URL Shortening via YOURLS

[SelfSufficient08]

Describe the problem/question

I must be doing something wrong. I have the below configured but when I click the shorten URL, it doesnt create the shortlink. The end result is that it acts like it succeeds and gives me the address of https://www.opera.com
Any suggestions are welcome.

; (optional) URL shortener address to offer after a new paste is created.
; It is suggested to only use this with self-hosted shorteners as this will leak
; the pastes encryption key.
urlshortener = "https://paste.jpdesigned.com/shortenviayourls?link="

; (optional) the "signature" (access key) issued by YOURLS for the using account
signature = "XXXXXXXXX"
; (optional) the URL of the YOURLS API, called to shorten a PrivateBin URL
apiurl = "https://link.jpdesigned.com/yourls-api.php"

Did you use the FAQ section?

• Yes, I have read the FAQ and I found no solution/answer there.

What you did?

Tried a variety of urls.

What happens

It acts like it worked but it didnt.

What should happen

No response

Additional information

No response

Server address

No response

Server OS

No response

Webserver

No response

PrivateBin version

No response

Browser and version

No response

Local operating system and version

No response

Issue reproducibility

No, I cannot reproduce it on https://privatebin.net.

[elrido]

Have a look at #1002 where similar issues were discussed. It seems that some got it to work, while others not. It requires configuration of both services and frontend webserver for this to work (i.e. the privatebin server must be able to resolve and reach the yourls instance).

[SelfSufficient08]

Thanks for the response and the reference. I have tried a ton without much luck. I am hopeful someone shares a docker-compose file that includes both services and maybe a config that could shed some light on what I am doing wrong. I do think it has to do with connectivity of some sort but I have tried adding host records to my local dns so that the API calls stay in network and that still won't work. I also tried eliminating domains and entered the hostnames of the containers in hopes for a different result but it wasn't fruitful. Regardless, it's a great solution as is. Someday someone will figure it out.
For transparency, I run mine in a compose file with both services. Then I have a separate machine running Nginx Proxy Manager that handles routing from the outside. I also run pihole with local DNS entries for both privatebin and yourls. I have tried using treafik in a similar way but still no luck. Ignore the fact that I have ports exposed along with traefik. I did this for testing every possible way of communicating. :-) In nginx proxy manager, its setup pretty basic, just domain, port and cert. I do check the box to block common exploits.

version: '3.1'

services:

  yourls:
    image: yourls
    hostname: yourls
    container_name: yourls
    restart: always
    links:
      - db
    depends_on:
      - db
    networks:
      - proxy
      - yourls
    ports:
      - 9070:80
    environment:
      YOURLS_SITE: https://link.test.com
      YOURLS_USER: XXXXXXXXXXXXXXX
      YOURLS_PASS: XXXXXXXXXXXXXXXXXXXXXXXX
      YOURLS_DB_HOST: db
      YOURLS_DB_USER: yourls
      YOURLS_DB_PASS: XXXXXXXXXXXXXXXXXXXXXXXX
    volumes:
      - ./plugins:/var/www/html/user/plugins
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.link.entrypoints=http"
      - "traefik.http.routers.link.rule=Host(`link.test.com`)"
      - "traefik.http.middlewares.link-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.link.middlewares=link-https-redirect"
      - "traefik.http.routers.link-secure.entrypoints=https"
      - "traefik.http.routers.link-secure.rule=Host(`link.test.com`)"
      - "traefik.http.routers.link-secure.tls=true"
      - "traefik.http.routers.link-secure.service=link"
      - "traefik.http.services.link.loadbalancer.server.port=80"
      - "traefik.docker.network=proxy"

  db:
    image: mysql
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: XXXXXXXXXXXXXXXXXXXXXXXX
      MYSQL_DATABASE: yourls
      MYSQL_USER: yourls
      MYSQL_PASSWORD: XXXXXXXXXXXXXXXXXXXXXXXX
    volumes:
      - ./db_data:/var/lib/mysql     
    networks:
      - yourls



  privatebin:
    hostname: privatebin
    container_name: privatebin
    image: privatebin/nginx-fpm-alpine:1.3.5
    read_only: true # not in compose 3.0 documentation but appears supported
    ports:
      - 5252:8080
    volumes:
      - ./data:/srv/data # data volume for pastes to persist after container stop or restart
      - ./config/conf.php:/srv/cfg/conf.php:ro # second volume for custom configuration file
    restart: always
    networks:
      - proxy
      - yourls
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.paste.entrypoints=http"
      - "traefik.http.routers.paste.rule=Host(`paste.test.com`)"
      - "traefik.http.middlewares.paste-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.paste.middlewares=paste-https-redirect"
      - "traefik.http.routers.paste-secure.entrypoints=https"
      - "traefik.http.routers.paste-secure.rule=Host(`paste.test.com`)"
      - "traefik.http.routers.paste-secure.tls=true"
      - "traefik.http.routers.paste-secure.service=paste"
      - "traefik.http.services.paste.loadbalancer.server.port=8080"
      - "traefik.docker.network=proxy"


networks:
  proxy:
    external: true
  yourls:

Config File:

;<?php http_response_code(403); /*
; config file for PrivateBin
;
; An explanation of each setting can be find online at https://github.com/PrivateBin/PrivateBin/wiki/Configuration.

[main]
; (optional) set a project name to be displayed on the website
 name = " "

; The full URL, with the domain name and directories that point to the
; PrivateBin files, including an ending slash (/). This URL is essential to
; allow Opengraph images to be displayed on social networks.
 basepath = "https://paste.test.com/"

; enable or disable the discussion feature, defaults to true
discussion = true

; preselect the discussion feature, defaults to false
opendiscussion = false

; enable or disable the password feature, defaults to true
password = true

; enable or disable the file upload feature, defaults to false
fileupload = true

; preselect the burn-after-reading feature, defaults to false
burnafterreadingselected = false

; which display mode to preselect by default, defaults to "plaintext"
; make sure the value exists in [formatter_options]
defaultformatter = "plaintext"

; (optional) set a syntax highlighting theme, as found in css/prettify/
; syntaxhighlightingtheme = "sons-of-obsidian"

; size limit per paste or comment in bytes, defaults to 10 Mebibytes

sizelimit = 10485760

; template to include, default is "bootstrap" (tpl/bootstrap.php)
template = "bootstrap-dark-page"

; (optional) info text to display
; use single, instead of double quotes for HTML attributes
; info = " "

; (optional) notice to display
; notice = "Note: This is a test service: Data may be deleted anytime. Kittens will die if you abuse this service."

; by default PrivateBin will guess the visitors language based on the browsers
; settings. Optionally you can enable the language selection menu, which uses
; a session cookie to store the choice until the browser is closed.
languageselection = false

; set the language your installs defaults to, defaults to English
; if this is set and language selection is disabled, this will be the only language
; languagedefault = "en"

; (optional) URL shortener address to offer after a new paste is created.
; It is suggested to only use this with self-hosted shorteners as this will leak
; the pastes encryption key.
 urlshortener = "https://paste.test.com/shortenviayourls?link="

; (optional) Let users create a QR code for sharing the paste URL with one click.
; It works both when a new paste is created and when you view a paste.
; qrcode = true

; (optional) Let users send an email sharing the paste URL with one click.
; It works both when a new paste is created and when you view a paste.
; email = true

; (optional) IP based icons are a weak mechanism to detect if a comment was from
; a different user when the same username was used in a comment. It might get
; used to get the IP of a comment poster if the server salt is leaked and a
; SHA512 HMAC rainbow table is generated for all (relevant) IPs.
; Can be set to one these values:
; "none" / "identicon" (default) / "jdenticon" / "vizhash".
; icon = "none"

; Content Security Policy headers allow a website to restrict what sources are
; allowed to be accessed in its context. You need to change this if you added
; custom scripts from third-party domains to your templates, e.g. tracking
; scripts or run your site behind certain DDoS-protection services.
; Check the documentation at https://content-security-policy.com/
; Notes:
; - If you use a bootstrap theme, you can remove the allow-popups from the
;   sandbox restrictions.
; - By default this disallows to load images from third-party servers, e.g. when
;   they are embedded in pastes. If you wish to allow that, you can adjust the
;   policy here. See https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-not-it-load-embedded-images
;   for details.
; - The 'unsafe-eval' is used in two cases; to check if the browser supports
;   async functions and display an error if not and for Chrome to enable
;   webassembly support (used for zlib compression). You can remove it if Chrome
;   doesn't need to be supported and old browsers don't need to be warned.
; cspheader = "default-src 'none'; base-uri 'self'; form-action 'none'; manifest-src 'self'; connect-src * blob:; script-src 'self' 'unsafe-eval'; style-src 'self'; font-src 'self'; frame-ancestors 'none'; img-src 'self' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals allow-downloads"

; stay compatible with PrivateBin Alpha 0.19, less secure
; if enabled will use base64.js version 1.7 instead of 2.1.9 and sha1 instead of
; sha256 in HMAC for the deletion token
; zerobincompatibility = false

; Enable or disable the warning message when the site is served over an insecure
; connection (insecure HTTP instead of HTTPS), defaults to true.
; Secure transport methods like Tor and I2P domains are automatically whitelisted.
; It is **strongly discouraged** to disable this.
; See https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-it-show-me-an-error-about-an-insecure-connection for more information.
; httpwarning = true

; Pick compression algorithm or disable it. Only applies to pastes/comments
; created after changing the setting.
; Can be set to one these values: "none" / "zlib" (default).
; compression = "zlib"

[expire]
; expire value that is selected per default
; make sure the value exists in [expire_options]
default = "1week"

[expire_options]
; Set each one of these to the number of seconds in the expiration period,
; or 0 if it should never expire
5min = 300
10min = 600
1hour = 3600
1day = 86400
1week = 604800
; Well this is not *exactly* one month, it's 30 days:
1month = 2592000
1year = 31536000
never = 0

[formatter_options]
; Set available formatters, their order and their labels
plaintext = "Plain Text"
syntaxhighlighting = "Source Code"
markdown = "Markdown"

[traffic]
; time limit between calls from the same IP address in seconds
; Set this to 0 to disable rate limiting.
limit = 10

; (optional) Set IPs addresses (v4 or v6) or subnets (CIDR) which are exempted
; from the rate-limit. Invalid IPs will be ignored. If multiple values are to
; be exempted, the list needs to be comma separated. Leave unset to disable
; exemptions.
; exempted = "1.2.3.4,10.10.10/24"

; (optional) If you want only some source IP addresses (v4 or v6) or subnets
; (CIDR) to be allowed to create pastes, set these here. Invalid IPs will be
; ignored. If multiple values are to be exempted, the list needs to be comma
; separated. Leave unset to allow anyone to create pastes.
; creators = "1.2.3.4,10.10.10/24"

; (optional) if your website runs behind a reverse proxy or load balancer,
; set the HTTP header containing the visitors IP address, i.e. X_FORWARDED_FOR
; header = "X_FORWARDED_FOR"

[purge]
; minimum time limit between two purgings of expired pastes, it is only
; triggered when pastes are created
; Set this to 0 to run a purge every time a paste is created.
limit = 300

; maximum amount of expired pastes to delete in one purge
; Set this to 0 to disable purging. Set it higher, if you are running a large
; site
batchsize = 10

[model]
; name of data model class to load and directory for storage
; the default model "Filesystem" stores everything in the filesystem
class = Filesystem
[model_options]
dir = PATH "data"

;[model]
; example of a Google Cloud Storage configuration
;class = GoogleCloudStorage
;[model_options]
;bucket = "my-private-bin"
;prefix = "pastes"
;uniformacl = false

;[model]
; example of DB configuration for MySQL
;class = Database
;[model_options]
;dsn = "mysql:host=localhost;dbname=privatebin;charset=UTF8"
;tbl = "privatebin_"	; table prefix
;usr = "privatebin"
;pwd = "Domelike-Pajamas-Smother6"
;opt[12] = true	  ; PDO::ATTR_PERSISTENT

;[model]
; example of DB configuration for SQLite
;class = Database
;[model_options]
;dsn = "sqlite:" PATH "data/db.sq3"
;usr = null
;pwd = null
;opt[12] = true	; PDO::ATTR_PERSISTENT

;[model]
; example of DB configuration for PostgreSQL
;class = Database
;[model_options]
;dsn = "pgsql:host=localhost;dbname=privatebin"
;tbl = "privatebin_"     ; table prefix
;usr = "privatebin"
;pwd = "Domelike-Pajamas-Smother6"
;opt[12] = true    ; PDO::ATTR_PERSISTENT

;[model]
; example of S3 configuration for Rados gateway / CEPH
;class = S3Storage
;[model_options]
;region = ""
;version = "2006-03-01"
;endpoint = "https://s3.my-ceph.invalid"
;use_path_style_endpoint = true
;bucket = "my-bucket"
;accesskey = "my-rados-user"
;secretkey = "my-rados-pass"

;[model]
; example of S3 configuration for AWS
;class = S3Storage
;[model_options]
;region = "eu-central-1"
;version = "latest"
;bucket = "my-bucket"
;accesskey = "access key id"
;secretkey = "secret access key"

;[model]
; example of S3 configuration for AWS using its SDK default credential provider chain
; if relying on environment variables, the AWS SDK will look for the following:
; - AWS_ACCESS_KEY_ID
; - AWS_SECRET_ACCESS_KEY
; - AWS_SESSION_TOKEN (if needed)
; for more details, see https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials.html#default-credential-chain 
;class = S3Storage
;[model_options]
;region = "eu-central-1"
;version = "latest"
;bucket = "my-bucket"

[yourls]
; When using YOURLS as a "urlshortener" config item:
; - By default, "urlshortener" will point to the YOURLS API URL, with or without
;   credentials, and will be visible in public on the PrivateBin web page.
;   Only use this if you allow short URL creation without credentials.
; - Alternatively, using the parameters in this section ("signature" and
;   "apiurl"), "urlshortener" needs to point to the base URL of your PrivateBin
;   instance with "shortenviayourls?link=" appended. For example:
;   urlshortener = "${basepath}shortenviayourls?link="
;   This URL will in turn call YOURLS on the server side, using the URL from
;   "apiurl" and the "access signature" from the "signature" parameters below.

; (optional) the "signature" (access key) issued by YOURLS for the using account
 signature = "XXXXXXXXXXXXXXXXXXXXXXXXX"
; (optional) the URL of the YOURLS API, called to shorten a PrivateBin URL
 apiurl = "https://link.test.com/yourls-api.php"

Edit: by moderator for readability of the configs

[elrido]

I'm not sure, but I would expect the port mapping from 9070 to 80 to only occur at the network boundaries or even only at the egress, so maybe the Yourls instance on the "yourls" network would be reachable at "http://yourls:9070/..." from privatebins point of view? This only matters when using the yourls proxy (apiurl in the [yourls] section) - if not using the proxy, the public URL would get specified in the urlshortener parameter (which has a leading space, not sure if PHP tolerates this).

[haywardgg]

I use this, give it a try: https://github.com/ajsap/privatebin-yourls