Users unable to upload videos when using different PDS hostname

[Tophhie]

We've ran into an issue where our users are unable to upload videos to Bluesky when they log in with a PDS hostname that is different to the did:web: identifier.

For example, our did:web identifier is "did:web:pds.tophhie.cloud", the PDS was initially branded with the domain "pds.tophhie.cloud" but transitioned over to using the domain "tophhie.social". We did not update the did:web or PLC documents for our users.

Now, when they log into Bluesky using the custom server "tophhie.social", they're greeted with the above error message when trying to upload videos.

It would seem like the AppView has hardcoded the did:web audience string from the input server, instead of querying it from the describeServer atproto API?

[axfelix]

Oh no, a did:web edge case!

Will investigate, thanks for reporting.

[Tophhie]

Cheers, @axfelix! I've found, as a temporary workaround, users can log out, then log back in but change the custom server to "pds.tophhie.cloud" to successfully upload videos. Error only occurs if they use our branded hostname "tophhie.social" when logging in.

[axfelix]

It would appear that https://pds.tophhie.social/.well-known/did.json is unavailable -- I wonder if isolating that has any clues for us?

[Tophhie]

'pds.tophhie.social' doesn't exist in our environment.

There's the original

• pds.tophhie.cloud

And the new endpoint

• tophhie.social

Is there supposed to be a response for /.well-known/did.json at the root of the server? I thought that just returned for actual users?

[Tophhie]

Just tested with another PDS, the /.well-known/did.json doesn't return for their server either... so not sure it's that?

https://selfhosted.social/.well-known/did.json

[DavidBuchanan314]

Looks like the issue is here: https://github.com/bluesky-social/social-app/blob/2200cc95d841c4de3adf30cebb7508745fdfafec/src/lib/media/video/upload.shared.ts#L21 - getServiceAuthAudFromUrl assumes the service did is did:web:${hostname}

It should perhaps call describeServer instead (but perhaps the Agent should already know the service DID)

[Tophhie]

That feels like the problem! Tbf, when you do query "describeServer" on either pds.tophhie.cloud or tophhie.social, it always returns the same did:web.

https://tophhie.social/xrpc/com.atproto.server.describeServer

{"did":"did:web:pds.tophhie.cloud","availableUserDomains":[".tophhie.social"],"inviteCodeRequired":false,"links":{"privacyPolicy":"https://blog.tophhie.cloud/atproto-privacy-policy/","termsOfService":"https://blog.tophhie.cloud/atproto-tos/"},"contact":{"email":"help@tophhie.cloud"}}

Seems the Bluesky app clients are making assumptions?

Appreciate this is niche...

[Tophhie]

Done some more digging this evening...

Investigation shows that the PLC document can be updated manually to point the AtprotoPersonalDataServer endpoint to "https://tophhie.social". This then allows the user to log into Bluesky with the custom server "tophhie.social" and the error no longer appears when attaching a video.

Tool used to update PLC document: https://boat.kelinci.net/plc-applicator

Test account used: https://plc.directory/did:plc:luqol4lhvqrasrfm6vpgx47z

However, there appears to be a "video processing error" on the Bluesky Video CDN after performing this change. Possible knock-on effect to updating the PLC document?

[m00dawg]

I'm having a similar issue with attaching images or video to a post. Existing videos and images work, but for the past few weeks I cannot make posts with attachments (though I can make normal posts). The media ends up on my PDS in the pds/blocks/tempt. The post never gets created however and the assets never get moved into pds/blocks/did...

The $hostname call out had me thinking that maybe something changed recently on the BlueSky side or some such? The local hostnames of all my PDSs do not match the external hostnames as these are run using StatefulSets in K8s (specifically K3s in my case). I'm looking into how to set a pod's hostname though that seems to be somewhat frowned up with StatefulSets. Is there a way I can inject this into the PDS itself other than by using PDS_HOSTNAME in the pds.env file?

EDIT: Nevermind, after discussing it further on the ATProto Touchers discord, it sounds like it doesn't relate.