admin
e6d1ebd152
gates / gates (push) Successful in 28s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
55 lines
11 KiB
Markdown
55 lines
11 KiB
Markdown
# FIT — checklist group 0 for the nine new apps (2026-10-01)
|
||
|
||
Read 2026-10-01 14:10–15:00 UTC. Sources: GitHub API and raw repo files, Docker Hub / ghcr.io / quay.io registry APIs
|
||
(`A/A1-github-facts.txt`, `A/compose/`), upstream docs and issues (URLs below). Three research passes ran in parallel;
|
||
their facts are kept with their source. **[U]** upstream code/docs/registry · **[R]** user reports · **[I]** our inference.
|
||
Nothing here is measured on a box except where it says so — group 0 plans the tests, it does not close them.
|
||
|
||
SparkyFitness and Calibre-Web Automated are already in the catalog (`templates/sparkyfitness` v0.17.3,
|
||
`templates/calibre-web` = `crocodilestick/calibre-web-automated:v4.0.8`) — not added again.
|
||
|
||
## The table
|
||
|
||
| app (project → image) | licence | last release · 2026 releases | tags · arch | phone-home (switch) | internet at runtime | non-HTTP ports | clients through the tunnel / gate | DB + services | memory (rough) | first admin (guess → measure) | verdict |
|
||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
||
| **Radicale** (Kozea/Radicale → `ghcr.io/kozea/radicale`, the project's own image; picked over `tomsquest/docker-radicale` because it is upstream's, same cadence, multi-arch) | GPL-3.0 | v3.8.1 2026-09-24 · 13 | `3.8.1`, `3.8.0` … · amd64, arm64, arm/v7 | none found [U] | no | none | CalDAV/CardDAV (DAVx5, iOS, Thunderbird) over HTTPS + basic auth — **measured on 9202**: well-known → 301, PROPFIND 207, wrong 401 | none (files) | ~25 MiB **measured** | class 1: box-generated password; **no config ships, default auth = denyall** [U] | **build** — done, see the per-app report |
|
||
| **Karakeep** (karakeep-app/karakeep → `ghcr.io/karakeep-app/karakeep`) | AGPL-3.0 | 0.33.2 2026-08-11 · 5 | `0.33.2` · amd64, arm64 | new-release check → api.github.com (`DISABLE_NEW_RELEASE_CHECK`); crawler fetches ad-block lists (`CRAWLER_ENABLE_ADBLOCKER`); **the official mobile app has Sentry crash reporting built in** [U]; **AI tagging OFF unless `OPENAI_API_KEY`/`OLLAMA_BASE_URL` is set** [U] | yes — it crawls every bookmarked URL (the product) | none | browser extension + mobile app: server URL + API key over HTTPS [U] | SQLite + `karakeep-chrome` + `meilisearch:v1.41` | web 300–500 MB, chrome 300–800 MB, meili ~200 MB [I] | class 4: first sign-up becomes admin; `DISABLE_SIGNUPS` also blocks the FIRST [U] → setup gate + `after_setup` | **build with a note** (crawl traffic; the phone app's crash reports; sign-up closed after the first admin) |
|
||
| **Dawarich** (Freika/dawarich → `freikin/dawarich`) | AGPL-3.0 | 1.15.3 2026-09-30 · 56 | `1.15.3` … · amd64, arm, arm64 | telemetry removed; PostHog/Sentry only if configured [U]; **map tiles from `tyles.dwri.xyz` by default** (the household's browser asks it for the areas it views) [U] | reverse geocoding OFF unless Photon/Nominatim/Geoapify/LocationIQ is set [U] | none | phone apps (Dawarich, Overland, OwnTracks, GPSLogger) POST with `?api_key=` / Bearer over HTTPS [U] — the gate must be open after setup | `postgis/postgis:17-3.5-alpine` (ARM: `imresamu/postgis`), `redis:7.4`, sidekiq | app limit 4 G upstream [U]; to measure | **`db:seed` creates `demo@dawarich.app` / `safepassword` on first boot** [U] → `after_install` must replace it | **build with a note** (seeded known login; tile host; ~3 image moves a month) |
|
||
| **Grimmory** (grimmory-tools/grimmory → `grimmory/grimmory` / `ghcr.io/grimmory-tools/grimmory`) | AGPL-3.0 | v3.5.0 2026-09-21 · 24 | `v3.5.0` … · amd64, arm64 | version check → api.github.com [U]; metadata lookups send titles/ISBNs to Google Books, Open Library, Amazon, Goodreads, Hardcover … [U]; Kobo sync proxies to kobo.com [U] | for metadata/Kobo only | none (HTTP 6060) | OPDS v1/v2 + Komga API (basic auth), KOReader sync, Kobo sync token — all HTTP [U] | MariaDB 11.4 (`lscr.io/linuxserver/mariadb`) | Java, ~512 MB heap (`MaxRAMPercentage=60`) [U]; ~1 GB + 256 MB [I] | `POST /api/v1/setup` once, then 403 [U] → setup gate | **build with a note** (metadata lookups leave the box) |
|
||
| **Grimoire** (goniszewski/grimoire) | MIT | v1.3.0 2026-09-28 · 4 | **no published 1.x image** (compose uses `build:`; Docker Hub is the old 0.x line) [U] | local update checks [U] | — | — | bookmarklet with a token | SQLite, one Bun daemon | small | **"Public-network exposure is not a supported Grimoire mode"; REST routes "loopback-only and tokenless"** [U] | **stop** — upstream rules out exactly how we publish apps, and there is no image |
|
||
| **MeTube** (alexta69/metube → `ghcr.io/alexta69/metube`) | AGPL-3.0 | 2026.09.29 · 80 tags (≈10 are yt-dlp releases; the rest MeTube's own changes) [U] | date tags · amd64, arm64 | none documented [U] | yes — YouTube etc., **from the household's IP** | none | web only | none (files in `/downloads`) | not documented | **no login at all, by design** ("deliberately has no login system", wiki) [U] — anyone who finds the subdomain downloads through the household's IP and can use uploaded cookies | ~~**stop as specified**~~ → **build behind the family gate** (changed 2026-10-02, `09` §3 decision 64). **Why:** the stop had ONE reason — the box had no permanent household-only door. Controller 0.287.0 has one: the family gate, every path (the websocket included) behind each member's own login, measured on 9202 (`audits/family-gate-2026-10-02/A/items.txt`). MeTube gets NO exception — it has no login to fall back on. The download-through-the-household's-IP risk stays the household's, now limited to its own members; the page says the household downloads only what it may (own use, copyright). |
|
||
| **Pinchflat** (kieraneglin/pinchflat → `ghcr.io/kieraneglin/pinchflat`) | AGPL-3.0 | v2025.9.26 (2025-09-26) · **0 in 2026**; last push 2025-12-16 | **no `v2025.9.26` tag; newest version tag `v2025.6.6`; `latest` is amd64 only** [U] | none documented | yes (YouTube; yt-dlp self-updates daily [U]) | none | web only | SQLite | undocumented; an unanswered report of a 30 GB yt-dlp leak (#866) [R] | optional `BASIC_AUTH_*` [U]; runs as root by default [U] | **stop** — upstream paused (checklist 0.2: no release in 6 months); forks exist (Pinchflat-NGX, MorganKryze) — a different upstream is the operator's choice |
|
||
| **Invidious** (iv-org/invidious → `quay.io/invidious/invidious`) — **fit only** | AGPL-3.0 | v2.20260804.1 2026-08-05 · 5 (+ rolling dated builds) | `2.20260804.1`, dated `YYYY.MM.DD-sha` · amd64, arm64; **companion has no version tags** (rolling `latest`) [U] | statistics off by default [U] | yes — youtube.com, googlevideo.com … from the **household's IP** | none | Clipious, Yattee, FreeTube over HTTPS [I] | **needs `invidious-companion`** (replaces sig-helper and the po_token generator) [U]; PostgreSQL **14** (EOL Nov 2026) | "2 GB free RAM, restart regularly" [U] | `registration_enabled: true` by default [U] | **stop (recommended; operator decides)** — upstream: a bot check means "your IP is blocked from YouTube", 429s "for 24 hours", triggered by "someone on your network" [U]; on our boxes that IP is the household's. One bad period in 2026 (March, ~2 weeks, companion #274/#290) [R]. No report found of a family's phones being bot-checked [I: plausible, not shown] |
|
||
| **moonlight-web** — two unrelated projects — **fit only** | GPL-3.0 both | MrCreativ3001/moonlight-web-stream: v2.10.0 (May) + v3 prereleases to 09-16 · linckosz/moonlight-web: v0.3.1 09-25 (since Jul) | `mrcreativ3001/moonlight-web-stream`, `ghcr.io/linckosz/moonlight-web` · amd64, arm64 | linckosz: update check + session metrics by default (`MW_NO_TELEMETRY=1`) [U] | linckosz: remote access through the author's rendezvous server [U] | **WebRTC over UDP** (40000-40100/udp; linckosz 48550-48573/udp, recommends `--network host`) [U] | a **WebSocket fallback exists in both** (needs HTTPS; more latency) [U] | needs **Sunshine/Apollo/Wolf on a gaming PC on the LAN** [U] | — | first login becomes admin (MrCreativ3001); PIN + admin password (linckosz) [U] | **stop** — usable latency needs UDP or host networking; through an HTTP tunnel only the high-latency fallback; a logged-in user controls the gaming PC's desktop [I] |
|
||
|
||
## Claims in the brief that were wrong or need a correction
|
||
|
||
1. **Grimmory / BookLore.** The brief: "several forks of BookLore exist after its original was abandoned". Closer: the
|
||
sole developer deleted the repo, Discord and site on 2026-03-23 [R: XDA 2026-03-31, braedach.com]; the repo came
|
||
back ~2026-04-30 as `booklore-app/booklore` (the original, not a fork — `adityachandelgit/BookLore` redirects to it)
|
||
and now says it is in **maintenance mode**, naming **BookOrbit** as its successor [U: its README]. `grimmory-tools/grimmory`
|
||
(the reviewer's guess) is right: an organisation with governance files and 24 releases in 2026.
|
||
2. **Invidious.** The brief names "companion / signature helper": the signature helper and the po_token generator are
|
||
**deprecated — invidious-companion replaces both** [U: docs.invidious.io/installation]. The IP behaviour is
|
||
upstream's own wording; the spill-over to the household's other devices is inference, not reported.
|
||
3. **moonlight-web.** Two **unrelated** projects; MrCreativ3001's is the original. A WebSocket fallback **does** exist
|
||
in both. GeForce Experience can no longer host (GameStream retired) — Sunshine, Apollo or Wolf [I, general knowledge].
|
||
4. **Karakeep's AI default** — the brief's worry is answered: OFF unless a key/URL is set [U]. Not in the brief: the
|
||
official mobile app ships Sentry crash reporting.
|
||
5. **Grimoire** — not "a lighter Karakeep" we can publish: upstream forbids public exposure.
|
||
6. **Pinchflat** — the brief's project is right, but it is paused.
|
||
7. **SparkyFitness and Calibre-Web Automated** — confirmed already in the catalog.
|
||
|
||
## Sources (beyond the GitHub/registry reads in `A/`)
|
||
|
||
docs.invidious.io/installation/ · docs.invidious.io/youtube-errors-explained/ · github.com/iv-org/invidious-companion/issues/274, /290 ·
|
||
github.com/MrCreativ3001/moonlight-web-stream (README, docker/README.md) · github.com/linckosz/moonlight-web (README) ·
|
||
github.com/alexta69/metube/wiki/Reverse-proxy-configurations · github.com/kieraneglin/pinchflat/issues/866 ·
|
||
github.com/community-scripts/ProxmoxVE/issues/15968 · github.com/TheBadFella/Pinchflat-NGX · github.com/MorganKryze/pinchflat ·
|
||
github.com/yt-dlp/yt-dlp/wiki/PO-Token-Guide, /Extractors, /FAQ · youtube.com/static?template=terms&hl=en ·
|
||
raw.githubusercontent.com/booklore-app/booklore/develop/README.md · xda-developers.com/single-maintainer-open-source-ticking-time-bomb/ ·
|
||
braedach.com/booklore-is-dead/ · github.com/community-scripts/ProxmoxVE/discussions/13155 ·
|
||
karakeep: packages/shared/config.ts, packages/trpc/models/users.ts, apps/mobile/app/_layout.tsx ·
|
||
dawarich: db/seeds.rb, config/initializers/01_constants.rb, 03_dawarich_settings.rb, style_manager.js ·
|
||
grimoire: SECURITY.md, docs/06-remote-access.md · grimmory: SetupController.java, SecurityConfig.java, KoboServerProxy.java.
|