Release v20.9 to unstable

-----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCgA0FiEEfWrbdQ+RCFWJSEvmd8DHXntlCAgFAl7DLdwWHGp2YWxsZXJv
 eUBtYWlsYm94Lm9yZwAKCRB3wMdee2UICL6LD/wKkImO2qEucdZ86feRWK7Dnc9M
 VhysJ4mjvqDmd22cVi7Y7+w921mQ8SCKIB8RWpjqzvwFSywUAIV+VyuRWtW/L3Ix
 8OQervWz18w++LYRW+6vJ+9cRjIUVOEterOwcwZCaFql67sl8LsCm9l/1fEPh2Km
 PzAFk+2XN57ON7yQMzntjNZciHxRI87MklKlyxeKOtgcNwjIX/cow4yhhgKCDPEe
 r6jAfAIzQRKKHAZJ+FJQyqG9bAdP7nXuvZh5e0qvebPCqi3Gbw6lm/5ivMBOoTp1
 4fTnrLD4xM9o9iU+6p6u8TVB/CCQ/vGeil95U3/zptfpD1H7W5C5Sd/qEC9GOOVl
 uHeNfQNlZe/vLqdGyK10GBgdL2t5FpbQgBDRDsNu6fOSOpFvn0FKwVQ5aVAazwfz
 i/QErSKCf1TD8BPmEGtcGC49rPLukNSwwZ13YNS2/A3laoWdLkpusMd5Xg1Fh64T
 iWvQFCI4/T/GAnQeE6HlS5cmdRu09TlewgMKk2x54pGoqfLSFTJxO77enKYftlZA
 de8VOsrcISwnuPA9KkB4Q5MQ6Ds/Ibfy+OwYRi1ZO0f0Dad6IyOrWPWRU0ZNPUny
 nmYdA/J3/hvBgR7v5NrIvN+OZBtz4GZcDPnce9d6ryVh6AMjmDP1otf46cMXgkMH
 uBhRfYviLns0oW17xw==
 =bpv2
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCgA0FiEEfWrbdQ+RCFWJSEvmd8DHXntlCAgFAl7GYJwWHGp2YWxsZXJv
 eUBtYWlsYm94Lm9yZwAKCRB3wMdee2UICJoTEADRoDLFfAbhizXRjm+CdPmw2qqf
 9lFlAxwqL/mso4HhIkFNnIjlipLnHdY9iC4hXUiYFe8phypByT8t6t7hxm8PX5EU
 VwJDN8M4sg46O6GGgjbcs/eaaB6b0P9QHm07+gcWIMDcaqgb6Ge+A/VaxpXIU9rk
 q0OXmnJzzulSl2/C5Abv3928Ya/N0koOY7q/BKv5go4M1/I1D9M/xwgSrXcEpTmL
 7SyzT117Tz/D8G1mGINgu/GsN+QnRWV2FlCb7aHOfVIJf9AWob61jd53v45TpBkb
 BaIqwRqvrmeNYPoTPIKF85kIlNSFB35SJ38YkKa06SZYWbPRMZ3VyK/Okq3BCSIu
 6R6YSpz6HyIJ26nkDjrVk3elRw0A+VHip068kiFKC5UyoY2JQtmIGS07sjW0lggK
 Rd2z1jz4F+724ihK4ImYy2YdtraLHvgWrlXMAxT3tVqDwUNG3dTORd/6HhZ2M34o
 JtG9SmGyYZ61fEUOm/9OqEYEGq7Q71wdaktP0QVxB4H0aospE+HZuOeuYTcdvSJN
 toV4LyOozmoxhNk/Pe8sGFJ9JWdjfqnMh51qvfkTVbsftQe/+lBJccr8mpJqHQFm
 qX9+TCIuYXAH5qyR4ZUPgRwT8ZEj7YkeYhNr9c8ciA7O674WztY7/Y0sqAQeygdu
 Ki/wb5E7Si6q64Ie0w==
 =/g55
 -----END PGP SIGNATURE-----

Merge tag 'v20.9' into debian/buster-backports

Release v20.9 to unstable

Signed-off-by: James Valleroy <jvalleroy@mailbox.org>

HACKING.md

@@ -92,7 +92,7 @@ and requires about 4.5 GB of disk space.
 
     ```bash
     host$ git clone https://salsa.debian.org/freedombox-team/freedombox.git
-    host$ cd plinth
+    host$ cd freedombox
     ```
 
 2.  To download, setup, run, and configure a VM for FreedomBox development using

actions/minidlna

@@ -4,17 +4,23 @@
 Configuration actions for the minidlna server.
 """
 import argparse
-from tempfile import mkstemp
-from shutil import move
 import subprocess
-from os import fdopen, remove, chmod, stat
+from os import chmod, fdopen, remove, stat
+from shutil import move
+from tempfile import mkstemp
 
 import augeas
+
 from plinth import action_utils
 from plinth.utils import grep
 
 CONFIG_PATH = '/etc/minidlna.conf'
 
+SYSCTL_CONF = '''# This file is managed and overwritten by FreedomBox.
+# Helps minidlna monitor changes in large media directories
+fs.inotify.max_user_watches = 100000
+'''
+
 
 def parse_arguments():
     """Return parsed command line arguments as dictionary."""
@@ -33,19 +39,34 @@ def parse_arguments():
     return parser.parse_args()
 
 
+def _undo_old_configuration_changes():
+    """Restore /etc/sysctl.conf to before our changes.
+
+    Older version of minidlna app in FreedomBox < 20.9 wrote to
+    /etc/sysctl.conf directly. This will cause conffile prompt during upgrade
+    of procps package. Undo the changes so that upgrade can happen smoothly.
+
+    """
+    aug = augeas.Augeas(flags=augeas.Augeas.NO_LOAD +
+                        augeas.Augeas.NO_MODL_AUTOLOAD)
+    aug.set('/augeas/load/Sysctl/lens', 'Sysctl.lns')
+    aug.set('/augeas/load/Sysctl/incl[last() + 1]', '/etc/sysctl.conf')
+    aug.load()
+
+    key_path = '/files/etc/sysctl.conf/fs.inotify.max_user_watches'
+    if aug.get(key_path) == '100000':
+        aug.remove(key_path)
+        aug.save()
+
+
 def subcommand_setup(arguments):
     """
     Increase inotify watches per folder to allow minidlna to
     monitor changes in large media-dirs.
     """
-    aug = augeas.Augeas(
-        flags=augeas.Augeas.NO_LOAD + augeas.Augeas.NO_MODL_AUTOLOAD)
-    aug.set('/augeas/load/Sysctl/lens', 'Sysctl.lns')
-    aug.set('/augeas/load/Sysctl/incl[last() + 1]', '/etc/sysctl.conf')
-    aug.load()
-
-    aug.set('/files/etc/sysctl.conf/fs.inotify.max_user_watches', '100000')
-    aug.save()
+    _undo_old_configuration_changes()
+    with open('/etc/sysctl.d/50-freedombox-minidlna.conf', 'w') as conf:
+        conf.write(SYSCTL_CONF)
 
     subprocess.run(['systemctl', 'restart', 'systemd-sysctl'], check=True)
 

actions/snapshot

@@ -35,9 +35,6 @@ def parse_arguments():
                                       help='Delete a snapshot by number')
     subparser.add_argument('number', help='Number of snapshot to delete')
 
-    subparser = subparsers.add_parser('delete-all',
-                                      help='Delete all the snapshots')
-
     subparser = subparsers.add_parser('set-config',
                                       help='Configure automatic snapshots')
     subparser.add_argument('config')
@@ -166,25 +163,30 @@ def _add_fstab_entry(mount_point):
         aug.save()
 
 
-def _get_snapper_list():
-    command = ['snapper', 'list']
-    process = subprocess.run(command, stdout=subprocess.PIPE, check=True)
-    return process.stdout.decode().splitlines()
+def _parse_number(number):
+    """Parse the char following the number and return status of snapshot."""
+    is_default = number[-1] in ('+', '*')
+    is_active = number[-1] in ('-', '*')
+    return number.strip('-+*'), is_default, is_active
 
 
 def subcommand_list(_):
     """List snapshots."""
-    lines = _get_snapper_list()
-    keys = ('number', 'type', 'pre_number', 'date', 'user', 'cleanup',
-            'description')
+    process = subprocess.run(['snapper', 'list'], stdout=subprocess.PIPE,
+                             check=True)
+    lines = process.stdout.decode().splitlines()
+
+    keys = ('number', 'is_default', 'is_active', 'type', 'pre_number', 'date',
+            'user', 'cleanup', 'description')
     snapshots = []
     for line in lines[2:]:
-        parts = [part.strip('* ') for part in line.split('|')]
-        snapshots.append(dict(zip(keys, parts)))
-
-    default = _get_default_snapshot()
-    for snapshot in snapshots:
-        snapshot['is_default'] = (snapshot['number'] == default)
+        parts = [part.strip() for part in line.split('|')]
+        parts = list(_parse_number(parts[0])) + parts[1:]
+        snapshot = dict(zip(keys, parts))
+        # Snapshot 0 always represents the current system, it need not be
+        # listed and cannot be deleted.
+        if snapshot['number'] != '0':
+            snapshots.append(snapshot)
 
     snapshots.reverse()
     print(json.dumps(snapshots))
@@ -231,35 +233,6 @@ def subcommand_delete(arguments):
     subprocess.run(command, check=True)
 
 
-def subcommand_delete_all(_):
-    """Delete all the snapshots (except the active one)."""
-    lines = _get_snapper_list()
-    snapshot_range = [line.split('|')[0].strip() for line in lines[3:]]
-    default_snapshot = _get_default_snapshot()
-    if snapshot_range:
-        if default_snapshot:
-            index = snapshot_range.index(default_snapshot)
-            range_before = snapshot_range[:index]
-            range_after = snapshot_range[index + 1:]
-            to_delete = [range_before, range_after]
-        else:
-            to_delete = [snapshot_range]
-
-        delete_args = filter(None, map(_get_delete_arg, to_delete))
-        for arg in delete_args:
-            subprocess.run(['snapper', 'delete', arg], check=True)
-
-
-def _get_delete_arg(range_list):
-    """Return 'a-b' when given ['a', ..., 'b']."""
-    if not range_list:
-        return None
-    elif len(range_list) == 1:
-        return range_list[0]
-    else:
-        return range_list[0] + '-' + range_list[-1]
-
-
 def subcommand_set_config(arguments):
     command = ['snapper', 'set-config'] + arguments.config.split()
     subprocess.run(command, check=True)

actions/storage

@@ -34,6 +34,10 @@ def parse_arguments():
     subparser.add_argument('device',
                            help='Partition which needs to be resized')
 
+    subparser = subparsers.add_parser('mount', help='Mount a filesystem')
+    subparser.add_argument('--block-device',
+                           help='Block device of the filesystem to mount')
+
     subparser = subparsers.add_parser('eject', help='Eject a storage device')
     subparser.add_argument('device', help='Path of the device to eject')
 
@@ -232,6 +236,26 @@ def _interpret_unit(value):
     return int(value)
 
 
+def subcommand_mount(arguments):
+    """Mount a disk are root user.
+
+    XXX: This is primarily to provide compatibility with older code that used
+    udiskie to auto-mount all partitions as root user under /media/root/
+    directory. We are setting special permissions for the directory /media/root
+    and users have set shared folders using this path. This can be removed in
+    favor of using DBus API once we have a migration plan in place. Disks can
+    be mounted directly /mount without ACL restrictions that apply to
+    /mount/<user> directories. This can be done by setting udev flag
+    UDISKS_FILESYSTEM_SHARED=1 by writing a udev rule.
+
+    """
+    process = subprocess.run([
+        'udisksctl', 'mount', '--block-device', arguments.block_device,
+        '--no-user-interaction'
+    ])
+    sys.exit(process.returncode)
+
+
 def subcommand_eject(arguments):
     """Eject a device by its path."""
     device_path = arguments.device

debian/changelog

@@ -1,3 +1,64 @@
+plinth (20.9) unstable; urgency=medium
+
+  [ Petter Reinholdtsen ]
+  * Translated using Weblate (Norwegian Bokmål)
+
+  [ James Valleroy ]
+  * snapshot: Set as essential module
+  * functional_tests: snapshot: Skip delete all when there are no snapshots
+  * quassel: Use systemd sandboxing features
+  * minidlna: Move sysctl config to /etc/sysctl.d/50-freedombox.conf
+  * upgrades: Add needrestart to restart services as needed
+  * upgrades: Enable Automatic-Reboot option of unattended-upgrades
+  * locale: Update translation strings
+  * doc: Fetch latest manual
+
+  [ Michael Breidenbach ]
+  * Translated using Weblate (German)
+  * Translated using Weblate (Swedish)
+
+  [ Fioddor Superconcentrado ]
+  * Folder remained unrenamed. Should have changed along with git links.
+
+  [ Sunil Mohan Adapa ]
+  * snapshot: Fix issues with restore and delete
+  * performance: Add basic functional tests
+  * daemon: Allow using an alias when enabling a daemon
+  * bind: Add daemon alias for bind9 -> named
+  * daemon: bind: cosmetic: yapf, isort formatting
+  * firewall: Reload firewalld so it works with newly installed services
+  * glib: Allow scheduling non-repeating tasks in separate threads
+  * notification: Expand and clarify restriction on id property
+  * storage: Auto-mount disks, notify of failing disks
+  * package: Fix error log when checking if package manager is busy
+  * power: cosmetic: Fix flake8 warnings
+  * first_setup: Fix regression with logo not showing
+  * minidlna: cosmetic: isort fixes
+  * mediawiki: Stop jobrunner during backup/restore
+  * minidlna: Stop daemon during backup/restore
+  * mumble: Stop server during backup/restore
+  * quassel: Fix stopping server during backup/restore
+  * tor: Fix stopping server during backup/restore
+  * upgrades: Always schedule a reboot at 02:00 local time
+  * upgrades: Add information about service restart and system reboot
+  * performance: Launch the Cockpit graphs directly if possible
+
+  [ Joseph Nuthalapati ]
+  * samba: Change description to Network File Storage
+  * functional-tests: Skip network setup wizard
+  * functional-tests: Move Disable tests to the end
+
+  [ fred1m ]
+  * performance: Add app for system monitoring
+
+  [ Luis A. Arizmendi ]
+  * Translated using Weblate (Spanish)
+
+  [ Artem ]
+  * Translated using Weblate (Russian)
+
+ -- James Valleroy <jvalleroy@mailbox.org>  Mon, 18 May 2020 19:42:49 -0400
+
 plinth (20.8~bpo10+1) buster-backports; urgency=medium
 
   * Rebuild for buster-backports.

debian/freedombox.preinst

@@ -19,6 +19,22 @@ case "$1" in
                 systemctl daemon-reload
             fi
         fi
+
+        # Handle removing freedombox-udiskie.service from 20.9.
+        if dpkg --compare-versions "$2" le 20.9; then
+            if [ -x "/usr/bin/deb-systemd-invoke" ]; then
+                deb-systemd-invoke stop freedombox-udiskie.service >/dev/null 2>/dev/null || true
+            fi
+
+            if [ -x "/usr/bin/deb-systemd-helper" ]; then
+                deb-systemd-helper purge freedombox-udiskie.service >/dev/null || true
+                deb-systemd-helper unmask freedombox-udiskie.service >/dev/null || true
+            fi
+
+            if [ -d /run/systemd/system ]; then
+                systemctl daemon-reload
+            fi
+        fi
         ;;
 esac
 

doc/manual/en/freedombox-manual.raw.xml

@@ -4,6 +4,12 @@
   <articleinfo>
     <title>FreedomBox/Manual</title>
     <revhistory>
+      <revision>
+        <revnumber>84</revnumber>
+        <date>2020-05-06 06:02:24</date>
+        <authorinitials>SunilMohanAdapa</authorinitials>
+        <revremark>Include Coturn app</revremark>
+      </revision>
       <revision>
         <revnumber>83</revnumber>
         <date>2020-05-04 07:46:54</date>
@@ -590,6 +596,8 @@
     <title>Quick Start</title>
     <section>
       <title>What you need to get started</title>
+      <para>The easy way is to <ulink url="https://freedomboxfoundation.org/buy/">buy</ulink> a FreedomBox kit. </para>
+      <para>Alternatively you may choose to build it yourself, by gathering all the components: </para>
       <itemizedlist>
         <listitem>
           <para>A supported <ulink url="https://wiki.debian.org/FreedomBox/Manual/FreedomBox/Hardware#">device</ulink> (including any device that can run Debian). We will call that the FreedomBox in the rest of this manual. </para>
@@ -885,7 +893,13 @@
   </section>
   <section>
     <title>Download and Install</title>
-    <para>Welcome to the FreedomBox download page. You may either install FreedomBox on one of the supported inexpensive <ulink url="https://wiki.debian.org/FreedomBox/Manual/FreedomBox/Hardware#">hardware</ulink> devices, on any Linux <ulink url="https://wiki.debian.org/FreedomBox/Manual/FreedomBox/Hardware/Debian#">Debian</ulink> operating system, or deploy it on a virtual machine. </para>
+    <para>Welcome to the FreedomBox download page. </para>
+    <itemizedlist>
+      <listitem override="none">
+        <para><emphasis role="strong">Note</emphasis>: If you purchased a FreedomBox kit this section is not meant for you, so you can just skip it entirely. (Unless you specifically want to build an alternative software image). </para>
+      </listitem>
+    </itemizedlist>
+    <para>You may either install FreedomBox on one of the supported inexpensive <ulink url="https://wiki.debian.org/FreedomBox/Manual/FreedomBox/Hardware#">hardware</ulink> devices, on any <ulink url="https://wiki.debian.org/FreedomBox/Manual/FreedomBox/Hardware/Debian#">Debian</ulink> operating system, or deploy it on a virtual machine. </para>
     <para>Installing on a machine running a Debian system is easy because FreedomBox is available as a package. We do recommend to install FreedomBox on a supported single board computer (SBC). The board will be dedicated for FreedomBox use from home, this will prevent a lot of risks, such as accidental misconfiguration by the user. In case of trouble deciding which hardware is best for you or during the installation, please use the <ulink url="https://wiki.debian.org/FreedomBox/Manual/FreedomBox/Support#">support page</ulink> or read the <ulink url="https://wiki.debian.org/FreedomBox/Manual/FreedomBox/QuestionsAndAnswers#">Questions and Answers</ulink> page based on posts on the <ulink url="https://lists.alioth.debian.org/mailman/listinfo/freedombox-discuss">Freedombox-discuss</ulink> mailing list archives. </para>
     <section>
       <title>Downloading on Debian</title>
@@ -1571,13 +1585,13 @@ dd if=temp/usr/lib/u-boot/A20-OLinuXino-Lime2/u-boot-sunxi-with-spl.bin of=<lime
       </section>
       <section>
         <title>Synchronizing over Tor</title>
-        <para>In Plinth, setting up a calendar with Radicale over Tor is the same as over the clear net. Here is a short summary: </para>
+        <para>In FreedomBox, setting up a calendar with Radicale over Tor is the same as over the clear net. Here is a short summary: </para>
         <orderedlist numeration="arabic">
           <listitem>
-            <para>When logged in to Plinth over Tor, click on Radicale, and at the prompt provide your <ulink url="https://wiki.debian.org/FreedomBox/Manual/FreedomBox#">FreedomBox</ulink> user name and password.  </para>
+            <para>When logged in to FreedomBox interface over Tor, click on Radicale, and at the prompt provide your FreedomBox user name and password.  </para>
           </listitem>
           <listitem>
-            <para>In the Radicale web interface, log in using your <ulink url="https://wiki.debian.org/FreedomBox/Manual/FreedomBox#">FreedomBox</ulink> user name and password. </para>
+            <para>In the Radicale web interface, log in using your FreedomBox user name and password. </para>
           </listitem>
           <listitem>
             <para>Click on "Create new address book or calendar", provide a title, select a type, and click "Create". </para>
@@ -1601,10 +1615,10 @@ dd if=temp/usr/lib/u-boot/A20-OLinuXino-Lime2/u-boot-sunxi-with-spl.bin of=<lime
             <para>Select CalDAV and for the location copy the URL, e.g., <code>https://</code><emphasis>ONION-ADDRESS-FOR-YOUR-SERVER</emphasis><code>.onion/radicale/</code><emphasis>USERNAME</emphasis><code>/</code><emphasis>CALENDAR-CODE</emphasis><code>/</code>. Items in <emphasis>italics</emphasis> need to be changed to match your settings. </para>
           </listitem>
           <listitem>
-            <para>Provide a name, etc. Click "Next". Your calendar is now syncing with your <ulink url="https://wiki.debian.org/FreedomBox/Manual/FreedomBox#">FreedomBox</ulink> over Tor. </para>
+            <para>Provide a name, etc. Click "Next". Your calendar is now syncing with your FreedomBox over Tor. </para>
           </listitem>
           <listitem>
-            <para>If you have not generated a certificate for your <ulink url="https://wiki.debian.org/FreedomBox/Manual/FreedomBox#">FreedomBox</ulink> with "Let's Encrypt", you may need to select "Confirm Security Exception" when prompted. </para>
+            <para>If you have not generated a certificate for your FreedomBox with "Let's Encrypt", you may need to select "Confirm Security Exception" when prompted. </para>
           </listitem>
         </orderedlist>
       </section>
@@ -2036,8 +2050,8 @@ echo "UPDATE users SET admin=1 WHERE name='@username:domainname'" | sudo sqlite3
       </section>
     </section>
     <section>
-      <title>File Synchronization (Samba)</title>
-      <para>Samba lets you have a shared folder over the local network that can be used from multiple computers running different operating systems. We will henceforth refer to these shared folders as "shares".  </para>
+      <title>Network File Storage (Samba)</title>
+      <para>Samba lets you have shared folders over the local network that can be used from multiple computers running different operating systems. We refer to these shared folders as "shares".  </para>
       <para>You can have a personal folder shared between your own devices (Home share), a folder shared with a trusted group (Group share) or one that is shared with every device on the network (Open share). </para>
       <para>Samba lets you to treat a share as if it's a local folder on your computer. However, shares are available only on the local network. </para>
       <para>To learn more about Samba, please refer to the <ulink url="https://wiki.samba.org/index.php/User_Documentation">user documentation</ulink> on their wiki. </para>
@@ -2093,7 +2107,7 @@ echo "UPDATE users SET admin=1 WHERE name='@username:domainname'" | sudo sqlite3
         <title>How to setup Quassel?</title>
         <itemizedlist>
           <listitem>
-            <para>Within Plinth </para>
+            <para>Within FreedomBox's web interface </para>
             <orderedlist numeration="arabic">
               <listitem>
                 <para>select <emphasis>Applications</emphasis> </para>
@@ -2135,10 +2149,10 @@ echo "UPDATE users SET admin=1 WHERE name='@username:domainname'" | sudo sqlite3
                 <para>
                   <inlinemediaobject>
                     <imageobject>
-                      <imagedata fileref="https://wiki.debian.org/FreedomBox/Manual/Quassel?action=AttachFile&amp;do=get&amp;target=Quassel_PortForwarding.png"/>
+                      <imagedata fileref="https://wiki.debian.org/FreedomBox/Manual/Quassel?action=AttachFile&amp;do=get&amp;target=Quassel_PortForwarding_en_v01.png"/>
                     </imageobject>
                     <textobject>
-                      <phrase>Quassel_PortForwarding.png</phrase>
+                      <phrase>Quassel_PortForwarding_en_v01.png</phrase>
                     </textobject>
                   </inlinemediaobject>
                 </para>
@@ -2936,6 +2950,28 @@ $ sudo nmcli connection import type openvpn file /path/to/<USER>.ovpn]]></screen
 echo "newpassword" | su mumble-server -s /bin/sh -c "/usr/sbin/murmurd -ini /etc/mumble-server.ini --readsupw"]]></screen>
       </section>
     </section>
+    <section>
+      <title>VoIP Helper (Coturn)</title>
+      <para>Coturn is a server to facilitate audio/video calls and conferences by providing an implementation of TURN and STUN protocols. WebRTC, SIP and other communication servers can use it to establish a call between parties who are otherwise unable connect to each other. </para>
+      <para>It is not meant to be used directly by users. Servers such as Matrix Synapse need to be configured with the details provided on the Coturn app page. Apart from Matrix Synapse, Jitsi, Ejabberd, Nextcloud Talk, etc. can use Coturn server for audio/video calls and conferences. There is no need for the servers to be running on the same machine as FreedomBox and external servers can use Coturn running on FreedomBox. </para>
+      <para>Coturn is available in FreedomBox since version 20.8 as an advanced app. This means that you need to check "Show advanced apps and features" in "General Configuration" to see Coturn icon in the "Apps" section. </para>
+      <section>
+        <title>How it works</title>
+        <para>When making an audio/video call, it is best to route the media streams between two peers directly. This will give the best possible latency (better signal quality) and avoid depending on a centralized server (privacy). It scales well because a simple chat server can host thousands of calls without involving the server in any way other than to setup the call. However, this approach does not work most of the time to due to how networks are configured. Most peers on the network do not have a unique IP address allocated to them. They work hidden behind a network device that performs "Network Address Translation" (NAT) for them. This means that the two peers have no way of reaching each other. </para>
+        <para>To address this problem, a simple technique known as STUN was introduced. With the help of a third party STUN server, the peers can trick the NAT devices, to carry the traffic between the two peers. Unfortunately, this trick only works about 80% of the time. So, if STUN fails, peers have no choice but to route their traffic through an intermediary server called TURN server. All the mechanism of trying out STUN first and then falling back to TURN is described in a protocol known as ICE. </para>
+        <para>On FreedomBox, Coturn provides both STUN and TURN servers. Both services are provided over TCP as well as UDP. They are provided on unencrypted as well as encrypted channels (with have a higher chance of success). Since STUN servers are very inexpensive and don't consume a lot of server resources, there is no authentication needed to use them. TURN servers on the other hand need authentication. This authentication is highly simplified and does not require maintaining a database of users. A server such as matrix-synapse which is about to setup an audio/video call between two peers will generate a username and password using a shared secret. When the peers use the TURN server, they will be validated using these credentials because the TURN server also knows the same secret. </para>
+        <para>In summary, a communication server needs to know the URLs of the STUN/TURN servers along with a shared authentication secret for TURN. After that, during audio/video call setup, they will correctly guide the peers to use STUN/TURN servers. Coturn app in FreedomBox provides exactly this information. This information can be used to configure a communication server irrespective of whether it is running on the same FreedomBox or on another server. </para>
+      </section>
+      <section>
+        <title>Configuring Matrix Synapse</title>
+        <para>Matrix Synapse server in FreedomBox can be configured to use Coturn TURN/STUN server. In future, when you install Matrix Synapse, FreedomBox will automatically install Coturn and configure its parameters into Matrix Synapse. To configure Matrix Synapse, edit the file <emphasis>/etc/matrix-synapse/homeserver.yaml</emphasis> with the following lines: </para>
+        <screen><![CDATA[turn_uris: [ "stun:myfreedombox.example.org:3478?transport=udp", "stun:myfreedombox.example.org:3478?transport=tcp", "turn:myfreedombox.example.org:3478?transport=udp", "turn:myfreedombox.example.org:3478?transport=tcp" ]
+turn_shared_secret: "my-freedombox-provided-secret"
+turn_user_lifetime: 86400000
+turn_allow_guests: True]]></screen>
+        <para>And then restart matrix-synapse server by disabling and re-enabling the matrix-synapse app. </para>
+      </section>
+    </section>
     <section>
       <title>Web Proxy (Privoxy)</title>
       <para>A web proxy acts as a filter for incoming and outgoing web traffic. Thus, you can instruct any computer in your network to pass internet traffic through the proxy to remove unwanted ads and tracking mechanisms. </para>
@@ -6690,22 +6726,15 @@ nmcli con modify "<connection_name>" connection.zone internal]]></screen>
     </section>
     <section>
       <title>Performance (cockpit-pcp)</title>
-      <itemizedlist>
-        <listitem>
-          <para>Cockpit support for reading PCP metrics and loading PCP archives. </para>
-        </listitem>
-        <listitem>
-          <para>Performance Co-Pilot (PCP) is a framework and services to support system-level performance monitoring and performance management. </para>
-        </listitem>
-      </itemizedlist>
-      <para>When this system app is installed and enabled, cockpit's graphs show the past (up to one week). </para>
+      <para>Performance app allows you to collect, store and view information about utilization of the hardware. This can gives you basic insights into usage patterns and whether the hardware is overloaded by users and services. </para>
+      <para>Performance metrics are collected by Performance Co-Pilot and can be viewed using the Cockpit app. Performance app is available in FreedomBox since version 20.9. When this system app is installed and enabled, cockpit's graphs shows the past (up to one year at a time). </para>
       <para>
         <inlinemediaobject>
           <imageobject>
-            <imagedata fileref="https://wiki.debian.org/FreedomBox/Manual/Performance?action=AttachFile&amp;do=get&amp;target=one-week.png"/>
+            <imagedata fileref="https://wiki.debian.org/FreedomBox/Manual/Performance?action=AttachFile&amp;do=get&amp;target=performance-one-week.png"/>
           </imageobject>
           <textobject>
-            <phrase>one-week.png</phrase>
+            <phrase>performance-one-week.png</phrase>
           </textobject>
         </inlinemediaobject>
       </para>
@@ -8069,7 +8098,7 @@ Password: <enter user password here>
     </section>
     <section>
       <title>Pioneer Edition FreedomBox</title>
-      <para>Pioneer FreedomBox Home Servers are produced and sold by Olimex, a company which specializes in Open Source Hardware. The kit includes pocket-sized server hardware, an SD card with the operating system pre-installed, and a backup battery which can power the hardware for 4-5 hours in case of outages. It sells for 82 euro. By purchasing this product, you also support the FreedomBox Foundation's efforts to create and promote its free and open source server software. </para>
+      <para>Pioneer FreedomBox Home Servers are produced and sold by Olimex, a company which specializes in Open Source Hardware (OSHW). The kit includes pocket-sized server hardware, an SD card with the operating system pre-installed, and a backup battery which can power the hardware for 4-5 hours in case of outages. It sells for 82 euro. An optional storage add-on for high capacity hard disk (HDD) or solid-state drive (SSD) is also available from Olimex.  By purchasing this product, you also support the FreedomBox Foundation's efforts to create and promote its free and open source server software. </para>
       <para>
         <inlinemediaobject>
           <imageobject>
@@ -8102,6 +8131,9 @@ Password: <enter user password here>
           <listitem>
             <para>an Ethernet cable. </para>
           </listitem>
+          <listitem>
+            <para>an optional storage add-on for hard disk (HDD) or solid-state drive (SSD) </para>
+          </listitem>
         </itemizedlist>
       </section>
       <section>
@@ -8125,6 +8157,7 @@ Password: <enter user password here>
       </section>
       <section>
         <title>Hardware Specifications</title>
+        <para>Pioneer Edition FreedomBox Home Server is based on A20-OLinuXino-LIME2 Rev.G. </para>
         <itemizedlist>
           <listitem>
             <para>Open Source Hardware (OSHW): <ulink url="https://github.com/OLIMEX/OLINUXINO/tree/master/HARDWARE">Yes</ulink> </para>
@@ -8138,6 +8171,12 @@ Password: <enter user password here>
           <listitem>
             <para>Storage: 32GB class 10+ microSD card pre-loaded with FreedomBox </para>
           </listitem>
+          <listitem>
+            <para>SATA: 1 SATA port 2.6 compliant 3Gb/s </para>
+          </listitem>
+          <listitem>
+            <para>USB: 2 USB 2.0 Hi-Speed host ports </para>
+          </listitem>
           <listitem>
             <para>Battery: 3.3V Li-Po, 1400mAh (4-5 hours of backup without additional devices connected via USB) </para>
           </listitem>
@@ -8147,12 +8186,70 @@ Password: <enter user password here>
           <listitem>
             <para>Power adapter: 110-220 V input, 5V output, EU style (with optional UK or US sockets) </para>
           </listitem>
+          <listitem>
+            <para>Power consumption: 1.5W and 5W depending on load (0.3A to 1A current) </para>
+          </listitem>
           <listitem>
             <para>Box: Custom metallic box with FreedomBox decal </para>
           </listitem>
         </itemizedlist>
+        <para>Further information: </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <ulink url="https://www.olimex.com/Products/OLinuXino/Home-Server/Pioneer-FreedomBox-HSK/open-source-hardware">Quick start leaflet</ulink>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <ulink url="https://www.olimex.com/Products/OLinuXino/Home-Server/Pioneer-FreedomBox-HSK/open-source-hardware">Hardware source files</ulink>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <ulink url="https://www.olimex.com/Products/OLinuXino/Home-Server/Pioneer-FreedomBox-HSK/open-source-hardware">A20-OLinuXino-LIME2 rev.G schematic</ulink>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <ulink url="http://dl.linux-sunxi.org/A20/A20%20Brief%202013-02-27.pdf">A20 SOC datasheet</ulink>
+            </para>
+          </listitem>
+        </itemizedlist>
         <para>The kits run entirely on Free Software. They work with Kernel and u-boot from Debian repositories. Even the boot firmware in ROM called <ulink url="https://linux-sunxi.org/BROM">BROM</ulink> is free software (GPLV2+). </para>
       </section>
+      <section>
+        <title>Storage Add-on</title>
+        <para>You can order a storage add-on along with the Pioneer Edition FreedomBox Home Server. The storage add-on is a SATA disk drive enclosure case optionally with a hard disk or solid-state drive of size 128GB to 2000GB. If you have already purchased the Home Server without the add-on, you can order the add-on separately. </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <ulink url="https://www.olimex.com/Products/OLinuXino/Home-Server/BAY-HDD-1000GB/">Olimex Store</ulink>
+            </para>
+          </listitem>
+          <listitem>
+            <para>Price: 9 EUR (without the hard disk, only for the case, you need to add your own HDD/SSD to it) </para>
+          </listitem>
+          <listitem>
+            <para>Price: 42 EUR (with 128GB Solid-State Drive) </para>
+          </listitem>
+          <listitem>
+            <para>Price: 69 EUR (with 512GB Solid-State Drive) </para>
+          </listitem>
+          <listitem>
+            <para>Price: 42 EUR (with 320GB Hard Disk) </para>
+          </listitem>
+          <listitem>
+            <para>Price: 53 EUR (with 500GB Hard Disk) </para>
+          </listitem>
+          <listitem>
+            <para>Price: 64 EUR (with 1000GB Hard Disk) </para>
+          </listitem>
+          <listitem>
+            <para>Price: 86 EUR (with 2000GB Hard Disk) </para>
+          </listitem>
+        </itemizedlist>
+      </section>
       <section>
         <title>Download</title>
         <para>The kits come with an SD card pre-loaded with FreedomBox. There's <emphasis role="strong">NO need to download images</emphasis>. </para>
@@ -10184,6 +10281,78 @@ wget https://www.thinkpenguin.com/files/ath9k_firmware_free-version/htc_7010.fw]
     <section>
       <title>Release Notes</title>
       <para>The following are the release notes for each FreedomBox version. </para>
+      <section>
+        <title>FreedomBox 20.9 (2020-05-18)</title>
+        <section>
+          <title>Top Highlights</title>
+          <itemizedlist>
+            <listitem>
+              <para>performance: Add app for system monitoring </para>
+            </listitem>
+            <listitem>
+              <para>upgrades: Restart services and system when needed after upgrades </para>
+              <itemizedlist>
+                <listitem>
+                  <para>System restart will happen at 02:00 local time </para>
+                </listitem>
+              </itemizedlist>
+            </listitem>
+          </itemizedlist>
+        </section>
+        <section>
+          <title>Other Changes</title>
+          <itemizedlist>
+            <listitem>
+              <para>bind: Add service alias for bind9 -&gt; named </para>
+            </listitem>
+            <listitem>
+              <para>firewall: Reload firewalld so it works with newly installed services </para>
+            </listitem>
+            <listitem>
+              <para>first_setup: Fix regression with logo not showing </para>
+            </listitem>
+            <listitem>
+              <para>locale: Update translations for Norwegian Bokmål, German, Swedish, Spanish, and Russian </para>
+            </listitem>
+            <listitem>
+              <para>mediawiki: Stop jobrunner during backup/restore </para>
+            </listitem>
+            <listitem>
+              <para>minidlna: Stop service during backup/restore </para>
+            </listitem>
+            <listitem>
+              <para>mumble: Stop service during backup/restore </para>
+            </listitem>
+            <listitem>
+              <para>package: Fix error log when checking if package manager is busy </para>
+            </listitem>
+            <listitem>
+              <para>performance: Launch the Cockpit graphs directly if possible </para>
+            </listitem>
+            <listitem>
+              <para>quassel: Fix stopping service during backup/restore </para>
+            </listitem>
+            <listitem>
+              <para>quassel: Use systemd sandboxing features </para>
+            </listitem>
+            <listitem>
+              <para>samba: Change description to Network File Storage </para>
+            </listitem>
+            <listitem>
+              <para>snapshot: Fix issues with restore and delete </para>
+            </listitem>
+            <listitem>
+              <para>snapshot: Set as essential module </para>
+            </listitem>
+            <listitem>
+              <para>storage: Auto-mount disks, notify of failing disks </para>
+            </listitem>
+            <listitem>
+              <para>tor: Fix stopping service during backup/restore </para>
+            </listitem>
+          </itemizedlist>
+        </section>
+      </section>
       <section>
         <title>FreedomBox 20.8 (2020-05-04)</title>
         <itemizedlist>