admin
e6d1ebd152
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
New apps through the checklist (2026-10-01, evening)
Brief: wger hidden until fixed; the fit check (checklist group 0) for nine apps; then build in order — Radicale, Karakeep,
Dawarich, Grimmory, Grimoire, MeTube, Pinchflat; Invidious and moonlight-web fit check only.
Architecture read: 09-update-architecture.md §3 decisions 13, 22, 42, 45–50, 57, 61 and §6.5; 01-topology-and-trust.md
(HTTP-only tunnel, §5 the setup gate); 07-backup-architecture.md (classes). Baselines: catalog dc0ab8b (54 dirs incl.
none new), felhom.eu 2d69c61, register 399 rows / highest R-764; controller on 9202 0.285.0.
Venues
- Bench — LXC 9401 on demo-hp, swap 0, created this session (
P0/bench-create.txt; a first attempt picked the arm64 template and was destroyed at once).upgrade-test.py --moveper app, a from-birth cgroup sampler beside it. - Box — scratch guest 9202 on the DRILL catalog only (
B/B0-repoint-drill.txt; saved configcontroller.yaml.pre-newapps1001). Per app: install with a stranger's poll and the sampler, the app's checks, the guarded Update step (boxstep.py), remove keeping backups + restore (restorecase.py), remove with data. - Ladder — the single writer
upgrade-test.py --write-ladderfrom both verdicts.
Per app
| app | result | catalog commit | memory (peak anon / limit) | ladder step | notes |
|---|---|---|---|---|---|
| Radicale | published | 195129c |
26 MiB / 128M (bench, swap 0) | 3.8.0 → 3.8.1 | first template lost the login on a restore → fixed (R-765) |
| Karakeep | published | 882ac14 |
web 832 MiB / 1536M under a 10-page crawl burst; chrome 28 %, meili 17 % | 0.33.1 → 0.33.2 | limit 768M → 1024M → 1536M on measurements; R-772, R-773, R-774 |
| Dawarich | published | 72247a3 |
app 460 / 1024, sidekiq 270 / 1024, db 148 / 512 | 1.15.2 → 1.15.3 | public login name locks 1 h (mealie precedent, decision 57) |
| Grimmory | stopped before publishing | — (template kept in wip/grimmory/) |
app 522 / 1024, db 109 / 384 | 3.4.1 → 3.5.0 proven on both venues (not written: the app is held) | a stranger's 5 wrong sign-ins lock EVERY visitor out for 15 min (one address behind the tunnel; hard-coded) — R-775, operator decision |
| Grimoire | stop (fit) | — | — | — | upstream: public exposure unsupported, no image — R-768 |
| MeTube | stop (fit) | — | — | — | no login by design — R-767 |
| Pinchflat | stop (fit) | — | — | — | upstream paused — R-769 |
| Invidious | fit only | — | — | — | recommended not to build — R-770 |
| moonlight-web | fit only | — | — | — | UDP / gaming PC — R-771 |
The fit table is FIT.md.
Teardown
Machine: every app of tonight removed from 9202, 9202 back on the live catalog (B/B9-restore-live.txt). Host: bench 9401 destroyed, drill reset to live. Hub: untouched. Details: felhom.eu/REPORT-new-apps-2026-10-01.md.