felhom.eu/documentation/audits/new-apps-2026-10-01/FIT.md

FIT — checklist group 0 for the nine new apps (2026-10-01)

Read 2026-10-01 14:10–15:00 UTC. Sources: GitHub API and raw repo files, Docker Hub / ghcr.io / quay.io registry APIs (A/A1-github-facts.txt, A/compose/), upstream docs and issues (URLs below). Three research passes ran in parallel; their facts are kept with their source. [U] upstream code/docs/registry · [R] user reports · [I] our inference. Nothing here is measured on a box except where it says so — group 0 plans the tests, it does not close them.

SparkyFitness and Calibre-Web Automated are already in the catalog (templates/sparkyfitness v0.17.3, templates/calibre-web = crocodilestick/calibre-web-automated:v4.0.8) — not added again.

The table

app (project → image)	licence	last release · 2026 releases	tags · arch	phone-home (switch)	internet at runtime	non-HTTP ports	clients through the tunnel / gate	DB + services	memory (rough)	first admin (guess → measure)	verdict
Radicale (Kozea/Radicale → ghcr.io/kozea/radicale, the project's own image; picked over tomsquest/docker-radicale because it is upstream's, same cadence, multi-arch)	GPL-3.0	v3.8.1 2026-09-24 · 13	3.8.1, 3.8.0 … · amd64, arm64, arm/v7	none found [U]	no	none	CalDAV/CardDAV (DAVx5, iOS, Thunderbird) over HTTPS + basic auth — measured on 9202: well-known → 301, PROPFIND 207, wrong 401	none (files)	~25 MiB measured	class 1: box-generated password; no config ships, default auth = denyall [U]	build — done, see the per-app report
Karakeep (karakeep-app/karakeep → ghcr.io/karakeep-app/karakeep)	AGPL-3.0	0.33.2 2026-08-11 · 5	0.33.2 · amd64, arm64	new-release check → api.github.com (DISABLE_NEW_RELEASE_CHECK); crawler fetches ad-block lists (CRAWLER_ENABLE_ADBLOCKER); the official mobile app has Sentry crash reporting built in [U]; AI tagging OFF unless OPENAI_API_KEY/OLLAMA_BASE_URL is set [U]	yes — it crawls every bookmarked URL (the product)	none	browser extension + mobile app: server URL + API key over HTTPS [U]	SQLite + karakeep-chrome + meilisearch:v1.41	web 300–500 MB, chrome 300–800 MB, meili ~200 MB [I]	class 4: first sign-up becomes admin; DISABLE_SIGNUPS also blocks the FIRST [U] → setup gate + after_setup	build with a note (crawl traffic; the phone app's crash reports; sign-up closed after the first admin)
Dawarich (Freika/dawarich → freikin/dawarich)	AGPL-3.0	1.15.3 2026-09-30 · 56	1.15.3 … · amd64, arm, arm64	telemetry removed; PostHog/Sentry only if configured [U]; map tiles from tyles.dwri.xyz by default (the household's browser asks it for the areas it views) [U]	reverse geocoding OFF unless Photon/Nominatim/Geoapify/LocationIQ is set [U]	none	phone apps (Dawarich, Overland, OwnTracks, GPSLogger) POST with ?api_key= / Bearer over HTTPS [U] — the gate must be open after setup	postgis/postgis:17-3.5-alpine (ARM: imresamu/postgis), redis:7.4, sidekiq	app limit 4 G upstream [U]; to measure	db:seed creates demo@dawarich.app / safepassword on first boot [U] → after_install must replace it	build with a note (seeded known login; tile host; ~3 image moves a month)
Grimmory (grimmory-tools/grimmory → grimmory/grimmory / ghcr.io/grimmory-tools/grimmory)	AGPL-3.0	v3.5.0 2026-09-21 · 24	v3.5.0 … · amd64, arm64	version check → api.github.com [U]; metadata lookups send titles/ISBNs to Google Books, Open Library, Amazon, Goodreads, Hardcover … [U]; Kobo sync proxies to kobo.com [U]	for metadata/Kobo only	none (HTTP 6060)	OPDS v1/v2 + Komga API (basic auth), KOReader sync, Kobo sync token — all HTTP [U]	MariaDB 11.4 (lscr.io/linuxserver/mariadb)	Java, ~512 MB heap (MaxRAMPercentage=60) [U]; ~1 GB + 256 MB [I]	POST /api/v1/setup once, then 403 [U] → setup gate	build with a note (metadata lookups leave the box)
Grimoire (goniszewski/grimoire)	MIT	v1.3.0 2026-09-28 · 4	no published 1.x image (compose uses build:; Docker Hub is the old 0.x line) [U]	local update checks [U]	—	—	bookmarklet with a token	SQLite, one Bun daemon	small	"Public-network exposure is not a supported Grimoire mode"; REST routes "loopback-only and tokenless" [U]	stop — upstream rules out exactly how we publish apps, and there is no image
MeTube (alexta69/metube → ghcr.io/alexta69/metube)	AGPL-3.0	2026.09.29 · 80 tags (≈10 are yt-dlp releases; the rest MeTube's own changes) [U]	date tags · amd64, arm64	none documented [U]	yes — YouTube etc., from the household's IP	none	web only	none (files in /downloads)	not documented	no login at all, by design ("deliberately has no login system", wiki) [U] — anyone who finds the subdomain downloads through the household's IP and can use uploaded cookies	stop as specified → build behind the family gate (changed 2026-10-02, 09 §3 decision 64). Why: the stop had ONE reason — the box had no permanent household-only door. Controller 0.287.0 has one: the family gate, every path (the websocket included) behind each member's own login, measured on 9202 (audits/family-gate-2026-10-02/A/items.txt). MeTube gets NO exception — it has no login to fall back on. The download-through-the-household's-IP risk stays the household's, now limited to its own members; the page says the household downloads only what it may (own use, copyright).
Pinchflat (kieraneglin/pinchflat → ghcr.io/kieraneglin/pinchflat)	AGPL-3.0	v2025.9.26 (2025-09-26) · 0 in 2026; last push 2025-12-16	no v2025.9.26 tag; newest version tag v2025.6.6; latest is amd64 only [U]	none documented	yes (YouTube; yt-dlp self-updates daily [U])	none	web only	SQLite	undocumented; an unanswered report of a 30 GB yt-dlp leak (#866) [R]	optional BASIC_AUTH_* [U]; runs as root by default [U]	stop — upstream paused (checklist 0.2: no release in 6 months); forks exist (Pinchflat-NGX, MorganKryze) — a different upstream is the operator's choice
Invidious (iv-org/invidious → quay.io/invidious/invidious) — fit only	AGPL-3.0	v2.20260804.1 2026-08-05 · 5 (+ rolling dated builds)	2.20260804.1, dated YYYY.MM.DD-sha · amd64, arm64; companion has no version tags (rolling latest) [U]	statistics off by default [U]	yes — youtube.com, googlevideo.com … from the household's IP	none	Clipious, Yattee, FreeTube over HTTPS [I]	needs invidious-companion (replaces sig-helper and the po_token generator) [U]; PostgreSQL 14 (EOL Nov 2026)	"2 GB free RAM, restart regularly" [U]	registration_enabled: true by default [U]	stop (recommended; operator decides) — upstream: a bot check means "your IP is blocked from YouTube", 429s "for 24 hours", triggered by "someone on your network" [U]; on our boxes that IP is the household's. One bad period in 2026 (March, ~2 weeks, companion #274/#290) [R]. No report found of a family's phones being bot-checked [I: plausible, not shown]
moonlight-web — two unrelated projects — fit only	GPL-3.0 both	MrCreativ3001/moonlight-web-stream: v2.10.0 (May) + v3 prereleases to 09-16 · linckosz/moonlight-web: v0.3.1 09-25 (since Jul)	mrcreativ3001/moonlight-web-stream, ghcr.io/linckosz/moonlight-web · amd64, arm64	linckosz: update check + session metrics by default (MW_NO_TELEMETRY=1) [U]	linckosz: remote access through the author's rendezvous server [U]	WebRTC over UDP (40000-40100/udp; linckosz 48550-48573/udp, recommends --network host) [U]	a WebSocket fallback exists in both (needs HTTPS; more latency) [U]	needs Sunshine/Apollo/Wolf on a gaming PC on the LAN [U]	—	first login becomes admin (MrCreativ3001); PIN + admin password (linckosz) [U]	stop — usable latency needs UDP or host networking; through an HTTP tunnel only the high-latency fallback; a logged-in user controls the gaming PC's desktop [I]

Claims in the brief that were wrong or need a correction

1. Grimmory / BookLore. The brief: "several forks of BookLore exist after its original was abandoned". Closer: the sole developer deleted the repo, Discord and site on 2026-03-23 [R: XDA 2026-03-31, braedach.com]; the repo came back ~2026-04-30 as booklore-app/booklore (the original, not a fork — adityachandelgit/BookLore redirects to it) and now says it is in maintenance mode, naming BookOrbit as its successor [U: its README]. grimmory-tools/grimmory (the reviewer's guess) is right: an organisation with governance files and 24 releases in 2026.
2. Invidious. The brief names "companion / signature helper": the signature helper and the po_token generator are deprecated — invidious-companion replaces both [U: docs.invidious.io/installation]. The IP behaviour is upstream's own wording; the spill-over to the household's other devices is inference, not reported.
3. moonlight-web. Two unrelated projects; MrCreativ3001's is the original. A WebSocket fallback does exist in both. GeForce Experience can no longer host (GameStream retired) — Sunshine, Apollo or Wolf [I, general knowledge].
4. Karakeep's AI default — the brief's worry is answered: OFF unless a key/URL is set [U]. Not in the brief: the official mobile app ships Sentry crash reporting.
5. Grimoire — not "a lighter Karakeep" we can publish: upstream forbids public exposure.
6. Pinchflat — the brief's project is right, but it is paused.
7. SparkyFitness and Calibre-Web Automated — confirmed already in the catalog.

Sources (beyond the GitHub/registry reads in A/)

docs.invidious.io/installation/ · docs.invidious.io/youtube-errors-explained/ · github.com/iv-org/invidious-companion/issues/274, /290 · github.com/MrCreativ3001/moonlight-web-stream (README, docker/README.md) · github.com/linckosz/moonlight-web (README) · github.com/alexta69/metube/wiki/Reverse-proxy-configurations · github.com/kieraneglin/pinchflat/issues/866 · github.com/community-scripts/ProxmoxVE/issues/15968 · github.com/TheBadFella/Pinchflat-NGX · github.com/MorganKryze/pinchflat · github.com/yt-dlp/yt-dlp/wiki/PO-Token-Guide, /Extractors, /FAQ · youtube.com/static?template=terms&hl=en · raw.githubusercontent.com/booklore-app/booklore/develop/README.md · xda-developers.com/single-maintainer-open-source-ticking-time-bomb/ · braedach.com/booklore-is-dead/ · github.com/community-scripts/ProxmoxVE/discussions/13155 · karakeep: packages/shared/config.ts, packages/trpc/models/users.ts, apps/mobile/app/_layout.tsx · dawarich: db/seeds.rb, config/initializers/01_constants.rb, 03_dawarich_settings.rb, style_manager.js · grimoire: SECURITY.md, docs/06-remote-access.md · grimmory: SetupController.java, SecurityConfig.java, KoboServerProxy.java.