jobs run on BullMQ when REDIS_URL is set, and on an in-memory queue when it is not. Redis also backs API-key rate limits and the media cache, each with an in-memory fallback.

Downloads, webhooks, and signed links

  • One URL or a batch. Video or audio, quality, GIF, H.264, subtitles, thumbnails, embedded metadata, and a time clip.
  • Live progress over server-sent events.
  • Finished files are served from a signed link (exp and sig), from local disk or any S3-compatible bucket (R2, MinIO).
  • A finished or failed job can POST JSON to callbackUrl, signed as X-Downloader-Signature: sha256=… (WEBHOOK_SECRET).
  • yt-dlp failures use stable codes: BLOCKED, PRIVATE, GEO_RESTRICTED, LOGIN_REQUIRED, UNAVAILABLE, UNSUPPORTED.

SSRF guard

Private, loopback, and link-local addresses are rejected, including DNS answers and redirects that resolve to those ranges.

Metrics, playground, and the image

  • Prometheus metrics at /metrics, structured logs, and GET /v2/health.
  • OpenAPI at /openapi.json and Swagger at /docs.
  • Docker Compose brings up the API, Postgres, and Redis. Optional profiles cover MinIO and bgutil.
  • Railway deploy button. Health check is GET /v2/health.
  • This tag publishes ghcr.io/fabwaseem/snagbox:2.0.0 and ghcr.io/fabwaseem/snagbox:latest.

Upgrade

Point deploys at github.com/fabwaseem/snagbox and ghcr.io/fabwaseem/snagbox. Keep the existing environment variable names. Compose and production need BETTER_AUTH_SECRET. Leave AUTH_DISABLED unset on any host that is not only yours.

Assets 2
Loading