admin e5a59848f1 R-777 (held): Jellyfin and Emby no longer treat every internet visitor as the home network ...

Jellyfin: KnownProxies 172.16.0.0/12 seeded into network.xml. Emby:
LocalNetworkSubnets 10.0.0.0/8 + 192.168.0.0/16 seeded into system.xml.
Fresh volume or empty list only. Measured on 9202 through the simulated
tunnel: remote-off user 200 -> 403; LAN household still 200.

Held on night-held-2026-10-06 (night fence); not for main tonight.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-06 21:10:48 +02:00

..

actualbudget

…

adventurelog

R-758: mem_limit is the sum of the compose limits — eight figures corrected, gate mem-limit-sum (--fast, stdlib) with decoys

2026-10-05 21:49:05 +02:00

audiobookshelf

audiobookshelf: remove the client-written X-Forwarded-For chain on its router (R-753)

2026-10-01 21:02:52 +02:00

bentopdf

…

bookstack

R-127 (a): four data-encrypting keys flagged data_key (n8n, calcom, wanderer, bookstack APP_KEY) + gate data-key with decoys

2026-10-05 21:49:05 +02:00

calcom

R-127 (a): four data-encrypting keys flagged data_key (n8n, calcom, wanderer, bookstack APP_KEY) + gate data-key with decoys

2026-10-05 21:49:05 +02:00

calibre-web

calibre-web: the admin login name is generated at install (09 decision 61, R-752)

2026-10-01 13:19:02 +02:00

claper

R-758: mem_limit is the sum of the compose limits — eight figures corrected, gate mem-limit-sum (--fast, stdlib) with decoys

2026-10-05 21:49:05 +02:00

code-server

code-server: remove the client-written X-Forwarded-For chain on its router (R-753)

2026-10-01 21:03:12 +02:00

crafty-controller

…

dawarich

Dawarich: the third new app through the checklist — template, record, fixture, first ladder step 1.15.2 -> 1.15.3

2026-10-01 18:37:05 +02:00

docmost

docmost: remove the client-written X-Forwarded-For chain on its router (R-753)

2026-10-01 21:02:51 +02:00

emby

R-777 (held): Jellyfin and Emby no longer treat every internet visitor as the home network

2026-10-06 21:10:48 +02:00

ghost

ghost: remove the client-written X-Forwarded-For chain on its router (R-753)

2026-10-01 21:02:53 +02:00

gitea

…

glance

…

gokapi

gokapi: remove the client-written X-Forwarded-For chain on its router (R-753)

2026-10-01 21:03:11 +02:00

grafana

…

gramps-web

R-806: gramps-web runs 2 gunicorn workers (held — not for main tonight)

2026-10-06 21:07:59 +02:00

grimmory

R-798: grimmory sets the API-docs switch v3.5.0 reads (API_DOCS_ENABLED=false) instead of the dead SWAGGER_ENABLED

2026-10-05 21:49:05 +02:00

home-assistant

…

homebox

…

homepage

R-782: homepage allows the box's own host name (held — not for main tonight)

2026-10-06 20:52:28 +02:00

immich

…

jellyfin

R-777 (held): Jellyfin and Emby no longer treat every internet visitor as the home network

2026-10-06 21:10:48 +02:00

karakeep

R-747 + R-774: one sentence each on mealie's and Karakeep's page (hu + en)

2026-10-06 11:27:35 +02:00

kimai

R-776/R-613 proven on 9202 (with controls): comments point at the evidence; CHANGELOG

2026-10-06 08:46:42 +02:00

komga

komga: remove the client-written X-Forwarded-For chain on its router (R-753)

2026-10-01 21:03:06 +02:00

mealie

R-747 + R-774: one sentence each on mealie's and Karakeep's page (hu + en)

2026-10-06 11:27:35 +02:00

metube

Grimmory and MeTube published behind the family gate (controller >= 0.287.0, decisions 63/64), with complete records

2026-10-02 09:36:49 +02:00

n8n

R-127 (a): four data-encrypting keys flagged data_key (n8n, calcom, wanderer, bookstack APP_KEY) + gate data-key with decoys

2026-10-05 21:49:05 +02:00

navidrome

…

nextcloud

R-776/R-613 proven on 9202 (with controls): comments point at the evidence; CHANGELOG

2026-10-06 08:46:42 +02:00

onlyoffice

…

opengist

opengist: remove the client-written X-Forwarded-For chain on its router (R-753)

2026-10-01 21:03:09 +02:00

outline

R-758: mem_limit is the sum of the compose limits — eight figures corrected, gate mem-limit-sum (--fast, stdlib) with decoys

2026-10-05 21:49:05 +02:00

paperless-ngx

R-799 metube add body, R-761 logo name, R-391 no observations section (burn-down)

2026-10-05 16:55:06 +02:00

papra

burn-down round 2: R-593 papra field copy, R-760 vikunja healthcheck reason, R-594 English allow-list, R-605 refusal exit 3, R-781 onboarding decoy clone, R-806 scheme; stale runner test fixed

2026-10-05 19:15:02 +02:00

plant-it

plant-it: remove the client-written X-Forwarded-For chain on its router (R-753)

2026-10-01 21:03:04 +02:00

plex

…

privatebin

…

radarr

…

radicale

Radicale: the first new app through the checklist — template, record, fixture, first ladder step 3.8.0 -> 3.8.1

2026-10-01 16:58:56 +02:00

rallly

rallly: remove the client-written X-Forwarded-For chain on its router (R-753)

2026-10-01 21:03:05 +02:00

recipe-importer

…

romm

romm: remove the client-written X-Forwarded-For chain on its router (R-753)

2026-10-01 21:02:57 +02:00

seerr

seerr: remove the client-written X-Forwarded-For chain on its router (R-753)

2026-10-01 21:03:13 +02:00

sonarr

…

sparkyfitness

sparkyfitness: remove the client-written X-Forwarded-For chain on its router (R-753)

2026-10-01 21:02:56 +02:00

tandoor

…

termix

…

uptime-kuma

uptime-kuma: remove the client-written X-Forwarded-For chain on its router (R-753)

2026-10-01 21:03:15 +02:00

vaultwarden

vaultwarden 1.36.0 -> 1.37.4: its first ladder step, proven on the bench and on 9202 (R-890); instruction files kept true (decision 150)

2026-10-06 13:50:39 +02:00

vikunja

R-776/R-613 proven on 9202 (with controls): comments point at the evidence; CHANGELOG

2026-10-06 08:46:42 +02:00

wanderer

R-127 (a): four data-encrypting keys flagged data_key (n8n, calcom, wanderer, bookstack APP_KEY) + gate data-key with decoys

2026-10-05 21:49:05 +02:00

wger

wger: DJANGO_DEBUG=False + a wger-files nginx serving /static and /media (R-762); a definition step proven on the bench and on 9202, written by --write-ladder --to-definition

2026-10-06 15:39:34 +02:00

wishlist

R-612: wishlist's healthcheck reads the first-boot seed (held — not for main tonight)

2026-10-06 20:47:54 +02:00

zipline

R-776/R-613 proven on 9202 (with controls): comments point at the evidence; CHANGELOG

2026-10-06 08:46:42 +02:00