From d9ce4b061b3b0efa360f203a00f0783f23f18b85 Mon Sep 17 00:00:00 2001
From: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Date: Sun, 8 Nov 2026 08:14:34 -0600
Subject: [PATCH] Replace nginx secure token module (#24893)

* remove nginx-secure-token-module from the nginx build

Kaltura deleted the nginx-secure-token-module repo, so the tarball download in build_nginx.sh returned a 404 and any build without a cached nginx layer failed. This drops the module and its secure_token directives from the vod location.

* use sub_filter to pass vod playlist args to segment URLs

Home Assistant signs vod playlist URLs with authSig and needs it on every init, segment, and index URL in the playlist. sub_filter appends the request args to the three URL endings vod writes, giving byte-identical playlists to the old secure_token output.
---
 docker/main/build_nginx.sh                         |  7 -------
 docker/main/rootfs/usr/local/nginx/conf/nginx.conf | 10 ++++++++--
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/docker/main/build_nginx.sh b/docker/main/build_nginx.sh
index 4a8ea15d45..c1ab9c90ff 100755
--- a/docker/main/build_nginx.sh
+++ b/docker/main/build_nginx.sh
@@ -4,7 +4,6 @@ set -euxo pipefail
 
 NGINX_VERSION="1.27.4"
 VOD_MODULE_VERSION="v1.9.1"
-SECURE_TOKEN_MODULE_VERSION="1.5"
 SET_MISC_MODULE_VERSION="v0.33"
 NGX_DEVEL_KIT_VERSION="v0.3.3"
 
@@ -52,11 +51,6 @@ patch -d /tmp/nginx-vod-module/ -p1 << 'EOF'
 EOF
 
 
-mkdir /tmp/nginx-secure-token-module
-wget https://github.com/kaltura/nginx-secure-token-module/archive/refs/tags/${SECURE_TOKEN_MODULE_VERSION}.tar.gz
-tar -zxf ${SECURE_TOKEN_MODULE_VERSION}.tar.gz -C /tmp/nginx-secure-token-module --strip-components=1
-rm ${SECURE_TOKEN_MODULE_VERSION}.tar.gz
-
 mkdir /tmp/ngx_devel_kit
 wget https://github.com/vision5/ngx_devel_kit/archive/refs/tags/${NGX_DEVEL_KIT_VERSION}.tar.gz
 tar -zxf ${NGX_DEVEL_KIT_VERSION}.tar.gz -C /tmp/ngx_devel_kit --strip-components=1
@@ -80,7 +74,6 @@ cd /tmp/nginx
     --add-module=../ngx_devel_kit \
     --add-module=../nginx-set-misc-module \
     --add-module=../nginx-vod-module \
-    --add-module=../nginx-secure-token-module \
     --with-cc-opt="-O3 -Wno-error=implicit-fallthrough"
 
 make CC="ccache gcc" -j$(nproc) && make install
diff --git a/docker/main/rootfs/usr/local/nginx/conf/nginx.conf b/docker/main/rootfs/usr/local/nginx/conf/nginx.conf
index 5884a11ed5..cf9a567216 100644
--- a/docker/main/rootfs/usr/local/nginx/conf/nginx.conf
+++ b/docker/main/rootfs/usr/local/nginx/conf/nginx.conf
@@ -143,8 +143,14 @@ http {
             # version 6 (RFC 8216 section 7); the module default is 4
             vod_hls_version 6;
 
-            secure_token $args;
-            secure_token_types application/vnd.apple.mpegurl;
+            # Pass the playlist's query args (e.g. Home Assistant's authSig) on
+            # to every URL in it. These match the only URL endings vod writes
+            # with fmp4 and no subtitles.
+            sub_filter_types application/vnd.apple.mpegurl;
+            sub_filter_once off;
+            sub_filter '.m3u8' '.m3u8$is_args$args';
+            sub_filter '.m4s' '.m4s$is_args$args';
+            sub_filter '.mp4"' '.mp4$is_args$args"';
 
             include security_headers.conf;
             add_header Cache-Control "no-store";