Update: It's not only YT thumbnails which aren't shown. This is your post about the free 24 slot bag as shown on lemmy.wtf (without thumbnail), lemmy.world (without thumbnail) and feddit.de (with thumbnail):
I've been trying to troubleshoot it. It makes very little sense to me, that it doesn't show thumbnails from local posts on lemmy.wtf, but if you can via another instance, the thumbnails show up.
That's really weird. I already went through the issue tracker on GitHub for both the lemmy backend as well as the frontend, but couldn't find anything. I also checked the documentation whether there is a configuration option somewhere. Nothing.
My guess is that the thumbnail is extracted (read from the opengraph tag available via the posted URL) in the frontend (and not the backend). (wrong guess)
The only thing I could find on the issue tracker which might be related is this:
I have no idea why it is happening. The only thing I can think of is Cloudflare tunnel, but why would that keep the thumbnails from loading? I send a message to the admin of Lemmy.world.
edit: I am also trying to troubleshoot why users from kbin.social can't subscribe to here and vice versa.
I was able to subscribe from lemmy.world to kbin.social (yesterday or the day before). I tried it on another account from feddit.de today and it did not work. My guess is a problem at kbin.social.
The difference between the two communities at lemmy.world, is that c/selfhosted has been around for a long time and c/xcode was created just a few days ago. It seems that only communities that initially connected with kbin.social work, but not new communities.
I see you have been discussing this with the people & mod of the GW2 magazine on kbin.social already. To me it really seems to be an issue on their side. As I mentioned above: I currently cannot subscribe from feddit.de to their GW2 magazine, either.
Update: I was now able to subscribe to their GW2 magazine from feddit.de, but it does not display any posts.
There is an environment variable LEMMY_UI_DISABLE_CSP (default : false) to configure lemmy-ui. Do you set this on your instance or do you set a Content-Security-Policxy Header somewhere in your webserver/nginx config?
OK. Looks like the CSP headers are the same on working and not working instances.
What I found surprising is that chrome loads the thumbnail without accessing the actual YT URL (contrary to what I expected) from the "pictrs" server of the instance serving the post. Which means that the thumbnail gets only extracted once and is then stored along with the post.
It's not only YT thumbnails which aren't shown. This is your post about the free 24 slot bag as shown on lemmy.wtf (no thumbnail), lemmy.world (no thumbnail) and feddit.de (with thumbnail):