felhom.eu/documentation/audits/website-refresh-2026-10-08/shots/README.md

# Website refresh 2026-10-08: logos and screenshots for five catalog apps

Five apps get logos and screenshots here: Docmost, Homebox, Mealie, Recipe Importer and SparkyFitness. The work used the
same method as felhom.eu `8e31b450` and `344081f0`, and ran on 2026-10-08 between 05:55 and 06:28 UTC.

## Method

- **Where the work ran.** Scratch guest 9202 on demo-hp, reached only by `ssh hp` + `pct exec 9202 -- bash -s`. Scripts went in
  on stdin, so nothing was written on the demo-hp host. Guest 9201 and the other machines were not touched.
- **Install and removal.** Each app was installed through the product (`POST /api/stacks/<app>/deploy` from `tools/wr.py`
  deploy, which uses the catalog's `box_walk.deploy`) and removed through the product (stop, then `POST /api/stacks/<app>/remove`
  with `remove_hdd_data` and `remove_backups` set to true). The work handled one app at a time: install, seed, screenshot,
  copy the raw PNGs off the box, remove, verify. `<app>/run.log` holds each removal and its VERIFY block. `baseline-9202.txt`
  and `teardown-9202.txt` hold the box state before and after.
- **Screenshots.** Headless Chrome ran inside 9202: `ghcr.io/puppeteer/puppeteer:latest`, digest `sha256:60ad89b1…`. This
  image was already on the box and was left in place. Chrome ran on network `traefik-public` with
  `--host-resolver-rules=MAP * 172.18.0.5` (traefik) and `--ignore-certificate-errors`, so it reached each app under its real
  name `<sub>.enkisfelhom.hu`. The dashboard session cookie let Chrome through the setup gate, the same way a household
  passes it.
- **Shot sizes.** Desktop shots are 1280x800. Phone shots are 390x844 at 2x. `tools/towebp.py` converted the PNGs to WebP
  (Pillow, quality 80, method 6).
- **Demo content.** All content is invented: "Demo Család" / demo@example.com, made-up items, recipes and pages. No third-party
  site was contacted for content.
- **Secrets.** No secret is in this directory. The dashboard session and the demo password went into the guest only as a
  0600 `secrets.json`, and `shred -u` removed it as soon as Chrome exited. Chrome output passed through a filter that
  redacted long values.

## Per app

### Docmost (`docmost/docmost:0.96.0`)
- **Logo.** `docmost-logo.png` is `/app/apps/client/dist/icons/app-icon-512x512.png` from the image, copied byte for byte.
  The project ships no SVG logo: the image holds only `vite.svg`, the Vite placeholder, and the GitHub tree of tag v0.96.0
  has no other SVG. Licence: AGPL-3.0 (GitHub `LICENSE`).
- **Setup.** Docmost's own first-run setup (`POST /api/auth/setup`) created the workspace "Demo Család". Five invented
  Hungarian pages were added through its own Markdown import (`/api/pages/import`).
- **Interface language.** Docmost 0.96 ships no Hungarian locale, so the interface is in English.
- **Shots.**
  1. Home: "Spaces you belong to" and the recently updated pages.
  2. The page "Házirend": headings, a list and a table, with the page tree on the left.
  3. Phone: the same page.

### Homebox (`ghcr.io/sysadminsmedia/homebox:0.26.2`)
- **Logo.** `homebox-logo.svg` is `/favicon.svg`, served by the app's own binary (embedded `static/public/favicon.svg`),
  copied byte for byte. Licence: AGPL-3.0 (GitHub).
- **Seed.** Done through Homebox's own API (`/api/v1/entities`, `/api/v1/tags`). The seed added four locations, three tags
  and eight items with prices in HUF. Homebox's empty English default locations and tags were deleted.
- **Interface language.** Hungarian, set with Homebox's own language preference.
- **Shots.**
  1. Home: totals, recently added items and locations.
  2. The item "Fűnyíró".
  3. Phone: home.

### Mealie (`ghcr.io/mealie-recipes/mealie:v3.28.0`)
- **Logo.** `mealie-logo.svg` comes from `/opt/mealie/lib/python3.14/site-packages/mealie/frontend/icons/safari-pinned-tab.svg`
  in the image. Mealie's colour icons are PNG only, so the SVG was edited in two ways:
  - The single fill colour was changed from `#000000` to `#E58325`. That orange was sampled from the image's own
    `frontend/icon.png`.
  - The DOCTYPE and the fixed `width`/`height` were removed. The `viewBox` was kept.

  Licence: AGPL-3.0-only (wheel METADATA in the image; GitHub agrees).
- **Seed.** The first account (changeme@example.com) signed in with the password this install generated, through
  `/api/auth/token`. It added six invented Hungarian recipes and a six-day dinner plan through Mealie's own API, and set
  the display name to "Demo Család".
- **Interface language.** Hungarian (the cookie that Mealie's own language switch writes). The first-login wizard was
  skipped with Mealie's own "I'm already set up" button.
- **Shots.**
  1. The recipe "Rakott krumpli".
  2. The meal planner for the week.
  3. Phone: the recipe.

### Recipe Importer (`gitea.dooplex.hu/admin/recipe-importer:v0.9.11`, the operator's own project)
- **Logo.** `recipe-importer-logo.svg` is `/app/app/assets/logo_favicon_2.svg` from the image, copied byte for byte. This
  is the file the app serves as its favicon. The image also holds `/app/app/assets/logo.svg`, which is the same mark plus
  the word "felhom.eu".
- **Note: this logo is the Felhom cloud mark, not a separate app logo.** The project has no logo of its own.
- **Licence.** No LICENSE file: `gitea.dooplex.hu/admin/recipe-importer/raw/branch/main/LICENSE` returns 404, and the repo
  API lists no licence.
- **Setup.** No recipe site was contacted. The app's own settings form was saved with an invented Mealie address
  (`https://recipes.example.hu`) and a placeholder key, because the import page opens only after that save. No Mealie
  existed behind the address.
- **Shots.**
  1. Single import, with an invented example.com address typed in.
  2. Bulk import, with four invented addresses.
  3. Settings after the save.

  The phone layout overflows sideways (the app's own CSS), so no phone shot was used: `raw/unused-phone-import.png`.

### SparkyFitness (`codewithcj/sparkyfitness:v0.17.3` + `_server:v0.17.3`)
- **Logo.** `sparkyfitness-logo.png` is `/usr/share/nginx/html/images/icons/icon-512x512.png` from the frontend image,
  copied byte for byte. It is 384x512 and 129 KB, larger than the other PNG logos (the largest is 31 KB). The project ships
  no SVG logo: its GitHub tree has only feature icons.
- **Licence: NOT open source.** `LICENSE` at tag v0.17.3 is a custom licence: "use, copy, modify, and distribute the
  Software for **non-commercial purposes only**". This affects a paid service that offers the app, and the operator should
  read it. It was not judged here.
- **Seed.** An invented account was made through its own sign-up (`/api/auth/sign-up/email`), which is open while the
  setup gate is up. Six invented foods and today's diary went in through `/api/foods` and `/api/food-entries`. Fourteen
  days of invented weight and waist check-ins went in through `/api/measurements/check-in`. Five glasses of water went in
  with the diary's own "+" button.
- **Interface language.** Set to Hungarian in the account preferences. The app's own translation is partial, so some
  labels stay in English.
- **Dismissed screens.**
  - The "new version available (v1.8.0)" notice was dismissed by setting the app's own `dismissedReleaseVersion` key.
    The notice points to the GitHub release; where the app fetches it from was not checked. Its first appearance is in `raw/unused-first-load-version-notice.png`.
  - The onboarding wizard was closed with its own "Skip".
- **Shots.**
  1. The diary: energy goal, nutrition summary and water.
  2. Reports > Measurements: the 14-day weight and waist trend.
  3. Phone: the diary.

## Tools
- `tools/wr.py`: install, shoot, fetch, remove and verify.
- `tools/sw.py`: the `box_walk` shim that runs scripts through `pct exec` stdin.
- `tools/<app>.js`: one Chrome script per app.
- `tools/mealie-probe.js`: a read-only probe.
- `tools/towebp.py`: the PNG to WebP converter.
- `tools/env.sh`: the two path variables.