A tiny Go HTTP service that fetches YouTube auto-generated subtitles as SRT via yt-dlp and returns them in the HTTP response body. This exists as a service for n8n to call.

Build and run the hardened Docker image with the supplied Makefile:

make build         # build the image, tagged :<YYYYMMDD>-<sha8> and :latest
make run           # run it on :8080 with --read-only, --cap-drop=ALL, no-new-privileges

Then in another shell:

curl -s -X POST http://localhost:8080/ \
  -H 'Content-Type: application/json' \
  -d '{"data":"https://www.youtube.com/watch?v=dQw4w9WgXcQ"}' \
  | jq -r .srt

To publish a multi-arch image to docker.io/aijutsudev/ytsrtgen:

make login         # prompts for credentials (or use $CR_PAT for ghcr.io)
make publish       # buildx multi-arch build + push in one step

See Makefile for all targets and variables.

1. Client POSTs {"data":"<youtube-url>"} to /.
2. The server creates a fresh temp directory and invokes:

   yt-dlp --skip-download --write-auto-subs --sub-lang en \
          --sub-format srt --convert-subs srt \
          -o "%(id)s.%(ext)s" <youtube-url>
   

3. The resulting *.srt file is read from the temp dir.
4. The server responds with {"srt":"<srt-data>"} and removes the temp dir.

exec.CommandContext ties yt-dlp's lifetime to the inbound request, so a client disconnect cancels the download.

Request body

{ "data": "https://www.youtube.com/watch?v=dQw4w9WgXcQ" }

Success — 200 OK

{ "srt": "1\n00:00:00,000 --> 00:00:02,000\nHello\n..." }

Errors

Only POST is routed; other methods on / return 405.

Interactive OpenAPI 2.0 documentation, rendered by swaggo/http-swagger from annotations in main.go.

The spec is generated by swag into ./docs and embedded in the binary via a blank import. To regenerate after changing annotations:

make swagger       # installs swag if missing, then writes ./docs/{docs.go,swagger.json,swagger.yaml}

The build-go, build, buildx, and publish targets depend on swagger, so a fresh checkout that runs make publish will regenerate the docs before building the image.

curl -s -X POST http://localhost:8080/ \
  -H 'Content-Type: application/json' \
  -d '{"data":"https://www.youtube.com/watch?v=dQw4w9WgXcQ"}' \
  | jq -r .srt

Requires Go 1.25+ and yt-dlp on PATH.

make build-go      # outputs ./bin/ytsrtgen
./bin/ytsrtgen

Or:

go run .

Run the unit tests:

make test          # or: go test ./...

Tests live in main_test.go and exercise handleGenerate end-to-end through httptest. They do not require yt-dlp or network access — instead, each test that needs to invoke yt-dlp writes a short shell script named yt-dlp into a t.TempDir() and prepends that directory to PATH via t.Setenv. Because the handler sets cmd.Dir to its own per-request temp dir, the fake script's $PWD is exactly where the handler will later filepath.Glob("*.srt"), so it can drop a fake .srt there to simulate success, exit non-zero to simulate failure, or write nothing to simulate "no subs available".

Coverage:

The test file carries //go:build !windows because the fake binary is a #!/bin/sh script.

docker build -t ytsrtgen .
docker run --rm -p 8080:8080 ytsrtgen

Recommended defense-in-depth flags (the image is built to support all of these):

docker run --rm -p 8080:8080 \
  --read-only --tmpfs /tmp \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  ytsrtgen

A minimal Helm chart lives at charts/ytsrtgen/. It ships a single-replica Deployment and a ClusterIP Service, and intentionally exposes only three groups of values:

Anything else (replica count, service type, ingress, RBAC, etc.) is intentionally hardcoded — fork the chart or post-process with helm template | kubectl apply -f - if you need more.

The helm-* targets set image.repository / image.tag from $(REGISTRY)/$(NAMESPACE)/$(IMAGE):$(TAG) automatically, so a normal install is one command after make publish:

make publish                   # build & push the image
make helm-deploy               # helm upgrade --install into $(HELM_NAMESPACE)

Other common flows:

make helm-lint                                          # validate the chart
make helm-template                                      # render to stdout
make helm-deploy KUBE_CONTEXT=prod HELM_NAMESPACE=apps  # target a specific context/namespace
make helm-deploy HELM_VALUES=./my-values.yaml           # override resources/ports/image
make helm-diff                                          # diff vs. live release (needs helm-diff plugin)
make helm-uninstall                                     # remove the release
make helm-package                                       # tgz to ./dist

If you'd rather skip the Makefile:

helm upgrade --install ytsrtgen ./charts/ytsrtgen \
  --namespace ytsrtgen --create-namespace \
  --set image.repository=docker.io/aijutsudev/ytsrtgen \
  --set image.tag=20260518-abcdef12 \
  --atomic --wait

make help lists every target. Variables can be overridden on the command line, e.g. make publish TAG=v0.1.0 REGISTRY=ghcr.io.

Resolved image ref: $(REGISTRY)/$(NAMESPACE)/$(IMAGE):$(TAG). Run make print to see what would be built. The Helm targets feed this ref into the chart via --set image.repository --set image.tag, so every helm-* invocation deploys whatever the current TAG would build.

Go (host)

Docker — single-arch, local daemon

Docker — multi-arch via buildx

Publishing

Helm

Housekeeping

Local development loop:

make build && make run

Cut a release:

git tag v0.1.0
make login
make publish               # multi-arch, tagged v0.1.0 and latest

One-off image to a different registry:

make publish REGISTRY=ghcr.io NAMESPACE=youruser TAG=v0.1.0

For Kubernetes deploy flows, see Deploying with Helm.

The Dockerfile is a two-stage build:

Stage 1 — golang:1.25-alpine (build)

• CGO_ENABLED=0, GOFLAGS=-mod=readonly — fully static binary, no on-the-fly module mutation.
• -trimpath -ldflags="-s -w" — strips build host paths and debug symbols.
• BuildKit cache mounts for /go/pkg/mod and /root/.cache/go-build speed up rebuilds without bloating the image.

Stage 2 — alpine:3.22.4 (runtime)

• Installs python3, py3-pip, ca-certificates, tini.
• Creates a non-root system user app:app with /sbin/nologin.
• yt-dlp and bgutil-ytdlp-pot-provider are installed into /opt/venv as the app user — no root-owned site-packages.
• PATH is prefixed with /opt/venv/bin so the Go binary's exec.Command("yt-dlp", ...) resolves.
• The Go binary is copied in root:root mode 0555 — executable by app, but app cannot overwrite it.
• tini is PID 1, so SIGTERM is forwarded to the server and reaped yt-dlp subprocesses don't become zombies.
• TMPDIR=/tmp is set explicitly so --read-only containers work when /tmp is a tmpfs mount.

.
├── .dockerignore     # keeps the docker build context small
├── .gitignore        # ignores ./bin and vendor/
├── Dockerfile        # multi-stage hardened build
├── Makefile          # build / run / publish / helm recipes
├── README.md
├── charts/
│   └── ytsrtgen/     # minimal Helm chart (Deployment + ClusterIP Service)
├── docs/             # swaggo-generated OpenAPI spec (docs.go, swagger.json, swagger.yaml); regenerate with `make swagger`
├── go.mod            # module zephinzer/ytsrtgen, Go 1.25.5
├── go.sum
├── main.go           # entire server (single file) + swaggo annotations
└── main_test.go      # handler tests; fakes yt-dlp via PATH (see Testing)

• github.com/gorilla/mux v1.8.1 — HTTP routing.
• github.com/swaggo/http-swagger — serves Swagger UI at /swagger.
• github.com/swaggo/swag — build-time generator for ./docs from annotations in main.go (the swag CLI is installed on demand by make swagger).
• yt-dlp — installed in the runtime image's venv.
• bgutil-ytdlp-pot-provider — yt-dlp plugin for PO Token provisioning (mitigates YouTube's bot-check throttling).

• English auto-subs only. --sub-lang en is hard-coded. Videos without English auto-captions will return no srt produced.
• Synchronous. Each request blocks until yt-dlp finishes. There is no queueing or rate limiting; put a reverse proxy in front if exposing publicly.
• No request-size limit. json.NewDecoder reads the full body. Add http.MaxBytesReader if you expect untrusted clients.
• data is passed directly to yt-dlp as a CLI argument. This is safe against shell injection (no shell is invoked — exec.Command is argv-style), but yt-dlp itself accepts many URL forms, including playlists and non-YouTube sites. Validate the URL upstream if you need to restrict that.
• Single SRT. If yt-dlp emits multiple .srt files, only the first match from filepath.Glob is returned.
• No /health endpoint. Liveness/readiness must be inferred from the listener accepting connections.