ubuntu-post-install/CHANGELOG.md

Changelog

All notable changes to this project. Versions follow MAJOR.MINOR.PATCH. The project is pre-1.0 while the modular system reaches parity with the monolithic ubuntu-post-install-*.sh scripts.

[0.9.10] - 2026-06-03

Added

• Media batch — 6 service modules migrated from the monolith:
  • services/jellyfin.sh (media) — Free media server (movies, TV, music). Auto-detects /dev/dri/renderD128 and enables VAAPI hardware transcoding with the render GID when present; falls back to CPU transcoding otherwise. Ports 8096, 1900/udp (DLNA), 7359/udp (discovery).
  • services/emby.sh (media) — Emby media server. UID/GID baked from the install-time user; HW transcoding block left commented (uncomment /dev/dri once GPU confirmed). Ports 8096 (web) and 8920 (HTTPS).
  • services/audiobookshelf.sh (media) — Audiobook & podcast server. Separate audiobooks and podcasts paths; podcasts folder defaults to ./podcasts inside the service dir. Port 13378.
  • services/arm.sh (media) — Automatic Ripping Machine for DVDs, Blu-rays, CDs. Detects optical drives at install time (/dev/sr*); runs with privileged: true. Ripped output split into movies/ and music/. Port 8080.
  • services/lyrion.sh (media) — Lyrion Music Server (formerly LMS) for Squeezebox devices, the Squeezer app, and Chromecast. Uses network_mode: host so UDP discovery works without manual port mapping. Port 9000.
  • services/immich.sh (media) — Self-hosted photo & video backup (like Google Photos). Full multi-container stack (immich-server, immich-machine-learning, valkey/redis, postgres). Two library strategies: (1) unified — all photos in one place with an auto-generated import-photos.sh helper that handles admin account creation, API key generation, storage template config, and CLI upload; (2) external — existing photos indexed read-only, new uploads separate. Port 2283.

[0.9.9] - 2026-06-03

Added

• New extras category for non-Docker add-ons sourced from other repos — things that build/install on the host instead of running as a container. Inserted into CATEGORY_ORDER between gaming and backup.
• services/silent-send.sh (extras) — installs the Silent Send browser extension (redacts PII before it's sent to AI chatbots). Installs the build toolchain (git, Node.js ≥18 via NodeSource, npm), clones outis1one/silent-send to ~/silent-send, runs npm install so the Firefox build/sign tooling (web-ext) is ready, optionally builds a signed Firefox .xpi (with Mozilla API creds), and prints load-unpacked / build instructions per browser. README written to the checkout. No server/container.
• is_installed marker for silent-send (checks ~/silent-send/.git).

[0.9.8] - 2026-06-03

Added

• services/wolf-pair.sh (gaming) — browser-based Moonlight pairing UI for Wolf. Builds a tiny Python HTTP container (python:3.12-alpine + docker-cli) that watches docker logs wolf for the current pairing secret and serves a PIN entry form on port 8090. Eliminates the ./manage.sh pin CLI workflow — open http://<server>:8090, type the 4-digit PIN, done. Runs with network_mode: host so it can reach Wolf's /pin/ API at localhost:47989; mounts the Docker socket read-only for log access. Optional Caddy subdomain.

[0.9.7] - 2026-06-03

Added

• services/caddy.sh (homelab) — Caddy reverse proxy + automatic HTTPS, own ~/docker/caddy/ folder (compose + starter Caddyfile + README). Services add their site blocks to its Caddyfile.
• services/crowdsec.sh (homelab) — system-level intrusion prevention (agent + firewall bouncer + Caddy log acquisition + optional ntfy ban alerts); README in ~/docker/crowdsec/.
• Guided menu redesign in setup.sh:
  • Prints the required set (essential packages incl. glow + a Docker check) up front and lets you cancel before anything changes.
  • Offers Caddy first (most services depend on it).
  • Category menu loop: pick a category → checklist (already-installed shown as [installed]) → install → back to the menu for the next category, until you choose Done. whiptail UI with a plain-text fallback.

Changed

• Categories reorganized: base · homelab · utilities · media · cameras · gaming · backup. Moved ntfy, filebrowser, portainer, uptimekuma, watchtower to utilities. Within homelab, Caddy → CrowdSec → Authelia sort first.

[0.9.6] - 2026-06-03

Added

• Per-service README generation. New write_readme helper in lib/common.sh; every module now writes a README.md into its ~/docker/<service>/ folder (what it is, access URL, start/stop, data location, reverse-proxy notes) — so each service folder is self-documenting.
• Migrated 6 services from the monolith into modules (all in the homelab group, each with a README):
  • authelia — SSO + 2FA portal, ported from the authelia-setup repo + the monolith's working block: prompts for domain/SMTP, generates jwt/session/storage secrets + the admin Argon2 hash, writes compose/config/users, creates caddy_net, and injects the forward-auth snippet + portal block into the Caddyfile. Won't clobber an existing install.
  • filebrowser (8085), ntfy (8090), uptimekuma (3001), portainer (9443), watchtower (no web port).

Notes

• homelab group now: authelia, filebrowser, homeassistant, ntfy, portainer, uptimekuma, watchtower.
• Remaining monolith services still to migrate: ActualBudget, ARM, AudioBookshelf, Caddy, CrowdSec, Emby, FindMyDevice, Frigate, Frigate-Notify, Immich, Jellyfin, Lyrion, MagicMirror, Mealie, MeshCentral, Traccar, ddclient, wg-easy.

[0.9.5] - 2026-06-03

Added

• services/minecraft.sh (gaming) — full port of the standalone setupminecraft.sh, converted to the per-service-folder model. Each server is its own ~/docker/<instance>/ with a standalone compose, so multiple servers run side by side (port auto-bumps 25565→25566…). Preserves all the niceties: Fabric/Quilt/Paper/Vanilla/Forge flavours, the live Modrinth version/mod-availability picker, curated mods, Vanilla Tweaks datapacks, whitelist UUID pre-population, LuckPerms bootstrap, Chunky pre-gen, playit.gg tunnel, generated MINECRAFT_NETWORKING.md / CLIENT_MODS.md, and the client-mods download web page (its own folder + compose).

Fixed

• Minecraft compose env-block emission (trailing-newline bug from the original that glued ports: onto the last env line — now valid YAML).

Notes

• gaming group now: js99er, minecraft, wolf.
• Still pending: whitelist Minecraft helper; migrating the ~65 monolith services into services/.

[0.9.4] - 2026-06-03

The first versioned release. Introduces the modular post-install system so you can install the whole box at once or run a single service, with one source of truth (no per-service script duplication, nothing generated).

Added

• setup.sh dispatcher: interactive menu, run-one (sudo ./setup.sh <name>), --list, --dry-run, --unattended, --version.
• lib/common.sh: shared helpers (logging, prompts, ownership, Caddy wiring) and a self-registration service registry — one implementation of each.
• Service modules (each its own ~/docker/<name>/ folder + standalone compose):
  • base — essential CLI packages, now including glow.
  • glow — terminal markdown reader (charmbracelet), standalone too.
  • homeassistant — bridge/host networking choice, trusted_proxies pre-seed.
  • js99er (gaming) — self-hosted TI-99/4A emulator (Selkies launcher tie-in removed).
  • wolf (gaming) — Games-on-Whales Moonlight streaming (wolf-pair dropped; pin workflow kept).
  • backup — Kopia encrypted backups (paths adapted to ~/docker).
• MODULAR.md documenting the architecture, how to add a module, migration status.
• Service groups: base / homelab / gaming / backup.
• glow also added to the live -crowdsec monolith scripts' essential packages.

Known gaps / next (0.9.5)

• minecraft module (rich, multi-instance port of setupminecraft.sh) — not yet written; the background port hit a session limit.
• whitelist Minecraft helper not yet shipped.
• ~65 services still live only in the monolith, to migrate into services/.

Earlier history (pre-versioning)

• Removed Keycloak; standardized on Authelia for SSO.
• Added -no-keycloak and -crowdsec script tiers (originals kept as the evolution record).
• CrowdSec replaces fail2ban in the -crowdsec tier (SSH + Caddy, geo + IP reputation, optional ntfy ban alerts).
• Home Assistant added to the -crowdsec tier.