ubuntu-post-install/CHANGELOG.md

Changelog

All notable changes to this project. Versions follow MAJOR.MINOR.PATCH.

[0.9.5] - 2026-06-03

Changed

• VERSION reset from 1.0.0 to 0.9.5 — versioning now tracks setup_v<X.Y.Z>.sh snapshot files. Each release creates a new numbered file (old files stay). The current setup.sh is always the live version; setup_v0.9.5.sh is the first named snapshot.

Added

• setup_v0.9.5.sh — first versioned snapshot of setup.sh. Future changes produce setup_v0.9.6.sh, etc. Previous snapshots are never removed.

[1.0.0] - 2026-06-03

Milestone: full parity with the monolith

Every service from ubuntu-post-install-24.04-crowdsec.sh is now a module. The modular system (setup.sh + services/) is the primary install path. The monolith is retained as a frozen evolution record.

Added

• services/linux-to-sync.sh (extras) — clones the private outis1one/linux-to-sync repository to ~/linux-to-sync via SSH key or GitHub PAT (PAT is stripped from the remote URL after clone for security). is_installed marker checks ~/linux-to-sync/.git.
• Updated MODULAR.md migration table to show the completed module inventory grouped by category.

[0.9.11] - 2026-06-03

Added

• Utilities batch — 8 service modules migrated from the monolith:
  • services/mealie.sh (utilities) — Recipe manager & meal planner. PUID/PGID baked; default creds noted (change immediately). Port 9925 → internal 9000.
  • services/actualbudget.sh (utilities) — Open-source personal finance (Actual Budget). Minimal container; bank sync via SimpleFIN optional. Port 5006.
  • services/traccar.sh (utilities) — GPS tracking server for phones, vehicles, assets. Ships a starter config/traccar.xml with H2 embedded DB. Port 8082 + 5000-5150 device protocols (TCP+UDP).
  • services/fmd.sh (utilities) — FindMyDevice server for Android. Generates a random admin password; mobile app from F-Droid (not Play Store). Port 8084.
  • services/ddclient.sh (utilities) — Dynamic DNS updater; no web UI. Ships a config/ddclient.conf template covering Cloudflare, DuckDNS, No-IP. Default start prompt is "n" — edit config first.
  • services/wg-easy.sh (utilities) — WireGuard VPN with web UI. Auto-detects public IP for WG_HOST; generates random password; requires NET_ADMIN + SYS_MODULE caps and ip_forward sysctl. Ports 51820/udp (VPN) + 51821/tcp (web).
  • services/meshcentral.sh (utilities) — Self-hosted remote device management server. Prompts for hostname (domain/IP for agent connections). Ports 4430 (HTTPS) + 4433 (agent).
  • services/magicmirror.sh (utilities) — Modular smart mirror / info dashboard. Multi-instance (1-3, ports 8081-8083); each instance in ~/docker/magicmirror/<N>/. Optionally copies existing config.js and auto-clones MMM-* third-party modules from GitHub (tries MichMich → bugsounet → MagicMirrorOrg org order).
• Cameras batch — 2 service modules:
  • services/frigate.sh (cameras) — AI-powered NVR with object detection. Auto-enables /dev/dri/renderD128 for hardware-accelerated detection when present; ships a starter config/config.yml with camera examples. privileged: true + 1 GB tmpfs cache. Ports 5000 (web), 8554 (RTSP restream), 8555 (WebRTC). Default start prompt is "n" — edit config first.
  • services/frigate-notify.sh (cameras) — Push notification sidecar for Frigate events. Auto-detects local Frigate and ntfy installs to pre-fill config defaults. Supports ntfy, Pushover, Discord, Gotify, Telegram, and more. No web UI.

[0.9.10] - 2026-06-03

Added

• Media batch — 6 service modules migrated from the monolith:
  • services/jellyfin.sh (media) — Free media server (movies, TV, music). Auto-detects /dev/dri/renderD128 and enables VAAPI hardware transcoding with the render GID when present; falls back to CPU transcoding otherwise. Ports 8096, 1900/udp (DLNA), 7359/udp (discovery).
  • services/emby.sh (media) — Emby media server. UID/GID baked from the install-time user; HW transcoding block left commented (uncomment /dev/dri once GPU confirmed). Ports 8096 (web) and 8920 (HTTPS).
  • services/audiobookshelf.sh (media) — Audiobook & podcast server. Separate audiobooks and podcasts paths; podcasts folder defaults to ./podcasts inside the service dir. Port 13378.
  • services/arm.sh (media) — Automatic Ripping Machine for DVDs, Blu-rays, CDs. Detects optical drives at install time (/dev/sr*); runs with privileged: true. Ripped output split into movies/ and music/. Port 8080.
  • services/lyrion.sh (media) — Lyrion Music Server (formerly LMS) for Squeezebox devices, the Squeezer app, and Chromecast. Uses network_mode: host so UDP discovery works without manual port mapping. Port 9000.
  • services/immich.sh (media) — Self-hosted photo & video backup (like Google Photos). Full multi-container stack (immich-server, immich-machine-learning, valkey/redis, postgres). Two library strategies: (1) unified — all photos in one place with an auto-generated import-photos.sh helper that handles admin account creation, API key generation, storage template config, and CLI upload; (2) external — existing photos indexed read-only, new uploads separate. Port 2283.

[0.9.9] - 2026-06-03

Added

• New extras category for non-Docker add-ons sourced from other repos — things that build/install on the host instead of running as a container. Inserted into CATEGORY_ORDER between gaming and backup.
• services/silent-send.sh (extras) — installs the Silent Send browser extension (redacts PII before it's sent to AI chatbots). Installs the build toolchain (git, Node.js ≥18 via NodeSource, npm), clones outis1one/silent-send to ~/silent-send, runs npm install so the Firefox build/sign tooling (web-ext) is ready, optionally builds a signed Firefox .xpi (with Mozilla API creds), and prints load-unpacked / build instructions per browser. README written to the checkout. No server/container.
• is_installed marker for silent-send (checks ~/silent-send/.git).

[0.9.8] - 2026-06-03

Added

• services/wolf-pair.sh (gaming) — browser-based Moonlight pairing UI for Wolf. Builds a tiny Python HTTP container (python:3.12-alpine + docker-cli) that watches docker logs wolf for the current pairing secret and serves a PIN entry form on port 8090. Eliminates the ./manage.sh pin CLI workflow — open http://<server>:8090, type the 4-digit PIN, done. Runs with network_mode: host so it can reach Wolf's /pin/ API at localhost:47989; mounts the Docker socket read-only for log access. Optional Caddy subdomain.

[0.9.7] - 2026-06-03

Added

• services/caddy.sh (homelab) — Caddy reverse proxy + automatic HTTPS, own ~/docker/caddy/ folder (compose + starter Caddyfile + README). Services add their site blocks to its Caddyfile.
• services/crowdsec.sh (homelab) — system-level intrusion prevention (agent + firewall bouncer + Caddy log acquisition + optional ntfy ban alerts); README in ~/docker/crowdsec/.
• Guided menu redesign in setup.sh:
  • Prints the required set (essential packages incl. glow + a Docker check) up front and lets you cancel before anything changes.
  • Offers Caddy first (most services depend on it).
  • Category menu loop: pick a category → checklist (already-installed shown as [installed]) → install → back to the menu for the next category, until you choose Done. whiptail UI with a plain-text fallback.

Changed

• Categories reorganized: base · homelab · utilities · media · cameras · gaming · backup. Moved ntfy, filebrowser, portainer, uptimekuma, watchtower to utilities. Within homelab, Caddy → CrowdSec → Authelia sort first.

[0.9.6] - 2026-06-03

Added

• Per-service README generation. New write_readme helper in lib/common.sh; every module now writes a README.md into its ~/docker/<service>/ folder (what it is, access URL, start/stop, data location, reverse-proxy notes) — so each service folder is self-documenting.
• Migrated 6 services from the monolith into modules (all in the homelab group, each with a README):
  • authelia — SSO + 2FA portal, ported from the authelia-setup repo + the monolith's working block: prompts for domain/SMTP, generates jwt/session/storage secrets + the admin Argon2 hash, writes compose/config/users, creates caddy_net, and injects the forward-auth snippet + portal block into the Caddyfile. Won't clobber an existing install.
  • filebrowser (8085), ntfy (8090), uptimekuma (3001), portainer (9443), watchtower (no web port).

Notes

• homelab group now: authelia, filebrowser, homeassistant, ntfy, portainer, uptimekuma, watchtower.
• Remaining monolith services still to migrate: ActualBudget, ARM, AudioBookshelf, Caddy, CrowdSec, Emby, FindMyDevice, Frigate, Frigate-Notify, Immich, Jellyfin, Lyrion, MagicMirror, Mealie, MeshCentral, Traccar, ddclient, wg-easy.

[0.9.5] - 2026-06-03

Added

• services/minecraft.sh (gaming) — full port of the standalone setupminecraft.sh, converted to the per-service-folder model. Each server is its own ~/docker/<instance>/ with a standalone compose, so multiple servers run side by side (port auto-bumps 25565→25566…). Preserves all the niceties: Fabric/Quilt/Paper/Vanilla/Forge flavours, the live Modrinth version/mod-availability picker, curated mods, Vanilla Tweaks datapacks, whitelist UUID pre-population, LuckPerms bootstrap, Chunky pre-gen, playit.gg tunnel, generated MINECRAFT_NETWORKING.md / CLIENT_MODS.md, and the client-mods download web page (its own folder + compose).

Fixed

• Minecraft compose env-block emission (trailing-newline bug from the original that glued ports: onto the last env line — now valid YAML).

Notes

• gaming group now: js99er, minecraft, wolf.
• Still pending: whitelist Minecraft helper; migrating the ~65 monolith services into services/.

[0.9.4] - 2026-06-03

The first versioned release. Introduces the modular post-install system so you can install the whole box at once or run a single service, with one source of truth (no per-service script duplication, nothing generated).

Added

• setup.sh dispatcher: interactive menu, run-one (sudo ./setup.sh <name>), --list, --dry-run, --unattended, --version.
• lib/common.sh: shared helpers (logging, prompts, ownership, Caddy wiring) and a self-registration service registry — one implementation of each.
• Service modules (each its own ~/docker/<name>/ folder + standalone compose):
  • base — essential CLI packages, now including glow.
  • glow — terminal markdown reader (charmbracelet), standalone too.
  • homeassistant — bridge/host networking choice, trusted_proxies pre-seed.
  • js99er (gaming) — self-hosted TI-99/4A emulator (Selkies launcher tie-in removed).
  • wolf (gaming) — Games-on-Whales Moonlight streaming (wolf-pair dropped; pin workflow kept).
  • backup — Kopia encrypted backups (paths adapted to ~/docker).
• MODULAR.md documenting the architecture, how to add a module, migration status.
• Service groups: base / homelab / gaming / backup.
• glow also added to the live -crowdsec monolith scripts' essential packages.

Known gaps / next (0.9.5)

• minecraft module (rich, multi-instance port of setupminecraft.sh) — not yet written; the background port hit a session limit.
• whitelist Minecraft helper not yet shipped.
• ~65 services still live only in the monolith, to migrate into services/.

Earlier history (pre-versioning)

• Removed Keycloak; standardized on Authelia for SSO.
• Added -no-keycloak and -crowdsec script tiers (originals kept as the evolution record).
• CrowdSec replaces fail2ban in the -crowdsec tier (SSH + Caddy, geo + IP reputation, optional ntfy ban alerts).
• Home Assistant added to the -crowdsec tier.