Add <track> to <video> if there's a .vtt file

[jonatron]

We now have .vtt files, from SReview and Whisper, so we can now add captions.

[jonatron]

I have to guess because I don't have the pretalx db, only the sample. It'd be something like this: https://github.com/jonatron/website/compare/master...jonatron:website:video_track_captions?expand=1

[johanvdw]

Thanks for your contribution!

I'll do a check with the actual data from pretalx.

[jonatron]

Just checked adding a track in devtools, I get:
Security Error: Content at https://fosdem.org/2025/schedule/event/fosdem-2025-5370-using-dpop-to-use-access-tokens-securely-in-your-single-page-applications/ may not load data from https://video.fosdem.org/2025/aw1120/fosdem-2025-4526-discovering-indoor-environments-and-positioning-systems.vtt .
So it needs a CORS or CSP header change too.

[johanvdw]

You should probably only add vtt if it exists.

[jonatron]

I updated the above branch to only add a track if a vtt exists. I also added crossorigin="anonymous", but it'll need Access-Control-Allow-Origin: https://fosdem.org added to video.fosdem.org .vtt file response headers, hopefully someone can sort that out?

[jonatron]

@gerryd do you know if it's possible to add that CORS header?

[johanvdw]

Can you make a PR? I was looking for this for a while but didn't find it because it was an issue and not a PR.
We can add the header to video.fosdem.org

[johanvdw]

I actually started doubting my own statement: because we use mirrors, we may not control the cors stuff. But anyway, we can try.

[jonatron]

It might be OK, it looks like currently video files send a location header to a mirror, but the vtt file is served direct.

[johanvdw]

#279 (comment) for a larger export file if you want to test on a larger scale.

[jonatron]

Seems to work with that export, thanks.

[jonatron]

It looks like crossorigin="anonymous" made the CORS header required on the video file. I thought it'd only affect the track. Assuming you can't add the header to videos because there's mirrors, I think the only way to make it work would to have the .vtt file on the fosdem.org domain, and remove crossorigin="anonymous" .

[johanvdw]

Yes, I reverted your patch as you saw.

I don't really understand why the CORS would block vtt and not the videos themselves.
What would happen if we just remove the crossorigin part?

I can push to our staging environment if we want to test that.

[jonatron]

It's annoying but without crossorigin=anonymous, the track .vtt is blocked but the video isn't, checked using devtools:

To proxy the .vtt so it's on the same domain, the nginx conf could look something like:

    location ~* ^/vtt/(.+\.vtt)$ {
        proxy_pass https://video.fosdem.org/$1;
        resolver 8.8.8.8;
    }

Not sure if it's worth it or not, it's only a nice to have, and google chrome has live captions built in to the browser.