doc: Revise instance rules for compliance and stability (#686)

* doc: Revise instance rules for compliance and stability

Updated rules for instances to include new requirements on playback stability and IP rotation due to YouTube blocking more aggressively public instances.

* docs: Clarify HTTPS requirement for instances

Author: unixfox

docs/instances.md

@@ -24,14 +24,16 @@
 
 ## Rules to have your instance in this list:
 
+Instance operators SHOULD [contact the Invidious maintainers](https://invidious.io/contact/) for guidance only if they are unsure how to comply with a specific rule or set of rules, such as questions about rotating proxies, anti-bot measures, monitoring, or Invidious configuration.
+
 1. Instances MUST have been up for at least a month before it can be added to this list.
 2. Instances MUST not be more than a month out of date compared with either the latest commit or latest release. Any instance that is more than a month out of date is considered unmaintained and will be removed from the list.
 3. Instances MUST have statistics (`/api/v1/stats`) enabled (`statistics_enabled: true` in the configuration file).
 4. Instances MUST have an uptime of at least 90% ([according to uptime.invidious.io](https://uptime.invidious.io/)).
-5. Instances MUST be served via domain name.
-6. Instances MUST be served via HTTPS (or/and onion).
-7. Instances using any DDoS Protection / MITM MUST be marked as such (e.g. Cloudflare, DDoS-Guard).
-8. Instances using any type of anti-bot protection MUST be marked as such.
+5. Instances MUST demonstrate good playback stability, as evaluated manually by the Invidious maintainers.
+6. Instances MUST be served via domain name.
+7. Instances MUST be served via HTTPS on the clearnet (internet).
+8. Instances using any DDoS Protection / MITM MUST be marked as such (e.g. Cloudflare, DDoS-Guard).
 9. Instances MUST NOT use any type of analytics, including external scripts of any kind.
 10. Any system whose goal is to modify the content served to the user (i.e web server HTML rewrite) is considered the same as modifying the source code.
 11. Instances running a modified source code:
@@ -40,5 +42,8 @@
     - MUST contain a link to both the modified and original source code of Invidious in the footer.
 12. Instances MUST NOT serve ads (sponsorship links in the banner are considered ads) NOR promote products.
 13. Instances MUST NOT restrict or disallow the access / usage to any [natural person](https://en.wikipedia.org/wiki/Natural_person) (e.g. a country's IP range MUST NOT be blocked, access by a natural person MUST NOT be disallowed for arbitrary reason) - this rule doesn't apply to [juridical persons](https://en.wikipedia.org/wiki/Juridical_person).
+14. Public instances MUST deploy effective measures to limit automated or abusive traffic (e.g., anti-bot systems, rate limiting, challenge-based access controls). These measures are required to preserve playback stability, performance, and service availability for legitimate users.
+15. Public instances MUST use a system that rotates the IP addresses used for communication with YouTube’s servers (for example, rotating proxy infrastructure). Static or single-IP setups are not considered sufficient for a public instance.
+16. Public instances MUST provide users with an experience that is as close as reasonably possible to the default (“vanilla”) feature set of the Invidious software. Deliberately disabling, degrading, or restricting core features (including but not limited to video quality options) is not permitted for public instances. Exceptions may be granted only at the maintainers’ discretion, and approval must be explicit.
 
 **NOTE:** We reserve the right to decline any instance from being added to the list, and to remove / ban any instance breaking the aforementioned rules.