use sub_filter to pass vod playlist args to segment URLs

Home Assistant signs vod playlist URLs with authSig and needs it on every init, segment, and index URL in the playlist. sub_filter appends the request args to the three URL endings vod writes, giving byte-identical playlists to the old secure_token output.

docker/main/build_nginx.sh

@@ -4,7 +4,6 @@ set -euxo pipefail
 
 NGINX_VERSION="1.27.4"
 VOD_MODULE_VERSION="v1.9.1"
-SECURE_TOKEN_MODULE_VERSION="1.5"
 SET_MISC_MODULE_VERSION="v0.33"
 NGX_DEVEL_KIT_VERSION="v0.3.3"
 
@@ -52,11 +51,6 @@ patch -d /tmp/nginx-vod-module/ -p1 << 'EOF'
 EOF
 
 
-mkdir /tmp/nginx-secure-token-module
-wget https://github.com/kaltura/nginx-secure-token-module/archive/refs/tags/${SECURE_TOKEN_MODULE_VERSION}.tar.gz
-tar -zxf ${SECURE_TOKEN_MODULE_VERSION}.tar.gz -C /tmp/nginx-secure-token-module --strip-components=1
-rm ${SECURE_TOKEN_MODULE_VERSION}.tar.gz
-
 mkdir /tmp/ngx_devel_kit
 wget https://github.com/vision5/ngx_devel_kit/archive/refs/tags/${NGX_DEVEL_KIT_VERSION}.tar.gz
 tar -zxf ${NGX_DEVEL_KIT_VERSION}.tar.gz -C /tmp/ngx_devel_kit --strip-components=1
@@ -80,7 +74,6 @@ cd /tmp/nginx
     --add-module=../ngx_devel_kit \
     --add-module=../nginx-set-misc-module \
     --add-module=../nginx-vod-module \
-    --add-module=../nginx-secure-token-module \
     --with-cc-opt="-O3 -Wno-error=implicit-fallthrough"
 
 make CC="ccache gcc" -j$(nproc) && make install

docker/main/rootfs/usr/local/nginx/conf/nginx.conf

@@ -143,8 +143,14 @@ http {
             # version 6 (RFC 8216 section 7); the module default is 4
             vod_hls_version 6;
 
-            secure_token $args;
-            secure_token_types application/vnd.apple.mpegurl;
+            # Pass the playlist's query args (e.g. Home Assistant's authSig) on
+            # to every URL in it. These match the only URL endings vod writes
+            # with fmp4 and no subtitles.
+            sub_filter_types application/vnd.apple.mpegurl;
+            sub_filter_once off;
+            sub_filter '.m3u8' '.m3u8$is_args$args';
+            sub_filter '.m4s' '.m4s$is_args$args';
+            sub_filter '.mp4"' '.mp4$is_args$args"';
 
             include security_headers.conf;
             add_header Cache-Control "no-store";