📥 YouTube to MP3 / MP4

YouTube blocks downloads from datacenter/VPS IPs with a "Sign in to confirm you're not a bot" check. The PO-token provider (office-tools-pot) is running and healthy, but on a flagged server IP that alone is not enough — YouTube requires authenticated cookies. There is no fully autonomous way to mint these on the server: the initial Google login must be done by a human (Google's login flow blocks datacenter logins with CAPTCHA/2FA). Cookies then last weeks, not forever, and must be re-exported when downloads start failing again.

① Create cookies (one time, on your local computer)

1. Make a "burner" Google account first. A burner (throwaway) account is a brand-new Google account created for this one job: any name, no recovery phone or address you care about, nothing else signed in to it, and you would not mind losing it tomorrow. Two reasons it must not be your real account: YouTube flags and sometimes bans accounts whose session is used for server-side downloading, and the exported cookies.txt is a working login for that account — anyone who can read that file on the server is signed in as it. Below, "the burner" means this account.
2. Recommended — private window + extension. Install "Get cookies.txt LOCALLY" (allow it to run in private windows), open a private / incognito window, log into youtube.com with the burner account, open a normal video, then click the extension → Export → save cookies.txt (Netscape format). Any ordinary video will do, e.g. https://www.youtube.com/watch?v=J6VMJLSNAHk.
   Private is the right choice because nothing touches that session afterwards — a session you keep browsing with has its cookies rotated, and the exported copy goes stale within hours.
3. Alternative — let yt-dlp export it, no extension needed:

   yt-dlp --cookies-from-browser firefox --cookies cookies.txt \
          --skip-download "https://www.youtube.com/watch?v=J6VMJLSNAHk"

   This reads the profile's on-disk cookie DB, so it cannot see a private window — those cookies are memory-only. Use a normal window, ideally a Firefox profile kept only for the burner account, and close Firefox before running it. Firefox, not Chrome: app-bound cookie encryption commonly breaks --cookies-from-browser chrome.
4. Close the window WITHOUT logging out. Logging out invalidates the session server-side — this is the #1 reason server cookies "work for an hour then die."

② Install on the server

Run deploy.sh → Option 6 → j) YouTube cookies → 1) Set up cookies. That is a three-screen walkthrough of everything in step ① above and ends at the paste prompt (paste, then a line containing only EOF). It validates the file, installs it as www-data 600, adds YTDLP_COOKIES to .env, installs the keep-alive cron, restarts yt-server and prints the probe result — no manual commands.

Equivalent by hand, if you prefer:

# after copying cookies.txt to the VPS (scp):
install -o www-data -g www-data -m 600 cookies.txt /opt/office-tools/yt-server/cookies.txt
grep -q '^YTDLP_COOKIES=' /opt/office-tools/yt-server/.env \
  || echo 'YTDLP_COOKIES=/opt/office-tools/yt-server/cookies.txt' >> /opt/office-tools/yt-server/.env
systemctl restart office-tools-cobalt
curl -s http://127.0.0.1:9000/health   # "cookies" should change from "none" to "file:ok"/"file:unchecked"

③ Renew (when the bot-check returns weeks later)

A cron probe (ytcookie-keepalive.sh, every 6 hours) keeps the session rotating and flips the backend line above to ⚠ cookies expired when Google finally rejects it — you no longer have to notice by watching downloads fail. Re-export with the same incognito method and repeat step ② (deploy.sh → Option 6 → j).

Note: yt-dlp rewrites rotated cookies back into this file on each use, so it must stay writable by www-data — that is why every path above installs it as www-data, never root. Cookie upkeep is inherent to running a YouTube downloader from a server IP — it is not a bug in the tool.