Release v24.2~bpo12+1 to bookworm-backports

Signed-off-by: James Valleroy <jvalleroy@mailbox.org>

.ci/Containerfile.functional-tests-stable

@@ -1,40 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-FROM debian:stable
-
-CMD /sbin/init
-USER root:root
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN echo "deb http://deb.debian.org/debian trixie-backports main" > /etc/apt/sources.list.d/backports.list; echo "deb-src http://deb.debian.org/debian trixie-backports main" >> /etc/apt/sources.list.d/backports.list
-
-RUN apt-get update
-
-# Update all packages
-RUN apt-get dist-upgrade -y
-
-# Install freedombox package so that plint:plinth user/group are created etc.
-RUN apt-get install -y freedombox/trixie-backports
-RUN systemctl disable plinth.service
-
-# Don't ask for the secret in first wizard
-RUN rm -f /var/lib/plinth/firstboot-wizard-secret
-
-# Dependencies of the freedombox Debian package
-RUN apt-get build-dep -y freedombox/trixie-backports
-
-# Build and test dependencies
-RUN apt-get install -y \
-    build-essential \
-    parted \
-    sshpass \
-    wget
-
-
-# Install functional test dependencies
-ADD https://salsa.debian.org/freedombox-team/freedombox/-/raw/main/plinth/tests/functional/install.sh /usr/src/install.sh
-RUN bash /usr/src/install.sh; rm -f /usr/src/install.sh
-
-# Allow daemons to start when container is started
-RUN rm -f /usr/sbin/policy-rc.d

.ci/Dockerfile.gitlabci

@@ -19,11 +19,10 @@ RUN apt-get build-dep -y .
 RUN apt-get install -y build-essential \
     # Test dependencies
     sshpass parted \
-    sudo python3-pip \
-    python3-flake8
+    sudo python3-pip
 
 # Module dependencies
 RUN apt-get install -y $(./run --list-dependencies)
 
 # Coverage should know that test_functional.py files are tests
-RUN pip3 install --break-system-packages splinter
+RUN pip3 install --break-system-packages splinter pytest-bdd

.ci/functional-tests.yml

@@ -1,27 +1,66 @@
 ---
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
-.run-functional-tests:
+.app-server:
   stage: functional-tests
-  needs: []
   dependencies: []
-  tags:
-    - functional-tests
-  timeout: 10h
-  # Need to find another way of running the cleanup step even on failure
-  allow_failure: true
   except:
     - $GITLAB_USER_LOGIN == "weblate"
+  script:
+    - BUILD_JOB_ID=$(curl -s "https://salsa.debian.org/api/v4/projects/$CI_PROJECT_ID/pipelines/$CI_PIPELINE_ID/jobs?scope[]=success" | jq -r '.[] | select(.name==env.BUILD_JOB_NAME) | .id')
+    - export AWS_DEFAULT_REGION=us-east-1
+    - |
+      aws lambda invoke --function-name launch_app_server --payload '{"launch_template_name": "'"$LAUNCH_TEMPLATE_NAME"'", "instance_name": "'"$INSTANCE_NAME"'", "ci_project_id": "'"$CI_PROJECT_ID"'", "build_job_id": "'"$BUILD_JOB_ID"'"}' response.json
+    - echo "APP_SERVER_IP_1=$(jq -r '.app_server_ip' response.json)" >> app-servers.env
+    - echo "INSTANCE_ID_1=$(jq -r '.instance_id' response.json)" >> app-servers.env
+    - |
+      aws lambda invoke --function-name launch_app_server --payload '{"launch_template_name": "'"$LAUNCH_TEMPLATE_NAME"'", "instance_name": "'"$INSTANCE_NAME"'", "ci_project_id": "'"$CI_PROJECT_ID"'", "build_job_id": "'"$BUILD_JOB_ID"'"}' response.json
+    - echo "APP_SERVER_IP_2=$(jq -r '.app_server_ip' response.json)" >> app-servers.env
+    - echo "INSTANCE_ID_2=$(jq -r '.instance_id' response.json)" >> app-servers.env
+  tags:
+    - functional-tests
+  artifacts:
+    reports:
+      dotenv: app-servers.env
+
+.run-functional-tests:
+  stage: functional-tests
+  timeout: 3h
+  # Need to find another way of running the cleanup step even on failure
+  allow_failure: true
+  when: delayed
+  # Wait for the app-server to come up. Saves time for the CI runners.
+  start_in: 3 minutes
   before_script:
     - apt-get update
-    - apt-get -y install make
-    - make provision-dev
-    - make wait-while-first-setup
+    - apt-get install -y sudo curl wget
+    - ./plinth/tests/functional/install.sh
+    - adduser tester --gecos "First Last,RoomNumber,WorkPhone,HomePhone" --disabled-password && echo "tester:password" | chpasswd
   script:
-    - FREDOMBOX_URL=https://localhost FREEDOMBOX_SSH_PORT=22 FREEDOMBOX_SAMBA_PORT=445 pytest -v --durations=10 --include-functional --splinter-headless --instafail --template=html1/index.html --report=functional-tests.html
+    - cp -r . /home/tester/freedombox && chown -R tester:tester /home/tester/freedombox
+    - |
+      sudo APP_SERVER_URL_1="https://$APP_SERVER_IP_1" APP_SERVER_URL_2="https://$APP_SERVER_IP_2" -u tester bash -c \
+        'cd /home/tester/freedombox && py.test-3 -v --durations=10 --include-functional --splinter-headless -n 2 --dist=loadscope --template=html1/index.html --report=functional-tests.html'
+  after_script:
+    - echo "INSTANCE_ID_1=$INSTANCE_ID_1" >> app-servers.env
+    - echo "INSTANCE_ID_2=$INSTANCE_ID_2" >> app-servers.env
+    - cp /home/tester/freedombox/functional-tests.html .
+    - cp -r /home/tester/freedombox/screenshots/ .
   artifacts:
     when: always
+    reports:
+      dotenv: app-servers.env
     paths:
       - functional-tests.html
       - screenshots/
-      - plinth.log
+
+# Does not run if the previous job times out or is cancelled
+.terminate-app-server:
+  stage: functional-tests
+  script:
+    - export AWS_DEFAULT_REGION=us-east-1
+    - |
+      aws lambda invoke --function-name terminate_app_server --payload '{"instance_id": "'"$INSTANCE_ID_1"'"}' response.json
+      aws lambda invoke --function-name terminate_app_server --payload '{"instance_id": "'"$INSTANCE_ID_2"'"}' response.json
+  tags:
+    - functional-tests

.ci/gitlab-runner/config.toml

@@ -1,21 +0,0 @@
-concurrent = 1
-check_interval = 0
-
-[[runners]]
-  name = "freedombox-functional"
-  url = "https://salsa.debian.org"
-  token = "<insert-server-provided-token-here>"
-  executor = "custom"
-  builds_dir = "/freedombox"
-  cache_dir = "/cache"
-  [runners.custom]
-    prepare_exec = "/var/lib/fbx-functional/bin/prepare.sh"
-    prepare_exec_timeout = 1200
-
-    run_exec = "/var/lib/fbx-functional/bin/run.sh"
-
-    cleanup_exec = "/var/lib/fbx-functional/bin/cleanup.sh"
-    cleanup_exec_timeout = 1200
-
-    graceful_kill_timeout = 200
-    force_kill_timeout = 200

.ci/gitlab-runner/custom-driver/README

@@ -1,7 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-This directory contains a custom driver for Gitlab-CI Runner. This is used to
-run functional tests.
-
-Based on https://docs.gitlab.com/runner/executors/custom_examples/lxd.html under
-Expat license.

.ci/gitlab-runner/custom-driver/base.sh

@@ -1,4 +0,0 @@
-#!/usr/bin/bash
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-CONTAINER_ID="runner-$CUSTOM_ENV_CI_RUNNER_ID-project-$CUSTOM_ENV_CI_PROJECT_ID-concurrent-$CUSTOM_ENV_CI_CONCURRENT_PROJECT_ID-$CUSTOM_ENV_CI_JOB_ID"

.ci/gitlab-runner/custom-driver/cleanup.sh

@@ -1,10 +0,0 @@
-#!/usr/bin/bash
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-current_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
-source ${current_dir}/base.sh # Get variables from base.
-
-echo "Deleting container $CONTAINER_ID"
-
-podman container stop "$CONTAINER_ID"
-podman container rm -f "$CONTAINER_ID"

.ci/gitlab-runner/custom-driver/prepare.sh

@@ -1,48 +0,0 @@
-#!/usr/bin/bash
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-current_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
-source ${current_dir}/base.sh # Get variables from base.
-
-set -eo pipefail
-
-# trap any error, and mark it as a system failure.
-trap "exit $SYSTEM_FAILURE_EXIT_CODE" ERR
-
-start_container () {
-    if podman container exists "$CONTAINER_ID" ; then
-        echo 'Found old container, deleting'
-        podman container stop "$CONTAINER_ID"
-        podman container rm -f "$CONTAINER_ID"
-    fi
-
-    podman pull registry.salsa.debian.org/freedombox-team/freedombox:functional-tests-stable
-    podman run --name "$CONTAINER_ID" --systemd=always \
-           --privileged \
-           --cap-add=SYS_ADMIN --cap-add=NET_ADMIN --cap-add=MKNOD \
-           --detach registry.salsa.debian.org/freedombox-team/freedombox:functional-tests-stable /sbin/init
-
-    if podman exec "$CONTAINER_ID" systemctl is-system-running --wait; then
-        echo 'Container started.'
-    else
-        echo 'Container started degraded.'
-    fi
-}
-
-install_dependencies () {
-    podman exec "$CONTAINER_ID" /usr/bin/bash <<EOF
-set -eo pipefail
-echo 'Package: *' > /etc/apt/preferences.d/unstable
-echo 'Pin: release a=unstable' >> /etc/apt/preferences.d/unstable
-echo 'Pin-Priority: 400'  >> /etc/apt/preferences.d/unstable
-echo 'deb http://deb.debian.org/debian unstable main' > /etc/apt/sources.list.d/unstable.list
-apt-get update
-DEBIAN_FRONTEND=noninteractive apt-get install -y gitlab-runner git-lfs
-EOF
-}
-
-echo "Running in $CONTAINER_ID"
-
-start_container
-
-install_dependencies

.ci/gitlab-runner/custom-driver/run.sh

@@ -1,14 +0,0 @@
-#!/usr/bin/bash
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-set -eo pipefail
-
-current_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
-source ${current_dir}/base.sh # Get variables from base.
-
-podman exec --interactive "$CONTAINER_ID" /bin/bash < "${1}"
-if [ $? -ne 0 ]; then
-    # Exit using the variable, to make the build as failure in GitLab
-    # CI.
-    exit $BUILD_FAILURE_EXIT_CODE
-fi

.ci/update-container-image.sh

@@ -1,11 +0,0 @@
-#! /bin/bash
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-CONTAINER=$1
-CONTAINER="${CONTAINER:-gitlabci}"
-
-podman login registry.salsa.debian.org
-
-# Build and upload a new image to the container registry
-podman build -t registry.salsa.debian.org/freedombox-team/freedombox:${CONTAINER} -f .ci/Containerfile.${CONTAINER} .
-podman push registry.salsa.debian.org/freedombox-team/freedombox:${CONTAINER}

.ci/update-gitlabci-docker-image.sh

@@ -0,0 +1,8 @@
+#! /bin/bash
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+docker login registry.salsa.debian.org
+
+# Build and upload a new image to the container registry
+DOCKER_BUILDKIT=1 docker build -t registry.salsa.debian.org/freedombox-team/freedombox:gitlabci -f .ci/Dockerfile.gitlabci .
+docker push registry.salsa.debian.org/freedombox-team/freedombox:gitlabci

.gitignore

@@ -4,7 +4,7 @@
 doc/manual/*/*.pdf
 doc/manual/*/*.html
 doc/manual/*/*.xml
-doc/*.1
+doc/plinth.1
 doc/dev/_build
 \#*
 .#*

.gitlab-ci.yml

@@ -16,25 +16,31 @@ code-quality:
   stage: test
   needs: []
   script:
-    - make check-code
+    - python3 -m flake8 container plinth actions/*
 
 static-type-check:
   stage: test
   needs: []
+  before_script:
+    - apt-get update
+    - apt-get install -y mypy
   script:
-    - make check-type
+    - mypy .
 
 unit-tests:
   stage: test
   needs: []
   before_script:
-    - make provision-dev
+    - export DEBIAN_FRONTEND=noninteractive
+    - apt-get update
+    - apt-get build-dep -y .  # Dependencies of the freedombox Debian package
+    - apt-get install -y $(./run --list-dependencies)  # Module dependencies
   script:
     - adduser tester --gecos "First Last,RoomNumber,WorkPhone,HomePhone" --disabled-password
     - echo "tester:password" | chpasswd
     - cp -r . /home/tester/plinth
     - chown -R tester:tester /home/tester/plinth
-    - su -c "cd ~/plinth; make check-tests-cov" tester
+    - su -c "cd ~/plinth;PYTHONPATH='.' py.test-3 --cov=plinth --cov-report=html:/home/tester/plinth/htmlcov --cov-report=term" tester
     - cp -r /home/tester/plinth/htmlcov test-coverage-report
   coverage: '/^TOTAL\s+.*\s+(\d+\.\d+%)$/'
   artifacts:
@@ -45,18 +51,75 @@ doc-tests:
   stage: test
   needs: []
   script:
-    - make check-doc
+    - doc/scripts/wikiparser.py
+
+app-server-stable:
+  variables:
+    LAUNCH_TEMPLATE_NAME: functional-tests-stable
+    INSTANCE_NAME: app-server-stable
+    BUILD_JOB_NAME: build-backports
+  extends: .app-server
 
 run-functional-tests-stable:
+  needs:
+    - job: app-server-stable
+      artifacts: true
   extends: .run-functional-tests
 
+terminate-app-server-stable:
+  needs:
+    - job: run-functional-tests-stable
+      artifacts: true
+  extends: .terminate-app-server
+
+app-server-testing:
+  variables:
+    LAUNCH_TEMPLATE_NAME: functional-tests-testing
+    INSTANCE_NAME: app-server-testing
+    BUILD_JOB_NAME: build
+  extends: .app-server
+
+run-functional-tests-testing:
+  needs:
+    - job: app-server-testing
+      artifacts: true
+  extends: .run-functional-tests
+
+terminate-app-server-testing:
+  needs:
+    - job: run-functional-tests-testing
+      artifacts: true
+  extends: .terminate-app-server
+
+app-server-unstable:
+  variables:
+    LAUNCH_TEMPLATE_NAME: functional-tests-unstable
+    INSTANCE_NAME: app-server-unstable
+    BUILD_JOB_NAME: build
+  extends: .app-server
+
+run-functional-tests-unstable:
+  needs:
+    - job: app-server-unstable
+      artifacts: true
+  extends: .run-functional-tests
+
+terminate-app-server-unstable:
+  needs:
+    - job: run-functional-tests-unstable
+      artifacts: true
+  extends: .terminate-app-server
+
+extract-source:
+    extends: .provisioning-extract-source
+
 build:
     extends: .build-package
 
 build-backports:
     extends: .build-package
     variables:
-      RELEASE: trixie-backports
+      RELEASE: bookworm-backports
 
 build i386:
     extends: .build-package-i386
@@ -79,9 +142,8 @@ lintian:
 
 # autopkgtest is flaky due to
 # https://salsa.debian.org/freedombox-team/freedombox/-/issues/2077
-autopkgtest:
-    extends: .test-autopkgtest
-    allow_failure: true
+#autopkgtest:
+#    extends: .test-autopkgtest
 
 blhc:
     extends: .test-blhc

.vagrant-scripts/plinth-user-permissions.py

@@ -0,0 +1,16 @@
+#!/usr/bin/python3
+# -*- mode: python -*-
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""Set required permissions for user "plinth" to run plinth in dev setup."""
+
+import pathlib
+
+content = '''
+Cmnd_Alias FREEDOMBOX_ACTION_DEV = /usr/share/plinth/actions/actions, /freedombox/actions/actions
+Defaults!FREEDOMBOX_ACTION_DEV closefrom_override
+plinth ALL=(ALL:ALL) NOPASSWD:SETENV : FREEDOMBOX_ACTION_DEV
+fbx    ALL=(ALL:ALL) NOPASSWD : ALL
+'''
+
+sudoers_file = pathlib.Path('/etc/sudoers.d/01-freedombox-development')
+sudoers_file.write_text(content)

CONTRIBUTING.md

@@ -34,8 +34,8 @@ Naming conventions:
   tools `yapf` and `isort`. Please check also with `flake8`.
 * Please include one single feature per merge request, to keep the review simple
   and focused on one topic. (This might still mean hundreds of lines of code.)
-  Use a branch other than `main`, so you can create multiple merge requests
-  and still keep merging from `main`. Depending on the complexity of your
+  Use a branch other than `master`, so you can create multiple merge requests
+  and still keep merging from `master`. Depending on the complexity of your
   merge request, it may take a while until it is reviewed and merged.
 * Keep your commits organized logically and as small as possible. If commit B
   fixes a mistake in commit A, both of which are part of the same merge request,

COPYING.md

@@ -1,9 +1,9 @@
 # License to Copy FreedomBox Service (Plinth)
 
-FreedomBox Service (Plinth) is Copyright 2011, 2012, 2013, 2014, 2015, 2016,
-2017, 2018, 2019, 2020, 2021, 2022, 2023, 2024, 2025 FreedomBox Authors. See Git
-log in the source repository for a full list of authors. It is distributed under
-the GNU Affero General Public License, Version 3 or later. A copy of AGPLv3 is
+FreedomBox Service (Plinth) is Copyright 2011, 2012, 2013, 2014, 2015,
+2016, 2017, 2018, 2019 FreedomBox Authors. See Git log in the source
+repository for a full list of authors. It is distributed under the GNU
+Affero General Public License, Version 3 or later. A copy of AGPLv3 is
 available [from the Free Software
 Foundation](http://www.gnu.org/licenses/agpl.html).
 

HACKING.md

@@ -66,7 +66,7 @@ development environment inside a systemd-nspawn container.
     folder: (This step requires at least 16GB of free disk space)
 
     ```bash
-    host$ ./container start
+    host$ ./container up
     ```
 
 1. To run unit tests:
@@ -97,43 +97,23 @@ development environment inside a systemd-nspawn container.
    1. Using an environment variable.
 
    ```bash
-   host$ DISTRIBUTION=stable ./container start
+   host$ DISTRIBUTION=stable ./container up
    host$ DISTRIBUTION=stable ./container ssh
    ```
 
    ```bash
    host$ export DISTRIBUTION=stable
-   host$ ./container start
+   host$ ./container up
    host$ ./container ssh
    ```
 
    2. Using the `--distribution` option for each command.
 
    ```bash
-   host$ ./container start --distribution=stable
+   host$ ./container up --distribution=stable
    host$ ./container ssh --distribution=stable
    ```
 
-#### Using KVM Virtual Machine
-
-The `./container` script, shipped with FreedomBox source code, can manage the
-development environment inside a KVM-based virtual machine using libvirt. This
-is an alternative to using containers described above (but the name of the
-script is still 'container' even when managing virtual machines). Some hardware,
-such as additional disks, can be better tested with virtual machine than with
-containers.
-
-Containers and a virtual machines of the same or different distribution all be
-used simultaneously as they all use different disk images.
-
-1.  To use virtual machines instead of container, append the option
-    '--machine-type=vm' to all the ./container commands described above. For
-    example, to bring up a virtual machine instead of a container run:
-
-    ```bash
-    host$ ./container start --machine-type=vm
-    ```
-
 #### Using after Setup
 
 After logging into the container, the source code is available in `/freedombox`
@@ -143,12 +123,12 @@ directory:
 guest$ cd /freedombox
 ```
 
-FreedomBox Service runs as plinth.service in the container. This service
-restarts when it detects a change to the source code file. This provides a quick
-feedback cycle during development. To watch service logs run:
+Run the development version of FreedomBox Service in the container using the
+following command. This command continuously deploys your code changes into the
+container providing a quick feedback cycle during development.
 
 ```bash
-guest$ sudo freedombox-logs
+guest$ freedombox-develop
 ```
 
 If you have changed any system configuration files during your development,
@@ -156,17 +136,16 @@ you will need to run the following to install those files properly on to the
 system and their changes to reflect properly.
 
 ```bash
-guest$ sudo make build install ;
-guest$ sudo systemctl restart plinth.service
+guest$ sudo ./setup.py install
 ```
 
 Note: This development container has automatic upgrades disabled by default.
 
 #### Troubleshooting
 
-* Sometimes `host$ ./container destroy && ./container start` doesn't work. In such
+* Sometimes `host$ ./container destroy && ./container up` doesn't work. In such
   cases, try to delete the hidden `.container` folder and then `host$
-  ./container start`.
+  ./container up`.
 * Not all kinds of changes are automatically updated. Try `guest$ sudo mount -o
   remount /freedombox`.
 * I am getting an error that says `lo` is not managed by Network Manager
@@ -178,7 +157,7 @@ Note: This development container has automatic upgrades disabled by default.
     ```bash
     host$ sudo touch /etc/NetworkManager/conf.d/10-globally-managed-devices.conf
     host$ sudo service network-manager restart
-    host$ ./container destroy && ./container start
+    host$ ./container destroy && ./container up
     ```
 * File/directory not found errors when running tests can be fixed by clearing `__pycache__` directories.
 
@@ -374,12 +353,13 @@ After logging into the virtual machine (VM), the source code is available in
 vm$ cd /freedombox
 ```
 
-FreedomBox Service runs as plinth.service in the virtual machine. This service
-restarts when it detects a change to the source code file. This provides a quick
-feedback cycle during development. To watch service logs run:
+Run the development version of FreedomBox Service (Plinth) from your source
+directory in the virtual machine using the following command. This command
+continuously deploys your code changes into the virtual machine providing a
+quick feedback cycle during development.
 
 ```bash
-vm$ sudo freedombox-logs
+vm$ freedombox-develop
 ```
 
 If you have changed any system configuration files during your development,
@@ -387,7 +367,7 @@ you will need to run the following to install those files properly on to the
 system and their changes to reflect properly.
 
 ```bash
-vm$ sudo make build install
+vm$ sudo ./setup.py install
 ```
 
 Note: This development virtual machine has automatic upgrades disabled by
@@ -416,7 +396,7 @@ for more details.
 ### Translating literals (contributing translations)
 
 The easiest way to start translating is with your browser, by using
-[Weblate](https://hosted.weblate.org/projects/freedombox/freedombox/).
+[Weblate](https://hosted.weblate.org/projects/freedombox/plinth/).
 Your changes will automatically get pushed to the code repository.
 
 Alternatively, you can directly edit the `.po` file in your language directory
@@ -609,19 +589,6 @@ installed.
 $ py.test-3 -n 4 --dist=loadfile --include-functional -m essential
 ```
 
-#### Enabling all apps
-
-When testing distribution upgrades from a stable release to next stable release
-or testing, it is beneficial to install all available FreedomBox applications.
-There is a script available to perform operation.
-
-In the VM or container, run the following command:
-
-```
-guest$ cd /freedombox
-guest$ sudo make build install
-guest$ plinth/tests/functional/enable-all-apps
-```
 
 [back to index](#hacking)
 

INSTALL.md

@@ -24,7 +24,7 @@ FreedomBox [Manual](https://wiki.debian.org/FreedomBox/Manual/)'s
     install FreedomBox Service (Plinth) itself.
 
     ```
-    $ sudo make build install
+    $ sudo python3 setup.py install
     ```
 
 2.  Run FreedomBox Service (Plinth):
@@ -35,7 +35,7 @@ FreedomBox [Manual](https://wiki.debian.org/FreedomBox/Manual/)'s
 
 3.  Access FreedomBox UI:
 
-    UI should be accessible at http://localhost:8000/freedombox
+    UI should be accessible at http://localhost:8000/plinth
 
 If you are installing FreedomBox Service (Plinth) for development purposes, see
 HACKING.md instead.

Makefile

@@ -1,252 +0,0 @@
-DJANGO_ADMIN := django-admin
-INSTALL := install
-PYTHON := python3
-PYTEST_ARGS :=
-CP_ARGS := --no-dereference --preserve=mode,timestamps --reflink=auto
-
-ENABLED_APPS_PATH := $(DESTDIR)/usr/share/freedombox/modules-enabled
-
-DISABLED_APPS_TO_REMOVE := \
-    apps \
-    coquelicot \
-    diaspora \
-    monkeysphere \
-    owncloud \
-    system \
-    xmpp \
-    disks \
-    udiskie \
-    restore \
-    repro \
-    tahoe \
-    mldonkey \
-    i2p \
-    ttrss \
-    sso
-
-APP_FILES_TO_REMOVE := $(foreach app,$(DISABLED_APPS_TO_REMOVE),$(ENABLED_APPS_PATH)/$(app))
-
-REMOVED_FILES := \
-    $(DESTDIR)/etc/apt/preferences.d/50freedombox3.pref \
-    $(DESTDIR)/etc/apache2/sites-available/plinth.conf \
-    $(DESTDIR)/etc/apache2/sites-available/plinth-ssl.conf \
-    $(DESTDIR)/etc/security/access.d/10freedombox-performance.conf \
-    $(DESTDIR)/etc/security/access.d/10freedombox-security.conf
-
-DIRECTORIES_TO_CREATE := \
-    $(DESTDIR)/var/lib/plinth \
-    $(DESTDIR)/var/lib/plinth/sessions
-
-STATIC_FILES_DIRECTORY := $(DESTDIR)/usr/share/plinth/static
-BIN_DIR := $(DESTDIR)/usr/bin
-LIB_DIR := $(DESTDIR)/usr/lib
-
-FIND_ARGS := \
-    -not -iname "*.log" \
-    -not -iname "*.pid" \
-    -not -iname "*.py.bak" \
-    -not -iname "*.pyc" \
-    -not -iname "*.pytest_cache" \
-    -not -iname "*.sqlite3" \
-    -not -iname "*.swp" \
-    -not -iname "\#*" \
-    -not -iname ".*" \
-    -not -iname "sessionid*" \
-    -not -iname "~*" \
-    -not -iname "django-secret.key" \
-    -not -iwholename "*/.mypy_cache/*"
-
-
-ROOT_DATA_FILES := $(shell find data -type f $(FIND_ARGS))
-MODULE_DATA_FILES := $(shell find $(wildcard plinth/modules/*/data) -type f $(FIND_ARGS))
-
-update-translations:
-	$(DJANGO_ADMIN) makemessages --all --domain django --keep-pot \
-		--verbosity=1 --ignore conftest.py --ignore doc --ignore build \
-		--ignore htmlcov --ignore screenshots --ignore debian --ignore \
-		actions --ignore preseed --ignore static --ignore data \
-		--settings plinth.settings --pythonpath .
-
-configure:
-	# Nothing to do
-
-build:
-	# Compile translations
-	$(DJANGO_ADMIN) compilemessages --verbosity=1
-
-	# Build documentation
-	$(MAKE) -C doc -j 8
-
-	# Build .whl package
-	rm -f dist/plinth-*.whl
-	$(PYTHON) -m build --no-isolation --skip-dependency-check --wheel
-
-install:
-	# Drop removed apps
-	rm -f $(APP_FILES_TO_REMOVE)
-
-	# Drop removed configuration files
-	rm -f $(REMOVED_FILES)
-
-	# Create data directories
-	for directory in $(DIRECTORIES_TO_CREATE) ; do \
-	    $(INSTALL) -d $$directory ; \
-	done
-
-	# Python package
-	temp=$$(mktemp -d) && \
-        lib_dir=$$($(PYTHON) -c 'import sysconfig; print(sysconfig.get_paths(scheme="deb_system")["purelib"])') && \
-	$(PYTHON) -m pip install dist/plinth-*.whl --break-system-packages \
-            --no-deps --no-compile --no-warn-script-location \
-            --ignore-installed --target=$${temp} && \
-        $(INSTALL) -d $(DESTDIR)$${lib_dir} && \
-	rm -rf $(DESTDIR)$${lib_dir}/plinth $(DESTDIR)$${lib_dir}/plinth*.dist-info && \
-        mv $${temp}/plinth $${temp}/plinth*.dist-info $(DESTDIR)$${lib_dir} && \
-	rm -f $(DESTDIR)$${lib_dir}/plinth*.dist-info/licenses/COPYING.md && \
-	rm -f $(DESTDIR)$${lib_dir}/plinth*.dist-info/direct_url.json && \
-        $(INSTALL) -D -t $(BIN_DIR) bin/plinth
-	$(INSTALL) -D -t $(LIB_DIR)/freedombox bin/freedombox-privileged
-	$(INSTALL) -D -t $(BIN_DIR) bin/freedombox-cmd
-	$(INSTALL) -D -t $(BIN_DIR) bin/freedombox-change-password
-
-	# Static web server files
-	rm -rf $(STATIC_FILES_DIRECTORY)
-	$(INSTALL) -d $(STATIC_FILES_DIRECTORY)
-	cp $(CP_ARGS) --recursive static/* $(STATIC_FILES_DIRECTORY)
-
-	# System data files
-	for file in $(ROOT_DATA_FILES) ; do \
-	    target=$$(dirname $(DESTDIR)$$(echo $${file} | sed -e 's|^data||')) ; \
-	    $(INSTALL) --directory --mode=755 $${target} ; \
-	    cp $(CP_ARGS) $${file} $${target} ; \
-	done
-	for file in $(MODULE_DATA_FILES) ; do \
-	    target=$$(dirname $(DESTDIR)$$(echo $${file} | sed -e 's|^plinth/modules/[^/]*/data||')) ; \
-	    $(INSTALL) --directory --mode=755 $${target} ; \
-	    cp $(CP_ARGS) $${file} $${target} ; \
-	done
-
-	# Documentation
-	$(MAKE) -C doc install
-
-check: check-type check-code check-doc check-tests
-
-# Run the main test suite
-check-tests:
-	$(PYTHON) -m pytest $(PYTEST_ARGS)
-
-# Tests with coverage report
-check-tests-cov:
-	$(PYTHON) -m pytest $(PYTEST_ARGS) --cov=plinth \
-	    --cov-report=html:./htmlcov --cov-report=term
-
-# Code quality checking using flake8
-check-code:
-	$(PYTHON) -m flake8 plinth container
-
-# Static type checking using mypy
-check-type:
-	$(PYTHON) -m mypy .
-
-# Use doctest for check the wikiparser in doc directory
-check-doc:
-	$(PYTHON) -m doctest doc/scripts/wikiparser.py
-
-clean:
-	make -C doc clean
-	rm -rf Plinth.egg-info
-	find plinth/locale -name *.mo -delete
-
-define DEVELOP_SERVICE_CONF
-[Service]
-Environment=FREEDOMBOX_DEVELOP=1
-Environment=PYTHONPATH=/freedombox/
-endef
-export DEVELOP_SERVICE_CONF
-
-define DEVELOP_LOGS_SCRIPT
-#!/usr/bin/bash
-
-set -e
-set -x
-
-journalctl --follow --unit=plinth.service --unit=freedombox-privileged.service
-endef
-export DEVELOP_LOGS_SCRIPT
-
-# Run basic setup for a developer environment (VM or container)
-provision-dev:
-	# Install newer build dependencies if any
-	apt-get update
-	DEBIAN_FRONTEND=noninteractive apt-get build-dep --yes .
-
-	# Install latest code over .deb
-	$(MAKE) build install
-
-	# Configure privileged and web daemon for development setup
-	mkdir -p /etc/systemd/system/freedombox-privileged.service.d/
-	echo "$$DEVELOP_SERVICE_CONF" > /etc/systemd/system/freedombox-privileged.service.d/develop.conf
-	mkdir -p /etc/systemd/system/plinth.service.d/
-	echo "$$DEVELOP_SERVICE_CONF" > /etc/systemd/system/plinth.service.d/develop.conf
-
-	# Create a command to easily watch service logs
-	echo "$$DEVELOP_LOGS_SCRIPT" > /usr/bin/freedombox-logs
-	chmod 755 /usr/bin/freedombox-logs
-
-	# Reload newer systemd units, ignore failure
-	-systemctl daemon-reload
-
-	# Enable privileged daemon
-	-systemctl stop freedombox-privileged.service
-
-	-test -d /run/systemd/system && \
-		systemctl enable --now freedombox-privileged.socket
-
-	# Enable and restart plinth service if it is running
-	-systemctl enable plinth.service
-	-systemctl restart plinth.service
-
-	# Stop any ongoing upgrade, ignore failure
-	-killall -9 unattended-upgr
-
-	# Fix any broken packages
-	dpkg --configure -a
-	apt-get -f install
-	apt-get update
-
-	# Install new packages needed by essential apps. Don't uninstall
-	# freedombox in case new dependencies conflict with old dependencies
-	apt-mark hold freedombox
-	DEBIAN_FRONTEND=noninteractive apt-get install --no-upgrade --yes \
-	    $$(sudo -u plinth ./run --develop --list-dependencies)
-	apt-mark unhold freedombox
-
-	# DNS resolution may be broken by upgrade to systemd-resolved. See
-	# #1079819 and ##1032937.
-	-systemctl restart systemd-resolved
-	-nmcli general reload dns-rc
-
-	# Install additional packages
-	DEBIAN_FRONTEND=noninteractive apt-get install --yes ncurses-term \
-	    sshpass bash-completion
-
-wait-while-first-setup:
-	while [ x$$(curl -k https://localhost/freedombox/status/ 2> /dev/null | \
-	    json_pp 2> /dev/null | grep 'is_first_setup_running' | \
-            tr -d '[:space:]' | cut -d':' -f2 ) != 'xfalse' ] ; do \
-	    sleep 1; echo -n .; done
-
-.PHONY: \
-    build \
-    check \
-    check-code \
-    check-doc \
-    check-type \
-    check-tests \
-    check-tests-cov \
-    clean \
-    configure \
-    install \
-    provision \
-    update-translations \
-    wait-while-first-setup

README.md

@@ -1,4 +1,4 @@
-[![pipeline status](https://salsa.debian.org/freedombox-team/freedombox/badges/main/pipeline.svg)](https://salsa.debian.org/freedombox-team/freedombox/commits/main)
+[![pipeline status](https://salsa.debian.org/freedombox-team/freedombox/badges/master/pipeline.svg)](https://salsa.debian.org/freedombox-team/freedombox/commits/master)
 [![Translation status](https://hosted.weblate.org/widgets/freedombox/-/svg-badge.svg)](https://hosted.weblate.org/engage/freedombox/?utm_source=widget)
 [![Debian Unstable](https://badges.debian.net/badges/debian/unstable/freedombox/version.svg)](https://packages.debian.org/unstable/freedombox)
 [![Debian Testing](https://badges.debian.net/badges/debian/testing/freedombox/version.svg)](https://packages.debian.org/testing/freedombox)
@@ -58,16 +58,8 @@ HACKING.md.
 
 # Contributing
 
-See the [HACKING.md](https://salsa.debian.org/freedombox-team/freedombox/blob/main/HACKING.md) file for contributing to FreedomBox Service (Plinth).
+See the [HACKING.md](https://salsa.debian.org/freedombox-team/freedombox/blob/master/HACKING.md) file for contributing to FreedomBox Service (Plinth).
 
 # Localization
 
-[![Translation status](https://hosted.weblate.org/widget/freedombox/horizontal-auto.svg)](https://hosted.weblate.org/engage/freedombox/)
-
-# License
-
-[![GNU AGPLv3 Image](https://www.gnu.org/graphics/agplv3-155x51.png)](https://www.gnu.org/licenses/agpl-3.0.html)
-
-FreedomBox is distributed under the GNU Affero General Public License, Version 3
-or later. A copy of [AGPLv3](http://www.gnu.org/licenses/agpl.html) is available
-from the Free Software Foundation.
+[![Translation status](https://hosted.weblate.org/widgets/freedombox/-/287x66-white.png)](https://hosted.weblate.org/engage/freedombox/?utm_source=widget)

Vagrantfile

@@ -6,13 +6,13 @@ require 'etc'
 
 Vagrant.configure(2) do |config|
   config.vm.box = "freedombox/freedombox-testing-dev"
-  config.vm.network "public_network"
+  config.vm.network "forwarded_port", guest: 443, host: 4430
+  config.vm.network "forwarded_port", guest: 445, host: 4450
   config.vm.synced_folder ".", "/freedombox", owner: "plinth", group: "plinth"
   config.vm.provider "virtualbox" do |vb|
     vb.cpus = Etc.nprocessors
     vb.memory = 2048
     vb.linked_clone = true
-    vb.customize ["modifyvm", :id, "--firmware", "efi"]
   end
   config.vm.provision "shell", run: 'always', inline: <<-SHELL
     # Disable automatic upgrades
@@ -23,19 +23,36 @@ Vagrant.configure(2) do |config|
   SHELL
   config.vm.provision "shell", inline: <<-SHELL
     cd /freedombox/
-    make provision-dev
+    ./setup.py install
+    systemctl daemon-reload
+    # Stop any ongoing upgrade
+    killall -9 unattended-upgr
+    dpkg --configure -a
+    apt -f install
+    apt-get update
+    # In case new dependencies conflict with old dependencies
+    apt-mark hold freedombox
+    DEBIAN_FRONTEND=noninteractive apt-get install --no-upgrade -y $(sudo -u plinth ./run --develop --list-dependencies)
+    apt-mark unhold freedombox
+    # Install ncurses-term
+    DEBIAN_FRONTEND=noninteractive apt-get install -y ncurses-term
+    echo 'alias freedombox-develop="cd /freedombox; sudo -u plinth /freedombox/run --develop"' >> /home/vagrant/.bashrc
   SHELL
   config.vm.provision "tests", run: "never", type: "shell", path: "plinth/tests/functional/install.sh"
   config.vm.post_up_message = "FreedomBox virtual machine is ready
-for development. To get the IP address:
+for development. You can run the development version of Plinth using
+the following command.
 $ vagrant ssh
-$ ip address show
-
-FreedomBox interface will be available at https://<ip address>/freedombox
-(with an invalid SSL certificate). To watch logs:
-$ vagrant ssh
-$ sudo freedombox-logs
+$ freedombox-develop
+Plinth will be available at https://localhost:4430/plinth (with
+an invalid SSL certificate).
 "
 
+  config.trigger.after [:up, :resume, :reload] do |trigger|
+    trigger.info = "Set plinth user permissions for development environment"
+    trigger.run_remote = {
+      path: ".vagrant-scripts/plinth-user-permissions.py"
+    }
+  end
   config.vm.boot_timeout=1200
 end

actions/actions

@@ -0,0 +1,210 @@
+#!/usr/bin/python3
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+import argparse
+import importlib
+import inspect
+import json
+import logging
+import os
+import sys
+import traceback
+import types
+import typing
+
+import plinth.log
+from plinth import cfg, module_loader
+
+EXIT_SYNTAX = 10
+EXIT_PERM = 20
+
+logger = logging.getLogger(__name__)
+
+
+def main():
+    """Parse arguments."""
+    plinth.log.action_init()
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument('module', help='Module to trigger action in')
+    parser.add_argument('action', help='Action to trigger in module')
+    parser.add_argument('--write-fd', type=int, default=1,
+                        help='File descriptor to write output to')
+    parser.add_argument('--no-args', default=False, action='store_true',
+                        help='Do not read arguments from stdin')
+    args = parser.parse_args()
+
+    try:
+        try:
+            arguments = {'args': [], 'kwargs': {}}
+            if not args.no_args:
+                input_ = sys.stdin.read()
+                if input_:
+                    arguments = json.loads(input_)
+        except json.JSONDecodeError as exception:
+            raise SyntaxError('Arguments on stdin not JSON.') from exception
+
+        return_value = _call(args.module, args.action, arguments)
+        with os.fdopen(args.write_fd, 'w') as write_file_handle:
+            write_file_handle.write(json.dumps(return_value))
+    except PermissionError as exception:
+        logger.error(exception.args[0])
+        sys.exit(EXIT_PERM)
+    except SyntaxError as exception:
+        logger.error(exception.args[0])
+        sys.exit(EXIT_SYNTAX)
+    except TypeError as exception:
+        logger.error(exception.args[0])
+        sys.exit(EXIT_SYNTAX)
+    except Exception as exception:
+        logger.exception(exception)
+        sys.exit(1)
+
+
+def _call(module_name, action_name, arguments):
+    """Import the module and run action as superuser"""
+    if '.' in module_name:
+        raise SyntaxError('Invalid module name')
+
+    cfg.read()
+    if module_name == 'plinth':
+        import_path = 'plinth'
+    else:
+        import_path = module_loader.get_module_import_path(module_name)
+
+    try:
+        module = importlib.import_module(import_path + '.privileged')
+    except ModuleNotFoundError as exception:
+        raise SyntaxError('Specified module not found') from exception
+
+    try:
+        action = getattr(module, action_name)
+    except AttributeError as exception:
+        raise SyntaxError('Specified action not found') from exception
+
+    if not getattr(action, '_privileged', None):
+        raise SyntaxError('Specified action is not privileged action')
+
+    func = getattr(action, '__wrapped__')
+
+    _assert_valid_arguments(func, arguments)
+
+    try:
+        return_values = func(*arguments['args'], **arguments['kwargs'])
+        return_value = {'result': 'success', 'return': return_values}
+    except Exception as exception:
+        logger.exception('Error executing action: %s', exception)
+        return_value = {
+            'result': 'exception',
+            'exception': {
+                'module': type(exception).__module__,
+                'name': type(exception).__name__,
+                'args': exception.args,
+                'traceback': traceback.format_tb(exception.__traceback__)
+            }
+        }
+
+    return return_value
+
+
+def _assert_valid_arguments(func, arguments):
+    """Check the names, types and completeness of the arguments passed."""
+    # Check if arguments match types
+    if not isinstance(arguments, dict):
+        raise SyntaxError('Invalid arguments format')
+
+    if 'args' not in arguments or 'kwargs' not in arguments:
+        raise SyntaxError('Invalid arguments format')
+
+    args = arguments['args']
+    kwargs = arguments['kwargs']
+    if not isinstance(args, list) or not isinstance(kwargs, dict):
+        raise SyntaxError('Invalid arguments format')
+
+    argspec = inspect.getfullargspec(func)
+    if len(args) + len(kwargs) > len(argspec.args):
+        raise SyntaxError('Too many arguments')
+
+    no_defaults = len(argspec.args)
+    if argspec.defaults:
+        no_defaults -= len(argspec.defaults)
+
+    for key in argspec.args[len(args):no_defaults]:
+        if key not in kwargs:
+            raise SyntaxError(f'Argument not provided: {key}')
+
+    for key, value in kwargs.items():
+        if key not in argspec.args:
+            raise SyntaxError(f'Unknown argument: {key}')
+
+        if argspec.args.index(key) < len(args):
+            raise SyntaxError(f'Duplicate argument: {key}')
+
+        _assert_valid_type(f'arg {key}', value, argspec.annotations[key])
+
+    for index, arg in enumerate(args):
+        annotation = argspec.annotations[argspec.args[index]]
+        _assert_valid_type(f'arg #{index}', arg, annotation)
+
+
+def _assert_valid_type(arg_name, value, annotation):
+    """Assert that the type of argument value matches the annotation."""
+    if annotation == typing.Any:
+        return
+
+    NoneType = type(None)
+    if annotation == NoneType:
+        if value is not None:
+            raise TypeError('Expected None for {arg_name}')
+
+        return
+
+    basic_types = {bool, int, str, float}
+    if annotation in basic_types:
+        if not isinstance(value, annotation):
+            raise TypeError(
+                f'Expected type {annotation.__name__} for {arg_name}')
+
+        return
+
+    # 'int | str' or 'typing.Union[int, str]'
+    if (isinstance(annotation, types.UnionType)
+            or getattr(annotation, '__origin__', None) == typing.Union):
+        for arg in annotation.__args__:
+            try:
+                _assert_valid_type(arg_name, value, arg)
+                return
+            except TypeError:
+                pass
+
+        raise TypeError(f'Expected one of unioned types for {arg_name}')
+
+    # 'list[int]' or 'typing.List[int]'
+    if getattr(annotation, '__origin__', None) == list:
+        if not isinstance(value, list):
+            raise TypeError(f'Expected type list for {arg_name}')
+
+        for index, inner_item in enumerate(value):
+            _assert_valid_type(f'{arg_name}[{index}]', inner_item,
+                               annotation.__args__[0])
+
+        return
+
+    # 'list[dict]' or 'typing.List[dict]'
+    if getattr(annotation, '__origin__', None) == dict:
+        if not isinstance(value, dict):
+            raise TypeError(f'Expected type dict for {arg_name}')
+
+        for inner_key, inner_value in value.items():
+            _assert_valid_type(f'{arg_name}[{inner_key}]', inner_key,
+                               annotation.__args__[0])
+            _assert_valid_type(f'{arg_name}[{inner_value}]', inner_value,
+                               annotation.__args__[1])
+
+        return
+
+    raise TypeError('Unsupported annotation type')
+
+
+if __name__ == '__main__':
+    main()

actions/dynamicdns

@@ -0,0 +1,9 @@
+#!/usr/bin/python3
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""Legacy configuration helper for Dynamic DNS, kept for compatibility.
+
+Cron jobs in the earlier implementation used to call into this script with the
+sub-commands 'update' and 'success'. This action script now allows for any
+arbitrary sub-command to be called and does nothing. It can be removed after
+the release of Debian 12 (bookworm).
+"""

actions/letsencrypt

@@ -0,0 +1,9 @@
+#!/usr/bin/python3
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""Legacy configuration helper for Let's Encrypt, kept for compatibility.
+
+LE configuration in the earlier implementation used to call into this script
+with the sub-commands 'run-pre-hooks', 'run-renew-hooks' and 'run-post-hooks'.
+This action script now allows for any arbitrary sub-command to be called and
+does nothing. It can be removed after the release of Debian 12 (bookworm).
+"""

actions/test_path

@@ -0,0 +1,10 @@
+#!/usr/bin/python3
+# -*- mode: python -*-
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""
+Helper to test whether action scripts use the correct PYTHONPATH.
+"""
+
+import plinth
+
+print(plinth.__file__)

bin/freedombox-change-password

@@ -1,61 +0,0 @@
-#!/usr/bin/python3
-# SPDX-License-Identifier: AGPL-3.0-or-later
-"""
-Utility to change user password in FreedomBox's Django database.
-
-Usage:
-$ freedombox-change-password <username>
-"""
-
-import argparse
-import getpass
-import sys
-
-import plinth.web_framework
-from plinth.modules.users import privileged
-
-
-def main():
-    """Ask for new password, setup Django and update a user's password."""
-    try:
-        plinth.web_framework.init()
-    except Exception:
-        _print('Error initializing Django.')
-        return
-
-    parser = argparse.ArgumentParser()
-    parser.add_argument('username',
-                        help='Username of the account to change password for')
-    args = parser.parse_args()
-
-    username = args.username
-    password = getpass.getpass('Enter new password: ')
-
-    try:
-        _change_password(username, password)
-        privileged._set_user_password(username, password)
-        privileged._set_samba_user(username, password)
-        _print('Password updated in web interface, LDAP, and samba databases.')
-    except Exception as exception:
-        _print('Error setting password:', str(exception))
-
-
-def _print(*args, **kwargs):
-    """Write to stderr."""
-    print(*args, **kwargs, file=sys.stderr)
-
-
-def _change_password(username: str, password: str):
-    """Update the password in SQLite database file."""
-    from django.contrib.auth.models import User
-    try:
-        user = User.objects.get(username=username)
-        user.set_password(password)
-        user.save()
-    except User.DoesNotExist:
-        _print('User account does not exist:', username)
-        raise
-
-
-if __name__ == '__main__':
-    main()

bin/freedombox-cmd

@@ -1,6 +0,0 @@
-#!/usr/bin/python3
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-import plinth.privileged_daemon
-
-plinth.privileged_daemon.client_main()

bin/freedombox-privileged

@@ -1,6 +0,0 @@
-#!/usr/bin/python3
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-import plinth.privileged_daemon
-
-plinth.privileged_daemon.main()

conftest.py

@@ -1,10 +1,256 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 """
-pytest configuration that needs to be pytest rootdir.
+pytest configuration for all tests.
 """
 
+import importlib
+import os
+import pathlib
+import sys
+from unittest.mock import patch
+
+import pytest
+
+try:
+    importlib.import_module('splinter')
+    importlib.import_module('selenium')
+    _functional_libs_available = True
+except ImportError:
+    _functional_libs_available = False
+
+
+def pytest_ignore_collect(path, config):
+    """Ignore functional tests when splinter is not available."""
+    if path.basename == 'test_functional.py':
+        return not _functional_libs_available
+
 
 def pytest_addoption(parser):
     """Add a command line option to run functional tests."""
     parser.addoption('--include-functional', action='store_true',
                      default=False, help='Run functional tests also')
+
+
+def pytest_collection_modifyitems(config, items):
+    """Filter out specificly marked tests unless explicitly requested.
+
+    The EXTENDED_TESTING environment variable is borrowed from the Lancaster
+    consensus met by the Pearl community. See
+    https://github.com/Perl-Toolchain-Gang/toolchain-site/blob/master/lancaster-consensus.md
+    """
+
+    def skip(item, reason):
+        item.add_marker(pytest.mark.skip(reason=reason))
+
+    extended = 'EXTENDED_TESTING' in os.environ
+    if not (extended or config.getoption('--include-functional')):
+        for item in items:
+            if 'functional' in item.keywords or (
+                    item.parent.fspath.basename
+                    and item.parent.fspath.basename == 'test_functional.py'):
+                skip(item, '--include-functional not provided')
+
+    if not extended:
+        for item in items:
+            if 'heavy' in item.keywords:
+                skip(item, ('Takes too much time. '
+                            'Set EXTENDED_TESTING=1 to force run'))
+
+
+@pytest.fixture(name='load_cfg')
+def fixture_load_cfg():
+    """Load test configuration."""
+    from plinth import cfg
+
+    keys = ('file_root', 'config_dir', 'data_dir', 'custom_static_dir',
+            'store_file', 'actions_dir', 'doc_dir', 'server_dir', 'host',
+            'port', 'use_x_forwarded_for', 'use_x_forwarded_host',
+            'secure_proxy_ssl_header', 'box_name', 'develop')
+    saved_state = {}
+    for key in keys:
+        saved_state[key] = getattr(cfg, key)
+
+    root_dir = pathlib.Path(__file__).resolve().parent
+    cfg_file = root_dir / 'plinth' / 'develop.config'
+    cfg.read_file(str(cfg_file))
+    yield cfg
+
+    for key in keys:
+        setattr(cfg, key, saved_state[key])
+
+
+@pytest.fixture(name='develop_mode')
+def fixture_develop_mode(load_cfg):
+    """Turn on development mode for a test."""
+    load_cfg.develop = True
+    yield
+    load_cfg.develop = False
+
+
+@pytest.fixture(name='needs_root', scope='session')
+def fixture_needs_root():
+    """Skip test if not running in root mode."""
+    if os.geteuid() != 0:
+        pytest.skip('Needs to be root')
+
+
+@pytest.fixture(name='needs_not_root', scope='session')
+def fixture_needs_not_root():
+    """Skip test if running in root mode."""
+    if os.geteuid() == 0:
+        pytest.skip('Needs not to be root')
+
+
+@pytest.fixture(name='needs_sudo')
+def fixture_needs_sudo():
+    """Skip test if sudo command is not available."""
+    if not os.path.isfile('/usr/bin/sudo'):
+        pytest.skip('Needs sudo command installed.')
+
+
+@pytest.fixture(scope='session')
+def splinter_selenium_implicit_wait():
+    """Disable implicit waiting."""
+    return 0
+
+
+@pytest.fixture(scope='session')
+def splinter_wait_time():
+    """Disable explicit waiting."""
+    return 0.01
+
+
+@pytest.fixture(scope='session')
+def splinter_browser_load_condition():
+    """When a page it loaded, wait until <body> is available."""
+
+    def _load_condition(browser):
+        if browser.url == 'about:blank':
+            return True
+
+        ready_state = browser.execute_script('return document.readyState;')
+        return ready_state == 'complete'
+
+    return _load_condition
+
+
+@pytest.fixture(name='actions_module', scope='module')
+def fixture_actions_module(request):
+    """Import and return an action module."""
+    actions_name = getattr(request.module, 'actions_name')
+    actions_file = str(
+        pathlib.Path(__file__).parent / 'actions' / actions_name)
+
+    loader = importlib.machinery.SourceFileLoader(actions_name, actions_file)
+    spec = importlib.util.spec_from_loader(actions_name, loader)
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[actions_name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+@pytest.fixture(name='mock_privileged')
+def fixture_mock_privileged(request):
+    """Mock the privileged decorator to nullify its effects."""
+    try:
+        privileged_modules_to_mock = request.module.privileged_modules_to_mock
+    except AttributeError:
+        raise AttributeError(
+            'mock_privileged fixture requires "privileged_module_to_mock" '
+            'attribute at module level')
+
+    for module_name in privileged_modules_to_mock:
+        module = importlib.import_module(module_name)
+        for name, member in module.__dict__.items():
+            wrapped = getattr(member, '__wrapped__', None)
+            if not callable(member) or not wrapped:
+                continue
+
+            if not getattr(member, '_privileged', False):
+                continue
+
+            setattr(wrapped, '_original_wrapper', member)
+            module.__dict__[name] = wrapped
+
+    yield
+
+    for module_name in privileged_modules_to_mock:
+        module = importlib.import_module(module_name)
+        for name, member in module.__dict__.items():
+            wrapper = getattr(member, '_original_wrapper', None)
+            if not callable(member) or not wrapper:
+                continue
+
+            module.__dict__[name] = wrapper
+
+
+@pytest.fixture(name='splinter_screenshot_dir', scope='session')
+def fixture_splinter_screenshot_dir(request):
+    """Set default screenshot directory to ./screenshots.
+
+    This can be overridden using --splinter-screenshot-dir=foo as the option.
+    """
+    option = request.config.getoption('--splinter-screenshot-dir')
+    screenshots_dir = option if option != '.' else './screenshots'
+    return os.path.abspath(screenshots_dir)
+
+
+@pytest.fixture(autouse=True)
+def fixture_fix_session_browser_screenshots(request):
+    """Fix a bug in pytest-splinter for screenshots.
+
+    When using session_browser, pytest-splinter does not take a screenshot when
+    a test has failed. It is uses internal pytest API on the FixtureRequest
+    object. This API was removed in later versions of pytest causing the
+    failure. Re-implement the fixture that has the problem fixing this issue.
+
+    Drop this fixture after a fix is merged and released in pytest-splinter.
+    See: https://github.com/pytest-dev/pytest-splinter/pull/157
+    """
+    yield
+
+    if not request.config.pluginmanager.has_plugin('pytest-splinter'):
+        return
+
+    session_tmpdir = request.getfixturevalue('session_tmpdir')
+    splinter_session_scoped_browser = request.getfixturevalue(
+        'splinter_session_scoped_browser')
+    splinter_make_screenshot_on_failure = request.getfixturevalue(
+        'splinter_make_screenshot_on_failure')
+    splinter_screenshot_dir = request.getfixturevalue(
+        'splinter_screenshot_dir')
+    splinter_screenshot_getter_html = request.getfixturevalue(
+        'splinter_screenshot_getter_html')
+    splinter_screenshot_getter_png = request.getfixturevalue(
+        'splinter_screenshot_getter_png')
+    splinter_screenshot_encoding = request.getfixturevalue(
+        'splinter_screenshot_encoding')
+
+    # Screenshot for function scoped browsers is handled in
+    # browser_instance_getter
+    if not splinter_session_scoped_browser:
+        return
+
+    for name in request.fixturenames:
+        fixture_def = request._fixture_defs.get(name)
+        if not fixture_def or not fixture_def.cached_result:
+            continue
+
+        value = fixture_def.cached_result[0]
+        should_take_screenshot = (hasattr(value, "__splinter_browser__")
+                                  and splinter_make_screenshot_on_failure
+                                  and getattr(request.node, 'splinter_failure',
+                                              True))
+
+        from pytest_splinter import plugin
+        if should_take_screenshot:
+            plugin._take_screenshot(
+                request=request,
+                fixture_name=name,
+                session_tmpdir=session_tmpdir,
+                browser_instance=value,
+                splinter_screenshot_dir=splinter_screenshot_dir,
+                splinter_screenshot_getter_html=splinter_screenshot_getter_html,
+                splinter_screenshot_getter_png=splinter_screenshot_getter_png,
+                splinter_screenshot_encoding=splinter_screenshot_encoding,
+            )

data/etc/apache2/conf-available/freedombox-tls-site-macro.conf

@@ -16,14 +16,8 @@
             SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
 
             # Automatically obtained certificates from Let's Encrypt
-            <IfFile /etc/letsencrypt/live/$domain/privkey.pem>
-                SSLCertificateFile /etc/letsencrypt/live/$domain/fullchain.pem
-                SSLCertificateKeyFile /etc/letsencrypt/live/$domain/privkey.pem
-            </IfFile>
-            <IfFile !/etc/letsencrypt/live/$domain/privkey.pem>
-                SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
-                SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
-            </IfFile>
+            SSLCertificateFile /etc/letsencrypt/live/$domain/fullchain.pem
+            SSLCertificateKeyFile /etc/letsencrypt/live/$domain/privkey.pem
 
             <FilesMatch "\.(cgi|shtml|phtml|php)$">
                 SSLOptions +StdEnvVars
@@ -31,19 +25,6 @@
             <Directory /usr/lib/cgi-bin>
                 SSLOptions +StdEnvVars
             </Directory>
-
-            <IfFile /etc/apache2/includes/all-domains-include-freedombox.conf>
-                Include includes/all-domains-include-freedombox.conf
-            </IfFile>
-            <IfFile /etc/apache2/includes/all-domains-include.conf>
-                Include includes/all-domains-include.conf
-            </IfFile>
-            <IfFile /etc/apache2/includes/$domain-include-freedombox.conf>
-                Include includes/$domain-include-freedombox.conf
-            </IfFile>
-            <IfFile /etc/apache2/includes/$domain-include.conf>
-                Include includes/$domain-include.conf
-            </IfFile>
         </VirtualHost>
     </IfModule>
 </Macro>

data/etc/apache2/conf-available/freedombox-tls.conf

@@ -12,7 +12,6 @@
     # Don't redirect for onion sites as it is not needed and leads to
     # unnecessary warning.
     RewriteCond %{HTTP_HOST} !^.*\.onion$ [NC]
-    RewriteCond %{REQUEST_URI} !^/freedombox/apache/discover-idp/$ [NC]
     ReWriteCond %{HTTPS} !=on
     RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
 </LocationMatch>

data/etc/apache2/conf-available/freedombox.conf

@@ -39,16 +39,53 @@
 </If>
 
 ##
-## Redirect traffic on home to /freedombox as part of turning the machine
+## Redirect traffic on home to /plinth as part of turning the machine
 ## into FreedomBox server.  Plinth then acts as a portal to reach all
 ## other services.
 ##
-<IfFile !/etc/apache2/conf-enabled/freedombox-apache-homepage.conf>
-    RedirectMatch "^/$" "/freedombox"
-</IfFile>
+RedirectMatch "^/$" "/plinth"
 
 ##
-## On all sites, provide FreedomBox on a default path: /freedombox
+## Disable sending Referer (sic) header from FreedomBox web interface to
+## external websites. This improves privacy by not disclosing FreedomBox
+## domains/URLs to external domains. Apps such as blogs which want to popularize
+## themselves with referrer header may still do so.
+##
+## A strict Content Security Policy.
+## - @fonts are allowed only from FreedomBox itself.
+## - <frame>/<iframe> sources are disabled.
+## - <img> sources are allowed only from FreedomBox itself.
+## - Manifest file is not allowed as there is none yet.
+## - <audio>, <video>, <track> tags are not allowed yet.
+## - <object>, <embed>, <applet> tags are not allowed yet.
+## - Allow JS from FreedomBox itself (no inline and attribute scripts).
+## - Allow inline CSS and CSS files from Freedombox itself.
+## - Web worker sources are allowed only from FreedomBox itself (for JSXC).
+## - All other fetch sources including Ajax are not allowed from FreedomBox
+##   itself.
+## - <base> tag is not allowed.
+## - No plugins types are alllowed since object-src is 'none'.
+## - Form action should be to FreedomBox itself.
+## - This interface may be not embedded in <frame>, <iframe>, etc. tags.
+## - When serving HTTPS, don't allow HTTP assets.
+##
+## Enable strict sandboxing enabled with some exceptions:
+## - Allow running Javascript.
+## - Allow popups as sometimes we use <a target=_blank>
+## - Allow forms to support configuration forms.
+## -
+##
+## Disable browser guessing of MIME types. FreedoBox already sets good content
+## types for all the common file types.
+##
+<LocationMatch "^/(plinth|freedombox)">
+    Header set Referrer-Policy 'same-origin'
+    Header set Content-Security-Policy "font-src 'self'; frame-src 'none'; img-src 'self'; manifest-src 'none'; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self'; default-src 'self'; base-uri 'none'; sandbox allow-scripts allow-popups allow-forms allow-same-origin allow-downloads; form-action 'self'; frame-ancestors 'none'; block-all-mixed-content;"
+    Header set X-Content-Type-Options 'nosniff'
+</LocationMatch>
+
+##
+## On all sites, provide FreedomBox on a default path: /plinth
 ##
 ## Requires the following Apache modules to be enabled:
 ##   mod_headers
@@ -56,8 +93,7 @@
 ##   mod_proxy_http
 ##
 <Location /freedombox>
-    ProxyPass        http://127.0.0.1:8000/freedombox
-    ProxyPreserveHost On
+    ProxyPass        http://127.0.0.1:8000/plinth
     ## Send the scheme from user's request to enable Plinth to redirect
     ## URLs, set cookies, set absolute URLs (if any) properly.
     RequestHeader    set X-Forwarded-Proto 'https' env=HTTPS
@@ -71,20 +107,7 @@
     RequestHeader    unset X-Forwarded-For
 </Location>
 <Location /plinth>
-    ProxyPass        http://127.0.0.1:8000/freedombox
-    ProxyPreserveHost On
-    RequestHeader    set X-Forwarded-Proto 'https' env=HTTPS
-    RequestHeader    unset X-Forwarded-For
-</Location>
-<Location /.well-known/openid-configuration>
-    ProxyPass        http://127.0.0.1:8000/freedombox/o/.well-known/openid-configuration
-    ProxyPreserveHost On
-    RequestHeader    set X-Forwarded-Proto 'https' env=HTTPS
-    RequestHeader    unset X-Forwarded-For
-</Location>
-<Location /.well-known/jwks.json>
-    ProxyPass        http://127.0.0.1:8000/freedombox/o/.well-known/jwks.json
-    ProxyPreserveHost On
+    ProxyPass        http://127.0.0.1:8000/plinth
     RequestHeader    set X-Forwarded-Proto 'https' env=HTTPS
     RequestHeader    unset X-Forwarded-For
 </Location>
@@ -96,7 +119,7 @@
 <Location ~ ^/favicon\.ico$>
     <IfModule mod_rewrite.c>
         RewriteEngine On
-        RewriteRule /favicon\.ico$ "/freedombox/static/theme/img/favicon.ico" [PT]
+        RewriteRule /favicon\.ico$ "/plinth/static/theme/img/favicon.ico" [PT]
     </IfModule>
 </Location>
 
@@ -126,12 +149,3 @@ ErrorLog "|/usr/bin/systemd-cat --identifier=apache-error"
 # records its own timestamp.
 ErrorLogFormat "[%-m:%l] [pid %P:tid %{g}T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i"
 CustomLog "|/usr/bin/systemd-cat --identifier=apache-access" vhost_combined
-
-## When showing an index page for a directory listing, ensure that viewport's
-## width is the same as the device's width. Directory index pages generated by
-## mod_autoindex are reasonably suitable for mobile devices. However, without
-## the directive, mobile devices will assume the page to be not-mobile friendly
-## and use a larger view port than the device size.
-<IfModule mod_autoindex.c>
-    IndexHeadInsert "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">"
-</IfModule>

data/etc/sudoers.d/plinth

@@ -1,3 +1,11 @@
+#
+# Allow plinth user to run plinth action scripts with superuser privileges
+# without needing a password.
+#
+Cmnd_Alias FREEDOMBOX_ACTION = /usr/share/plinth/actions/actions
+Defaults!FREEDOMBOX_ACTION closefrom_override
+plinth    ALL=(ALL:ALL) NOPASSWD:FREEDOMBOX_ACTION
+
 #
 # On FreedomBox, allow all users in the 'admin' LDAP group to execute
 # commands as root.

data/usr/lib/systemd/system/freedombox-privileged.service

@@ -1,27 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-[Unit]
-Description=FreedomBox Privileged Service
-Documentation=https://wiki.debian.org/FreedomBox/
-# Don't hit the start rate limiting.
-StartLimitIntervalSec=0
-# Stop/restart along with .socket unit (invoked from dpkg scripts).
-PartOf=freedombox-privileged.socket
-# Uploaded files in /var/tmp/ are shared with FreedomBox web service.
-JoinsNamespaceOf=plinth.service
-
-[Service]
-Type=notify
-ExecStart=/usr/lib/freedombox/freedombox-privileged
-TimeoutSec=300s
-User=root
-Group=root
-NotifyAccess=main
-# Uploaded files in /var/tmp/ are shared with FreedomBox web service by joining
-# namespaces.
-PrivateTmp=yes
-Restart=on-failure
-# Don't restart too fast
-RestartSec=1
-RestartSteps=3
-RestartMaxDelaySec=5

data/usr/lib/systemd/system/freedombox-privileged.socket

@@ -1,16 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-[Unit]
-Description=FreedomBox Privileged Service Socket
-Documentation=https://wiki.debian.org/FreedomBox/
-
-[Socket]
-Accept=no
-ListenStream=/run/freedombox/privileged.socket
-SocketUser=root
-SocketGroup=root
-SocketMode=0666
-DirectoryMode=755
-
-[Install]
-WantedBy=sockets.target

data/usr/lib/systemd/system/plinth.service

@@ -5,22 +5,16 @@ Description=FreedomBox Service (Plinth)
 Documentation=man:plinth(1)
 After=network.target
 StartLimitIntervalSec=0
-# Uploaded files in /var/tmp/ are shared with FreedomBox privileged service.
-JoinsNamespaceOf=freedombox-privileged.service
 
 [Service]
-Type=notify
 ExecStart=/usr/bin/plinth
-TimeoutSec=300s
 Restart=on-failure
 RestartSec=5
 ExecReload=/bin/kill -HUP $MAINPID
 User=plinth
 Group=plinth
-NotifyAccess=main
-# Uploaded files in /var/tmp/ are shared with FreedomBox privileged service by
-# joining namespaces.
-PrivateTmp=yes
+StandardOutput=null
+StandardError=null
 
 [Install]
 WantedBy=multi-user.target

debian/control

@@ -1,82 +1,89 @@
 Source: freedombox
 Section: web
+Priority: optional
 Maintainer: FreedomBox packaging team <freedombox-pkg-team@lists.alioth.debian.org>
 Uploaders:
+ Tzafrir Cohen <tzafrir@debian.org>,
+ Piotr Ożarowski <piotr@debian.org>,
  Petter Reinholdtsen <pere@debian.org>,
  Sunil Mohan Adapa <sunil@medhas.org>,
+ Nick Daly <Nick.M.Daly@gmail.com>,
  Federico Ceratto <federico@debian.org>,
  James Valleroy <jvalleroy@mailbox.org>,
 Build-Depends:
  debhelper-compat (= 13),
- dh-sequence-installsysusers,
  dblatex,
  dh-python,
  docbook-xsl,
- e2fsprogs <!nocheck>,
+ e2fsprogs,
  gir1.2-nm-1.0,
- libjs-bootstrap5 <!nocheck>,
- libjs-htmx <!nocheck>,
-# Older libjs-bootstrap5 does not have proper dependency on popper.js >= 2.0
- node-popper2 <!nocheck>,
- pybuild-plugin-pyproject,
+ libjs-bootstrap4,
  python3-all:any,
- python3-apt <!nocheck>,
+ python3-apt,
  python3-augeas,
- python3-bootstrapform <!nocheck>,
- python3-build,
+ python3-bootstrapform,
  python3-cherrypy3,
- python3-configobj <!nocheck>,
- python3-cryptography <!nocheck>,
+ python3-configobj,
  python3-dbus,
- python3-django,
- python3-django-axes <!nocheck>,
- python3-django-captcha <!nocheck>,
-# Explictly depend on ipware as it is optional dependecy of django-axes
- python3-django-ipware <!nocheck>,
- python3-django-oauth-toolkit <!nocheck>,
- python3-django-stronghold <!nocheck>,
- python3-fido2 <!nocheck>,
+ python3-django (>= 1.11),
+ python3-django-axes (>= 5.0.0),
+ python3-django-captcha,
+# Explictly depend on ipware as it is optional dependecy for future versions
+# of django-axes.
+ python3-django-ipware (>= 3),
+ python3-django-stronghold (>= 0.3.0),
+ python3-flake8,
  python3-gi,
  python3-markupsafe,
- python3-mypy <!nocheck>,
- python3-pampy <!nocheck>,
- python3-pexpect,
- python3-pip,
+ python3-openssl,
+ python3-pampy,
+ python3-paramiko,
  python3-psutil,
- python3-pytest <!nocheck>,
- python3-pytest-cov <!nocheck>,
- python3-pytest-django <!nocheck>,
- python3-pytest-runner <!nocheck>,
+ python3-pytest,
+ python3-pytest-cov,
+ python3-pytest-django,
+ python3-pytest-runner,
  python3-requests,
  python3-ruamel.yaml,
- python3-segno <!nocheck>,
  python3-setuptools,
- python3-systemd,
- python3-typeshed <!nocheck>,
+ python3-setuptools-git,
+# python3-tomli is not available in Bullseye
+ python3-tomli | python3-coverage (<< 6.0),
  python3-yaml,
- sshpass <!nocheck>,
+ sshpass,
  xmlto,
  xsltproc
-Standards-Version: 4.7.3
+Standards-Version: 4.6.2
 Homepage: https://salsa.debian.org/freedombox-team/freedombox
 Vcs-Git: https://salsa.debian.org/freedombox-team/freedombox.git
 Vcs-Browser: https://salsa.debian.org/freedombox-team/freedombox
+Rules-Requires-Root: no
 
 Package: freedombox
 Breaks:
+ freedombox-setup (<< 0.13~),
+ plinth (<< 0.46.0~),
 # Ensure fuse gets replaced by fuse3 on upgrades from buster s.t. sshfs can be installed.
  fuse (<< 3),
 # If ufw is installed, remove it. See issue 2247.
  ufw,
+Replaces:
+ freedombox-setup (<< 0.13~),
+ plinth (<< 0.46.0~),
 Architecture: all
+Provides: plinth
 Depends:
  ${python3:Depends},
  ${misc:Depends},
  ${freedombox:Depends},
+ adduser,
  augeas-tools,
- bind9-dnsutils,
  curl,
  debconf,
+ dnsutils,
+ e2fsprogs,
+ fonts-fork-awesome,
+ fonts-lato,
 # sgdisk is used in storage app to expand GPT disks
  gdisk,
  gettext,
@@ -86,13 +93,14 @@ Depends:
  ldapscripts,
 # For gdbus used to call hooks into service
  libglib2.0-bin,
- libjs-bootstrap5,
- libjs-htmx,
+ libjs-bootstrap4,
+ libjs-jquery,
+ libjs-modernizr,
  lsof,
  netcat-openbsd,
  network-manager,
-# Older libjs-bootstrap5 does not have proper dependency on popper.js >= 2.0
- node-popper2,
+# Ensure that nscd is installed rather than unscd.
+ nscd (>= 2),
  ppp,
  pppoe,
  python3-apt,
@@ -102,18 +110,17 @@ Depends:
  python3-cherrypy3,
  python3-configobj,
  python3-dbus,
- python3-django,
- python3-django-axes,
+ python3-django (>= 1.11),
+ python3-django-axes (>= 5.0.0),
  python3-django-captcha,
-# Explictly depend on ipware as it is optional dependecy of django-axes
- python3-django-ipware,
- python3-django-oauth-toolkit,
+# Explictly depend on ipware as it is optional dependecy for future versions
+# of django-axes.
+ python3-django-ipware (>= 3),
  python3-django-stronghold,
- python3-fido2,
  python3-gi,
  python3-markupsafe,
  python3-pampy,
- python3-pexpect,
+ python3-paramiko,
  python3-psutil,
  python3-requests,
  python3-ruamel.yaml,
@@ -122,29 +129,65 @@ Depends:
  sudo,
  wget,
 # Ensure fuse gets replaced by fuse3 on upgrades from buster s.t. sshfs can be installed.
- fuse3,
+ fuse3 (>= 3),
 Recommends:
-# Temporarily moved from Depends due to piuparts bug #1010967.
- e2fsprogs,
+# Priority: standard
+ bzip2,
+# Provides brctl for controlling bridges
+ bridge-utils,
+# Read, write to char devices
+ devio,
+# Create, repair DOS filesystems
+ dosfstools,
+# Priority: standard
+ file,
 # Wifi firmware
  firmware-ath9k-htc,
 # FreedomBox documentation
  freedombox-doc-en,
  freedombox-doc-es,
+# Provide entropy using HAVEGE algorithm
+ haveged,
+# Monitor system resources
+ htop,
+# Monitor network traffic statistics
+ iftop,
+# Basic network utitlity ping
+ iputils-ping,
+# Manage wireless devices
+ iw,
+# Resolve gateway.localhost
+ libnss-gw-name,
 # Resolve .local address using mDNS
  libnss-mdns,
 # Resolve current hostname without /etc/hosts
  libnss-myhostname,
+# Block repeated failed PAM login attempts
+ libpam-abl,
 # Priority: standard
  locales,
 # Precompiled data for all locales
  locales-all,
 # Priority: standard
  openssh-client,
+# Priority: standard
+ pciutils,
 # Used by unattended-upgrades to check if running on AC power
  powermgmt-base,
-# fuser, killall, pstree and other utilities
+# fuser, pstree and other utilities
  psmisc,
+# Manage /etc/resolv.conf
+ resolvconf,
+# Tool to kill WLAN, Bluetooth and moble broadband
+ rfkill,
+# Monitor network traffic
+ tcpdump,
+# Basic editor, VIM style
+ vim-tiny,
+# Priority: standard
+ whois,
+# Basic editor, Emacs style
+ zile,
 Description: easy to manage, privacy oriented home server
  FreedomBox is designed to be your own inexpensive server at home. It runs free
  software and offers an increasing number of services ranging from a calendar or

debian/copyright

@@ -2,7 +2,7 @@ Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Source: https://salsa.debian.org/freedombox-team/freedombox
 
 Files: *
-Copyright: 2011-2026 FreedomBox Authors
+Copyright: 2011-2023 FreedomBox Authors
 License: AGPL-3+
 
 Files: plinth/modules/jsxc/static/icons/jsxc.png
@@ -15,7 +15,7 @@ Files: doc/*.xml
        doc/*.png
        doc/*.jpg
        doc/*.wiki
-Copyright: 2011-2025 FreedomBox Authors
+Copyright: 2011-2023 FreedomBox Authors
 License: CC-BY-SA-4.0
 
 Files: doc/visual_design/apple-touch-icon*
@@ -32,16 +32,12 @@ Copyright: 2012 FreedomBox Foundation
 Comment: Original Author: Robert Martinez
 License: GPL-3+
 
-Files: static/themes/default/icons/app-store.svg
+Files: static/themes/default/icons/app-store.png
+       static/themes/default/icons/app-store.svg
 Copyright: Marie Van den Broeck (https://thenounproject.com/marie49/)
 Comment: https://thenounproject.com/icon/162372/
 License: CC-BY-SA-3.0
 
-Files: static/themes/default/js/color-modes.js
-Copyright: 2011-2025 The Bootstrap Authors
-Comment: https://getbootstrap.com/docs/5.3/customize/color-modes/
-License: CC-BY-3.0
-
 Files: plinth/modules/bepasty/static/icons/bepasty.svg
 Copyright: (c) 2014 by the Bepasty Team, see the AUTHORS file.
 Comment: https://github.com/bepasty/bepasty-server/blob/master/src/bepasty/static/app/bepasty.svg
@@ -68,8 +64,6 @@ Files: plinth/modules/ejabberd/static/icons/ejabberd.png
        plinth/modules/ejabberd/static/icons/ejabberd.svg
        plinth/modules/email/static/icons/email.png
        plinth/modules/email/static/icons/email.svg
-       plinth/modules/gnome/static/icons/gnome.png
-       plinth/modules/gnome/static/icons/gnome.svg
        plinth/modules/matrixsynapse/static/icons/matrixsynapse.svg
        plinth/modules/privoxy/static/icons/privoxy.png
        plinth/modules/privoxy/static/icons/privoxy.svg
@@ -78,7 +72,6 @@ Files: plinth/modules/ejabberd/static/icons/ejabberd.png
        plinth/modules/rssbridge/static/icons/rssbridge.svg
        plinth/modules/zoph/static/icons/zoph.png
        plinth/modules/zoph/static/icons/zoph.svg
-       static/themes/default/img/application.svg
        static/themes/default/img/network-connection.svg
        static/themes/default/img/network-connection-vertical.svg
        static/themes/default/img/network-ethernet.svg
@@ -100,11 +93,13 @@ Copyright: 2020 Adwaita Icon Theme Authors, GNOME Project
 Comment: https://github.com/GNOME/adwaita-icon-theme/ http://www.gnome.org
 License: LGPL-3 or CC-BY-SA-3.0-US
 
-Files: plinth/modules/featherwiki/static/icons/featherwiki.png
-       plinth/modules/featherwiki/static/icons/featherwiki.svg
-Copyright: 2022 Robbie Antenesse <dev@alamantus.com>
-Comment: https://codeberg.org/Alamantus/FeatherWiki/src/branch/main/logo.svg
-License: AGPL-3+
+Files: static/themes/default/icons/f-droid.png
+       static/themes/default/icons/f-droid.svg
+Copyright: 2012 William Theaker
+           2013 Robert Martinez
+           2015 Andrew Nayenko
+Comment: https://gitlab.com/fdroid/artwork/blob/master/fdroid-logo-2015/fdroid-logo.svg
+License: CC-BY-SA-3.0 or GPL-3+
 
 Files: plinth/modules/gitweb/static/icons/gitweb.png
        plinth/modules/gitweb/static/icons/gitweb.svg
@@ -112,11 +107,14 @@ Copyright: 2010 Git Authors
 Comment: https://github.com/git/git/blob/master/gitweb/static/git-logo.png
 License: GPL-2
 
-Files: plinth/modules/homeassistant/static/icons/homeassistant.png
-       plinth/modules/homeassistant/static/icons/homeassistant.svg
-Copyright: Home Assistant Core Developers
-Comment: https://github.com/home-assistant/core/blob/dev/tests/components/image_upload/logo.png
-License: Apache-2.0
+Files: static/themes/default/icons/google-play.png
+Copyright: Chameleon Design (https://thenounproject.com/Chamedesign/)
+Comment: https://thenounproject.com/icon/887917/
+License: CC-BY-3.0-US
+
+Files: static/themes/default/icons/gnu-linux.png
+Copyright: 2017 Cowemoji
+License: CC0-1.0
 
 Files: plinth/modules/ikiwiki/static/icons/ikiwiki.png
        plinth/modules/ikiwiki/static/icons/ikiwiki.svg
@@ -131,10 +129,7 @@ License: ISC
 
 Files: plinth/modules/janus/static/icons/janus.png
        plinth/modules/janus/static/icons/janus.svg
-       plinth/modules/janus/static/janus-video-room.css
-       plinth/modules/janus/static/janus-video-room.js
-       plinth/modules/janus/templates/janus_video_room.html
-Copyright: 2014-2025 Meetecho
+Copyright: 2014-2022 Meetecho
 License: GPL-3 with OpenSSL exception
 
 Files: plinth/modules/kiwix/static/icons/kiwix.png
@@ -143,6 +138,12 @@ Copyright: 2020 The other Kiwix guy
 Comment: https://commons.wikimedia.org/wiki/File:Kiwix_logo_v3.svg
 License: CC-BY-SA-4.0
 
+Files: static/themes/default/icons/macos.png
+       static/themes/default/icons/macos.svg
+Copyright: Vectors Market (https://thenounproject.com/vectorsmarket/)
+Comment: https://thenounproject.com/icon/1203053/
+License: CC-BY-SA-3.0
+
 Files: plinth/modules/matrixsynapse/static/icons/matrixsynapse.png
 Copyright: 2017 Kishan Raval
 Comment: https://github.com/thekishanraval/Logos
@@ -160,15 +161,9 @@ License: CC-BY-SA-3.0
 
 Files: plinth/modules/minetest/static/icons/minetest.svg
 Copyright: 2015 Calinou, Nils Dagsson Moskopp
-Comment: https://github.com/luanti-org/luanti/blob/master/misc/luanti.svg
+Comment: https://github.com/minetest/minetest/blob/master/misc/minetest.svg
 License: CC-BY-SA-3.0
 
-Files: plinth/modules/miniflux/static/icons/miniflux.png
-       plinth/modules/miniflux/static/icons/miniflux.svg
-Copyright: 2018, 2019 Frédéric Guillot
-Comment: https://github.com/miniflux/logo
-License: CC-BY-SA-4.0
-
 Files: plinth/modules/mumble/static/icons/mumble.png
 Copyright: 2009 Martin Skilnand
 Comment: https://commons.wikimedia.org/wiki/File:Icons_mumble.svg
@@ -180,12 +175,6 @@ Comment: https://github.com/mumble-voip/mumble/blob/master/icons/mumble.svg
          https://github.com/mumble-voip/mumble/blob/master/LICENSE
 License: BSD-3-clause
 
-Files: plinth/modules/nextcloud/static/icons/nextcloud.png
-       plinth/modules/nextcloud/static/icons/nextcloud.svg
-Copyright: 2016 Nextcloud GmbH.
-Comment: https://nextcloud.com/trademarks/
-License: AGPL-3+
-
 Files: plinth/modules/openvpn/static/icons/openvpn.png
 Copyright: 2017 Kishan Raval
 Comment: https://github.com/thekishanraval/Logos
@@ -266,12 +255,6 @@ Copyright: Interface (https://www.shareicon.net/author/interface)
 Comment: https://www.shareicon.net/universal-interface-interface-sharing-share-697502
 License: CC-BY-3.0
 
-Files: plinth/modules/sogo/static/icons/sogo.png
-       plinth/modules/sogo/static/icons/sogo.svg
-Copyright: 2024 Inverse inc./Alinto
-Comment: https://github.com/Alinto/sogo/blob/master/COPYING.GPL
-License: GPL-2
-
 Files: plinth/modules/syncthing/static/icons/syncthing.png
 Copyright: 2015 Jack Palevich <jack.palevich@gmail.com>
            2014 The Syncthing Authors
@@ -283,13 +266,6 @@ Copyright: Jakob Borg and the Syncthing project
 Comment: https://commons.wikimedia.org/wiki/File:SyncthingLogoHorizontal.svg
 License: MPL-2.0
 
-Files: plinth/modules/tiddlywiki/static/icons/tiddlywiki.svg
-       plinth/modules/tiddlywiki/static/icons/tiddlywiki.png
-Copyright: 2004-2007 Jeremy Ruston <jeremy@jermolene.com>
-           2007-2016 UnaMesa Association 
-Comment: https://github.com/Jermolene/TiddlyWiki5/blob/086506012d98e9db34c7d96dc27aea249a9bdbc8/editions/introduction/tiddlers/images/Motovun%20Jack.svg
-License: BSD-3-clause
-
 Files: plinth/modules/tor/static/icons/tor.png
        plinth/modules/tor/static/icons/tor.svg
 Copyright: The Tor Project, Inc.
@@ -303,12 +279,14 @@ Copyright: Transmission Authors
 Comment: https://github.com/transmission/transmission/blob/master/gtk/icons/hicolor_apps_scalable_transmission.svg
 License: GPL-3
 
-Files: plinth/modules/upgrades/data/usr/share/augeas/lenses/aptsources.aug
-       plinth/modules/upgrades/data/usr/share/augeas/lenses/tests/test_aptsources.aug
-Copyright: 2007-2025 David Lutterkort
-Comment: https://github.com/hercules-team/augeas/blob/master/lenses/aptsources.aug
-         https://github.com/hercules-team/augeas/blob/master/lenses/tests/test_aptsources.aug
-License: LGPL-2.1+
+Files: plinth/modules/ttrss/static/icons/ttrss.png
+Copyright: Mark James <mjames@gmail.com>
+License: CC-BY-3.0
+
+Files: plinth/modules/ttrss/static/icons/ttrss.svg
+Copyright: 2005 Andrew Dolgov
+Comment: https://git.tt-rss.org/fox/tt-rss/src/master/images/favicon-72px.png
+License: GPL-3+
 
 Files: plinth/modules/wordpress/static/icons/wordpress.png
        plinth/modules/wordpress/static/icons/wordpress.svg
@@ -316,6 +294,12 @@ Copyright: 2011-2021 WordPress Contributors
 Comment: https://github.com/WordPress/wordpress-develop/blob/master/src/wp-admin/images/wordpress-logo.svg
 License: GPL-2+
 
+Files: static/themes/default/icons/windows.png
+       static/themes/default/icons/windows.svg
+Copyright: 2007 ruli (https://thenounproject.com/2007ruli/)
+Comment: https://thenounproject.com/icon/1206946/
+License: CC-BY-SA-3.0
+
 Files: plinth/modules/wireguard/static/icons/wireguard.png
        plinth/modules/wireguard/static/icons/wireguard.svg
 Copyright: 2019 WireGuard LLC
@@ -327,88 +311,13 @@ Copyright: 2008 GNOME icon artists
 Comment: https://commons.wikimedia.org/wiki/File:Gnome-computer.svg
 License: LGPL-3+ or CC-BY-SA-3.0
 
-Files: static/themes/default/icons/adjust.svg
-       static/themes/default/icons/android.svg
-       static/themes/default/icons/arrow-right.svg
-       static/themes/default/icons/ban.svg
-       static/themes/default/icons/bar-chart.svg
-       static/themes/default/icons/bars.svg
-       static/themes/default/icons/bell-o.svg
-       static/themes/default/icons/book.svg
-       static/themes/default/icons/check-circle.svg
-       static/themes/default/icons/check.svg
-       static/themes/default/icons/chevron-right.svg
-       static/themes/default/icons/clock-o.svg
-       static/themes/default/icons/cog.svg
-       static/themes/default/icons/comments.svg
-       static/themes/default/icons/compass.svg
-       static/themes/default/icons/debian.svg
-       static/themes/default/icons/download.svg
-       static/themes/default/icons/eject.svg
-       static/themes/default/icons/exclamation-triangle.svg
-       static/themes/default/icons/external-link.svg
-       static/themes/default/icons/eye-slash.svg
-       static/themes/default/icons/eye.svg
-       static/themes/default/icons/f-droid.svg
-       static/themes/default/icons/files-o.svg
-       static/themes/default/icons/film.svg
-       static/themes/default/icons/flag.svg
-       static/themes/default/icons/freedombox.svg
-       static/themes/default/icons/frown-o.svg
-       static/themes/default/icons/globe-w.svg
-       static/themes/default/icons/gnu-linux.svg
-       static/themes/default/icons/google-play.svg
-       static/themes/default/icons/hdd-o.svg
-       static/themes/default/icons/heartbeat.svg
-       static/themes/default/icons/heart.svg
-       static/themes/default/icons/home.svg
-       static/themes/default/icons/hourglass-o.svg
-       static/themes/default/icons/info-circle.svg
-       static/themes/default/icons/key.svg
-       static/themes/default/icons/life-ring.svg
-       static/themes/default/icons/line-chart.svg
-       static/themes/default/icons/lock.svg
-       static/themes/default/icons/macos.svg
-       static/themes/default/icons/moon.svg
-       static/themes/default/icons/pencil-square-o.svg
-       static/themes/default/icons/plus.svg
-       static/themes/default/icons/power-off.svg
-       static/themes/default/icons/question-circle.svg
-       static/themes/default/icons/refresh.svg
-       static/themes/default/icons/repeat.svg
-       static/themes/default/icons/rocket.svg
-       static/themes/default/icons/shield.svg
-       static/themes/default/icons/signal.svg
-       static/themes/default/icons/smile-o.svg
-       static/themes/default/icons/spinner.svg
-       static/themes/default/icons/star.svg
-       static/themes/default/icons/sun.svg
-       static/themes/default/icons/tags.svg
-       static/themes/default/icons/tag.svg
-       static/themes/default/icons/terminal.svg
-       static/themes/default/icons/th.svg
-       static/themes/default/icons/times.svg
-       static/themes/default/icons/trash-o.svg
-       static/themes/default/icons/trash.svg
-       static/themes/default/icons/upload.svg
-       static/themes/default/icons/user.svg
-       static/themes/default/icons/users.svg
-       static/themes/default/icons/wifi.svg
-       static/themes/default/icons/windows.svg
-       static/themes/default/icons/wrench.svg
-Copyright: 2018, Fork Awesome
-Comment: https://github.com/ForkAwesome/Fork-Awesome/tree/master/src/icons/svg/
+Files: static/themes/default/lato/*
+Copyright: (c) 2010-2014, Łukasz Dziedzic
 License: OFL-1.1
 
-Files: static/themes/default/icons/fedora.svg
-       static/themes/default/icons/homebrew.svg
-Copyright: 2026, Simple Icons
-Comment: https://github.com/simple-icons/simple-icons/
-License: CC0-1.0
-
 Files: debian/*
 Copyright: 2013 Tzafrir Cohen
-           2013-2026 FreedomBox Authors
+           2013-2023 FreedomBox Authors
 License: GPL-2+
 
 License: AGPL-3+
@@ -2875,6 +2784,90 @@ License: MPL-2.0
  On Debian systems, the complete text of the Mozilla Public License, v. 2.0 can
  be found in "/usr/share/common-licenses/MPL-2.0".
 
+License: OFL-1.1
+ PREAMBLE
+  The goals of the Open Font License (OFL) are to stimulate worldwide
+ development of collaborative font projects, to support the font creation
+ efforts of academic and linguistic communities, and to provide a free and
+ open framework in which fonts may be shared and improved in partnership
+ with others.
+ .
+ The OFL allows the licensed fonts to be used, studied, modified and
+ redistributed freely as long as they are not sold by themselves. The
+ fonts, including any derivative works, can be bundled, embedded,
+ redistributed and/or sold with any software provided that any reserved
+ names are not used by derivative works. The fonts and derivatives,
+ however, cannot be released under any other type of license. The
+ requirement for fonts to remain under this license does not apply
+ to any document created using the fonts or their derivatives.
+ .
+ DEFINITIONS
+ "Font Software" refers to the set of files released by the Copyright
+ Holder(s) under this license and clearly marked as such. This may
+ include source files, build scripts and documentation.
+ .
+ "Reserved Font Name" refers to any names specified as such after the
+ copyright statement(s).
+ .
+ "Original Version" refers to the collection of Font Software components as
+ distributed by the Copyright Holder(s).
+ .
+ "Modified Version" refers to any derivative made by adding to, deleting,
+ or substituting -- in part or in whole -- any of the components of the
+ Original Version, by changing formats or by porting the Font Software to a
+ new environment.
+ .
+ "Author" refers to any designer, engineer, programmer, technical
+ writer or other person who contributed to the Font Software.
+ .
+ PERMISSION & CONDITIONS
+  Permission is hereby granted, free of charge, to any person obtaining
+ a copy of the Font Software, to use, study, copy, merge, embed, modify,
+ redistribute, and sell modified and unmodified copies of the Font
+ Software, subject to the following conditions:
+ .
+ 1) Neither the Font Software nor any of its individual components,
+    in Original or Modified Versions, may be sold by itself.
+ .
+ 2) Original or Modified Versions of the Font Software may be bundled,
+    redistributed and/or sold with any software, provided that each copy
+    contains the above copyright notice and this license. These can be
+    included either as stand-alone text files, human-readable headers or
+    in the appropriate machine-readable metadata fields within text or
+    binary files as long as those fields can be easily viewed by the user.
+ .
+ 3) No Modified Version of the Font Software may use the Reserved Font
+    Name(s) unless explicit written permission is granted by the corresponding
+    Copyright Holder. This restriction only applies to the primary font
+    name as presented to the users.
+ .
+ 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+    Software shall not be used to promote, endorse or advertise any
+    Modified Version, except to acknowledge the contribution(s) of the
+    Copyright Holder(s) and the Author(s) or with their explicit written
+    permission.
+ .
+ 5) The Font Software, modified or unmodified, in part or in whole,
+    must be distributed entirely under this license, and must not be
+    distributed under any other license. The requirement for fonts to
+    remain under this license does not apply to any document created
+    using the Font Software.
+ .
+ TERMINATION
+  This license becomes null and void if any of the above conditions are
+ not met.
+ .
+ DISCLAIMER
+  THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+ OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+ COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+ DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+ OTHER DEALINGS IN THE FONT SOFTWARE.
+
 License: public-domain
  This software has been placed into the public domain by its authors.
 
@@ -2897,94 +2890,3 @@ License: Zlib
  .
  3. This notice may not be removed or altered from any source
  distribution.
-
-License: OFL-1.1
- This Font Software is licensed under the SIL Open Font License,
- Version 1.1.
- .
- This license is copied below, and is also available with a FAQ at:
- http://scripts.sil.org/OFL
- .
- SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
- .
- PREAMBLE The goals of the Open Font License (OFL) are to stimulate
- worldwide development of collaborative font projects, to support the font
- creation efforts of academic and linguistic communities, and to provide
- a free and open framework in which fonts may be shared and improved in
- partnership with others.
- .
- The OFL allows the licensed fonts to be used, studied, modified and
- redistributed freely as long as they are not sold by themselves.
- The fonts, including any derivative works, can be bundled, embedded,
- redistributed and/or sold with any software provided that any reserved
- names are not used by derivative works.  The fonts and derivatives,
- however, cannot be released under any other type of license.  The
- requirement for fonts to remain under this license does not apply to
- any document created using the fonts or their derivatives.
- .
- DEFINITIONS
- "Font Software" refers to the set of files released by the Copyright
- Holder(s) under this license and clearly marked as such.
- This may include source files, build scripts and documentation.
- .
- "Reserved Font Name" refers to any names specified as such after the
- copyright statement(s).
- .
- "Original Version" refers to the collection of Font Software components
- as distributed by the Copyright Holder(s).
- .
- "Modified Version" refers to any derivative made by adding to, deleting,
- or substituting ? in part or in whole ?
- any of the components of the Original Version, by changing formats or
- by porting the Font Software to a new environment.
- .
- "Author" refers to any designer, engineer, programmer, technical writer
- or other person who contributed to the Font Software.
- .
- PERMISSION & CONDITIONS
- .
- Permission is hereby granted, free of charge, to any person obtaining a
- copy of the Font Software, to use, study, copy, merge, embed, modify,
- redistribute, and sell modified and unmodified copies of the Font
- Software, subject to the following conditions:
- .
- 1) Neither the Font Software nor any of its individual components, in
-    Original or Modified Versions, may be sold by itself.
- .
- 2) Original or Modified Versions of the Font Software may be bundled,
-    redistributed and/or sold with any software, provided that each copy
-    contains the above copyright notice and this license. These can be
-    included either as stand-alone text files, human-readable headers or
-    in the appropriate machine-readable metadata fields within text or
-    binary files as long as those fields can be easily viewed by the user.
- .
- 3) No Modified Version of the Font Software may use the Reserved Font
-    Name(s) unless explicit written permission is granted by the
-    corresponding Copyright Holder. This restriction only applies to the
-    primary font name as presented to the users.
- .
- 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
-    Software shall not be used to promote, endorse or advertise any
-    Modified Version, except to acknowledge the contribution(s) of the
-    Copyright Holder(s) and the Author(s) or with their explicit written
-    permission.
- .
- 5) The Font Software, modified or unmodified, in part or in whole, must
-    be distributed entirely under this license, and must not be distributed
-    under any other license. The requirement for fonts to remain under
-    this license does not apply to any document created using the Font
-    Software.
- .
- TERMINATION
- This license becomes null and void if any of the above conditions are not met.
- .
- DISCLAIMER
- THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
- MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
- OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT.  IN NO EVENT SHALL THE
- COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
- DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER
- DEALINGS IN THE FONT SOFTWARE.

debian/freedombox.lintian-overrides

@@ -1,3 +1,7 @@
+# debconf is used only to display a message, and not to get
+# configuration.
+freedombox binary: no-debconf-config
+
 # Apache configuration for the Plinth itself is shipped with proper
 # name plinth.conf.  However, due to the nature of the package, Plinth
 # takes the responsibility of configuring various other services
@@ -12,15 +16,11 @@ freedombox binary: non-standard-apache2-configuration-name *
 # that requires significant effort.
 freedombox binary: web-application-works-only-with-apache
 
+# FreedomBox adds systemd security features for other daemons in Debian. There
+# is no equivalent for this in sysvinit. Sometimes, FreedomBox provide service
+# files for packages that do not provide them. FreedomBox does not support
+# sysvinit so no init.d equivalent is provided.
+freedombox: package-supports-alternative-init-but-no-init.d-script [usr/lib/systemd/system/*]
+
 # Not documentation
 freedombox: package-contains-documentation-outside-usr-share-doc [usr/share/plinth/static/jslicense.html]
-freedombox: package-contains-documentation-outside-usr-share-doc [usr/lib/python3/dist-packages/plinth-*.dist-info/top_level.txt]
-
-# This executable is meant to executed from systemd service file and is not
-# meant for user. However, don't install to /usr/libexec and follow systemd
-# convention instead.
-freedombox: executable-in-usr-lib [usr/lib/freedombox/freedombox-privileged]
-
-# [Install] section is missing for the privileged daemon service because it is
-# socket activated.
-freedombox: systemd-service-file-missing-install-key [usr/lib/systemd/system/freedombox-privileged.service]

debian/freedombox.manpages

@@ -1,2 +1 @@
-./doc/freedombox-cmd.1
 ./doc/plinth.1

debian/freedombox.postinst

@@ -0,0 +1,40 @@
+#!/bin/sh
+
+set -e
+
+# Source debconf library.
+. /usr/share/debconf/confmodule
+
+# Due to a change in sudo, now it runs PAM modules even on password-less
+# invocations. This leads to plinth not being able to run root privileges. This
+# is because of our own restrictions in /etc/security/access.conf. Since Plinth
+# is locked out after upgrade, we need to do this in postinst.
+sed -i 's+-:ALL EXCEPT root fbx (admin) (sudo):ALL+-:ALL EXCEPT root fbx plinth (admin) (sudo):ALL+' /etc/security/access.conf
+
+case "$1" in
+    configure)
+        if ! getent group plinth >/dev/null; then
+            addgroup --system --quiet plinth
+        fi
+
+        if ! getent passwd plinth >/dev/null; then
+            adduser --system --quiet --ingroup plinth --no-create-home --home /var/lib/plinth plinth
+        fi
+
+        chown plinth: /var/lib/plinth
+        chown plinth: /var/lib/plinth/sessions
+
+        if [ ! -e '/var/lib/freedombox/is-freedombox-disk-image' ]; then
+            umask 377
+            base64 < /dev/urandom | head -c 16 | sed -e 's+$+\n+' > /var/lib/plinth/firstboot-wizard-secret
+            chown plinth:plinth /var/lib/plinth/firstboot-wizard-secret
+            db_subst plinth/firstboot_wizard_secret secret $(cat /var/lib/plinth/firstboot-wizard-secret)
+            db_input high plinth/firstboot_wizard_secret || true
+            db_go
+        fi
+        ;;
+esac
+
+#DEBHELPER#
+
+exit 0

debian/freedombox.postrm

@@ -4,6 +4,7 @@ set -e
 
 case "$1" in
 purge)
+    deluser --system --quiet plinth || true
     rm -rf /var/lib/plinth
 
     # Remove legacy directory too

debian/freedombox.preinst

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+set -e
+
+case "$1" in
+    upgrade)
+        # Handle removing freedombox-setup-repositories.timer from 20.5.
+        if dpkg --compare-versions "$2" le 20.7; then
+            if [ -x "/usr/bin/deb-systemd-invoke" ]; then
+               deb-systemd-invoke stop freedombox-setup-repositories.timer >/dev/null 2>/dev/null || true
+            fi
+
+            if [ -x "/usr/bin/deb-systemd-helper" ]; then
+                deb-systemd-helper purge freedombox-setup-repositories.timer >/dev/null || true
+                deb-systemd-helper unmask freedombox-setup-repositories.timer >/dev/null || true
+            fi
+
+            if [ -d /run/systemd/system ]; then
+                systemctl daemon-reload
+            fi
+        fi
+
+        # Handle removing freedombox-udiskie.service from 20.9.
+        if dpkg --compare-versions "$2" le 20.9; then
+            if [ -x "/usr/bin/deb-systemd-invoke" ]; then
+                deb-systemd-invoke stop freedombox-udiskie.service >/dev/null 2>/dev/null || true
+            fi
+
+            if [ -x "/usr/bin/deb-systemd-helper" ]; then
+                deb-systemd-helper purge freedombox-udiskie.service >/dev/null || true
+                deb-systemd-helper unmask freedombox-udiskie.service >/dev/null || true
+            fi
+
+            if [ -d /run/systemd/system ]; then
+                systemctl daemon-reload
+            fi
+        fi
+        ;;
+esac
+
+#DEBHELPER#
+
+exit 0

debian/freedombox.sysusers

@@ -1 +0,0 @@
-u! plinth - "FreedomBox service" /var/lib/plinth

debian/freedombox.templates

@@ -0,0 +1,9 @@
+Template: plinth/firstboot_wizard_secret
+Type: note
+#flag:translate!:3
+_Description: FreedomBox first wizard secret - ${secret}
+ Please note down the above secret. You will be asked to enter this in the
+ first screen after you launch the FreedomBox web interface. In case you lose
+ it, you can retrieve it by running the following command:
+ .
+ $ sudo cat /var/lib/plinth/firstboot-wizard-secret

debian/freedombox.tmpfiles

@@ -1,2 +0,0 @@
-d /var/lib/plinth 0755 plinth plinth
-d /var/lib/plinth/sessions 0755 plinth plinth

debian/gbp.conf

@@ -1,9 +1,3 @@
-[DEFAULT]
-debian-branch = main
-
-[buildpackage]
-export-dir = ../build-area/
-
 [dch]
 git-log = --no-merges
 multimaint-merge = True

debian/po/POTFILES.in

@@ -0,0 +1 @@
+[type: gettext/rfc822deb] freedombox.templates

debian/po/de.po

@@ -0,0 +1,37 @@
+# Translation of plinth debconf templates to German
+# Copyright (C) 2019 FreedomBox packaging team <freedombox-pkg-team@lists.alioth.debian.org>
+# This file is distributed under the same license as the plinth package.
+# Helge Kreutzmann <debian@helgefjell.de>, 2018, 2019.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: plinth 19.21\n"
+"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
+"POT-Creation-Date: 2019-11-18 18:11-0500\n"
+"PO-Revision-Date: 2019-11-24 06:46+0100\n"
+"Last-Translator: Helge Kreutzmann <debian@helgefjell.de>\n"
+"Language-Team: german <debian-l10n-german@lists.debian.org>\n"
+"Language: de\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+
+#. Type: note
+#. Description
+#: ../templates:1001
+msgid "FreedomBox first wizard secret - ${secret}"
+msgstr "Passphrase des Ersteinrichtungsprogramms der FreedomBox - ${secret}"
+
+#. Type: note
+#. Description
+#: ../templates:1001
+msgid ""
+"Please note down the above secret. You will be asked to enter this in the "
+"first screen after you launch the FreedomBox web interface. In case you lose "
+"it, you can retrieve it by running the following command:"
+msgstr ""
+"Bitte schreiben Sie diese geheime Zeichenkette auf. Sie werden auf dem "
+"ersten Bildschirm nach dem Start der FreedomBox-Schnittstelle nach dieser "
+"Zeichenkette gefragt werden. Falls Sie sie verlieren, können Sie sie durch "
+"Ausführung des folgenden Befehls wiedererlangen:"

debian/po/es.po

@@ -0,0 +1,37 @@
+# Translation of plinth debconf templates to Spanish
+# Copyright (C) 2019 FreedomBox packaging team <freedombox-pkg-team@lists.alioth.debian.org>
+# This file is distributed under the same license as the plinth package.
+# Fioddor Superconcentrado <fioddor@gmail.com>, 2019
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: plinth 19.20\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2022-07-31 16:07+0000\n"
+"PO-Revision-Date: 2022-08-01 15:13+0200\n"
+"Last-Translator: Camaleón <noelamac@gmail.com>\n"
+"Language-Team: Debian L10n Spanish <debian-l10n-spanish@lists.debian.org>\n"
+"Language: es\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: Poedit 2.4.2\n"
+"Plural-Forms: nplurals=2; plural=(n > 1);\n"
+
+#. Type: note
+#. Description
+#: ../freedombox.templates:1001
+msgid "FreedomBox first wizard secret - ${secret}"
+msgstr "Secreto del asistente al primer arranque de FreedomBox - ${secret}"
+
+#. Type: note
+#. Description
+#: ../freedombox.templates:1001
+msgid ""
+"Please note down the above secret. You will be asked to enter this in the "
+"first screen after you launch the FreedomBox web interface. In case you lose "
+"it, you can retrieve it by running the following command:"
+msgstr ""
+"Por favor, anote esta cadena de texto. Se le pedirá en la primera pantalla "
+"al iniciar la interfaz web de FreedomBox. Si la pierde, podrá recuperarla "
+"ejecutando la siguiente orden:"

debian/po/fr.po

@@ -0,0 +1,42 @@
+# Translation of plinth debconf templates to French
+# Copyright (C) 2018 FreedomBox packaging team <freedombox-pkg-team@lists.alioth.debian.org>
+# This file is distributed under the same license as the plinth package.
+#
+# Jean-Pierre Giraud <jean-pierregiraud@neuf.fr>, 2018, 2019.
+msgid ""
+msgstr ""
+"Project-Id-Version: plinth\n"
+"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
+"POT-Creation-Date: 2019-11-18 18:11-0500\n"
+"PO-Revision-Date: 2019-12-16 10:23+0100\n"
+"Last-Translator: Jean-Pierre Giraud <jean-pierregiraud@neuf.fr>\n"
+"Language-Team: French <debian-l10n-french@lists.debian.org>\n"
+"Language: fr_FR\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=2; plural=(n > 1);\n"
+"X-Generator: Lokalize 2.0\n"
+
+#. Type: note
+#. Description
+#: ../templates:1001
+msgid "FreedomBox first wizard secret - ${secret}"
+msgstr "Phrase secrète du premier assistant de FreedomBox - ${secret}"
+
+#. Type: note
+#. Description
+#: ../templates:1001
+#| msgid ""
+#| "Please save this string. You will be asked to enter this in the first "
+#| "screen after you launch the FreedomBox interface. In case you lose it, "
+#| "you can find it in the file /var/lib/plinth/firstboot-wizard-secret."
+msgid ""
+"Please note down the above secret. You will be asked to enter this in the "
+"first screen after you launch the FreedomBox web interface. In case you lose "
+"it, you can retrieve it by running the following command:"
+msgstr ""
+"Veuillez noter cette phrase secrète. Le premier écran après le chargement de "
+"l'interface web de FreedomBox vous la demandera. Si vous l'avez oubliée, vous "
+"pourrez la récupérer en exécutant la commande suivante :"
+

debian/po/it.po

@@ -0,0 +1,35 @@
+# freedombox po-debconf italian translation
+# Copyright (C) 2022 freedombox's copyright holder
+# This file is distributed under the same license as the freedombox package.
+# Ceppo <ceppo@oziosi.org>, 2022.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: freedombox\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2022-08-18 16:09+0000\n"
+"PO-Revision-Date: 2022-08-25 00:00+0000\n"
+"Last-Translator: Ceppo <ceppo@oziosi.org>\n"
+"Language-Team: Italian <debian-l10n-italian@lists.debian.org>\n"
+"Language: it\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../freedombox.templates:1001
+msgid "FreedomBox first wizard secret - ${secret}"
+msgstr "Codice del primo wizard di FreedomBox - ${secret}"
+
+#. Type: note
+#. Description
+#: ../freedombox.templates:1001
+msgid ""
+"Please note down the above secret. You will be asked to enter this in the "
+"first screen after you launch the FreedomBox web interface. In case you lose "
+"it, you can retrieve it by running the following command:"
+msgstr ""
+"Annotare il codice indicato sopra. Sarà richiesto di inserirlo nella prima "
+"schermata dopo l'avvio dell'interfaccia web di FreedomBox. Qualora venisse "
+"perso, sarebbe possibile recuperarlo eseguendo il comando seguente:"

debian/po/nl.po

@@ -0,0 +1,39 @@
+# Dutch translation of plinth debconf templates.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the plinth package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+# Frans Spiesschaert <Frans.Spiesschaert@yucom.be>, 2018.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: plinth_19.21\n"
+"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
+"POT-Creation-Date: 2019-11-18 18:11-0500\n"
+"PO-Revision-Date: 2019-12-02 21:04+0100\n"
+"Last-Translator: Frans Spiesschaert <Frans.Spiesschaert@yucom.be>\n"
+"Language-Team: Debian Dutch l10n Team <debian-l10n-dutch@lists.debian.org>\n"
+"Language: nl\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+"X-Generator: Poedit 2.2.1\n"
+
+#. Type: note
+#. Description
+#: ../templates:1001
+msgid "FreedomBox first wizard secret - ${secret}"
+msgstr "Geheime code voor de initiële wizard van FreedomBox - ${secret}"
+
+#. Type: note
+#. Description
+#: ../templates:1001
+msgid ""
+"Please note down the above secret. You will be asked to enter this in the "
+"first screen after you launch the FreedomBox web interface. In case you lose "
+"it, you can retrieve it by running the following command:"
+msgstr ""
+"Noteer bovenstaande geheime code. Er zal u gevraagd worden om ze in het "
+"openingsscherm in te voeren wanneer u de FreedomBox-interface opstart. In "
+"geval u ze kwijtraakt, kunt u ze terughalen door het volgende commando uit "
+"te voeren:"

debian/po/pt.po

@@ -0,0 +1,40 @@
+# Translation of plinth debconf templates to Portuguese
+# Copyright (C) 2019 FreedomBox packaging team <freedombox-pkg-team@lists.alioth.debian.org>
+# This file is distributed under the same license as the plinth package.
+# Rui Branco - DebianPT <ruipb@debianpt.org>, 2018.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: plinth 0.37.0\n"
+"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
+"POT-Creation-Date: 2019-11-18 18:11-0500\n"
+"PO-Revision-Date: 2018-09-27 15:33+0100\n"
+"Last-Translator: Rui Branco - DebianPT <ruipb@debianpt.org>\n"
+"Language-Team: Portuguese <traduz@debianpt.org>\n"
+"Language: pt\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../templates:1001
+msgid "FreedomBox first wizard secret - ${secret}"
+msgstr "Primeiro segredo FreedomBox - ${secret}"
+
+#. Type: note
+#. Description
+#: ../templates:1001
+#, fuzzy
+#| msgid ""
+#| "Please save this string. You will be asked to enter this in the first "
+#| "screen after you launch the FreedomBox interface. In case you lose it, "
+#| "you can find it in the file /var/lib/plinth/firstboot-wizard-secret."
+msgid ""
+"Please note down the above secret. You will be asked to enter this in the "
+"first screen after you launch the FreedomBox web interface. In case you lose "
+"it, you can retrieve it by running the following command:"
+msgstr ""
+"Por favor guarde esta 'string'. Ser-lhe-á pedido para a introduzir na "
+"primeira tela assim que lance a interface FreedomBox. No caso de a perder, "
+"poderá encontrá-la no ficheiro /var/lib/plinth/firstboot-wizard-secret."

debian/po/pt_BR.po

@@ -0,0 +1,36 @@
+# Debconf translations for plinth.
+# Copyright (C) 2020 THE plinth'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the plinth package.
+# Adriano Rafael Gomes <adrianorg@debian.org>, 2020.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: plinth 20.11\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2020-06-24 18:00+0000\n"
+"PO-Revision-Date: 2020-06-24 20:14-0300\n"
+"Last-Translator: Adriano Rafael Gomes <adrianorg@debian.org>\n"
+"Language-Team: Brazilian Portuguese <debian-l10n-portuguese@lists.debian."
+"org>\n"
+"Language: pt_BR\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../freedombox.templates:1001
+msgid "FreedomBox first wizard secret - ${secret}"
+msgstr "Segredo do primeiro assistente do FreedomBox - ${secret}"
+
+#. Type: note
+#. Description
+#: ../freedombox.templates:1001
+msgid ""
+"Please note down the above secret. You will be asked to enter this in the "
+"first screen after you launch the FreedomBox web interface. In case you lose "
+"it, you can retrieve it by running the following command:"
+msgstr ""
+"Por favor, anote o segredo acima. Você deverá informá-lo na primeira tela "
+"depois de iniciar a interface web do FreedomBox. Caso você o perca, você "
+"poderá recuperá-lo executando o seguinte comando:"

debian/po/ru.po

@@ -0,0 +1,38 @@
+# Russian translation of plinth debconf template.
+# Copyright (C) 2019 FreedomBox packaging team <freedombox-pkg-team@lists.alioth.debian.org>
+# This file is distributed under the same license as the plinth package.
+# Lev Lamberov <dogsleg@debian.org>, 2020.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: plinth\n"
+"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
+"POT-Creation-Date: 2019-11-18 18:11-0500\n"
+"PO-Revision-Date: 2020-02-10 10:17+0500\n"
+"Last-Translator: Lev Lamberov <dogsleg@debian.org>\n"
+"Language-Team: Debian L10n Russian <debian-l10n-russian@lists.debian.org>\n"
+"Language: ru\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: Poedit 2.2.4\n"
+"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n"
+"%10<=4 && (n%100<12 || n%100>14) ? 1 : 2);\n"
+
+#. Type: note
+#. Description
+#: ../templates:1001
+msgid "FreedomBox first wizard secret - ${secret}"
+msgstr "Секретная строка мастера настройки FreedomBox - ${secret}"
+
+#. Type: note
+#. Description
+#: ../templates:1001
+msgid ""
+"Please note down the above secret. You will be asked to enter this in the "
+"first screen after you launch the FreedomBox web interface. In case you lose "
+"it, you can retrieve it by running the following command:"
+msgstr ""
+"Запишите эту секретную строку. Вам будет необходимо ввести её на самом "
+"первом экране после запуска веб-интерфейса FreedomBox. Если вы потеряете эту "
+"строку, то вы сможете получить её, выполнив следующую команду:"

debian/po/sq.po

@@ -0,0 +1,37 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the plinth package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: plinth\n"
+"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
+"POT-Creation-Date: 2019-11-18 18:11-0500\n"
+"PO-Revision-Date: 2021-04-14 11:43+0300\n"
+"Language-Team: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: Poedit 2.4.2\n"
+"Last-Translator: Besnik Bleta <besnik@programeshqip.org>\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+"Language: sq\n"
+
+#. Type: note
+#. Description
+#: ../templates:1001
+msgid "FreedomBox first wizard secret - ${secret}"
+msgstr "E fshehtë për skenën e parë të ndihmësit FreedomBox - ${secret}"
+
+#. Type: note
+#. Description
+#: ../templates:1001
+msgid ""
+"Please note down the above secret. You will be asked to enter this in the "
+"first screen after you launch the FreedomBox web interface. In case you lose "
+"it, you can retrieve it by running the following command:"
+msgstr ""
+"Ju lutemi, mbajeni shënim të fshehtën më sipër. Do t’ju kërkohet ta jepni "
+"këtë në skenën e parë pasi të vini në punë ndërfaqen web të FreedomBox-it. "
+"Po e humbët, mund ta rimerrni duke xhiruar urdhrin vijues:"

debian/po/sv.po

@@ -0,0 +1,35 @@
+# Translation of freedombox 23.13 debconf to Swedish.
+# Copyright (C) 2011-2023 FreedomBox Authors
+# This file is distributed under the same license as the freedombox package.
+# Peter Kvillegård <quat@sdfeu.org>, 2023
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: freedombox 23.13\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2023-07-21 16:31+0000\n"
+"PO-Revision-Date: 2023-07-22 15:55+0200\n"
+"Last-Translator: Peter Kvillegård <quat@sdfeu.org>\n"
+"Language-Team: Swedish <debian-l10n-swedish@lists.debian.org>\n"
+"Language: sv\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../freedombox.templates:1001
+msgid "FreedomBox first wizard secret - ${secret}"
+msgstr "Hemlighet för FreedomBox första guidade installerare - ${secret}"
+
+#. Type: note
+#. Description
+#: ../freedombox.templates:1001
+msgid ""
+"Please note down the above secret. You will be asked to enter this in the "
+"first screen after you launch the FreedomBox web interface. In case you lose "
+"it, you can retrieve it by running the following command:"
+msgstr ""
+"Skriv ner ovanstående hemlighet. Du kommer att bli ombedd att ange den i "
+"den första skärmen efter att du startat FreedomBox webbgränssnitt. Om du "
+"tappar bort den kan den hämtas igen genom att köra följande kommando:"

debian/po/templates.pot

@@ -0,0 +1,33 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the plinth package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: plinth\n"
+"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
+"POT-Creation-Date: 2019-11-18 18:11-0500\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=CHARSET\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../templates:1001
+msgid "FreedomBox first wizard secret - ${secret}"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:1001
+msgid ""
+"Please note down the above secret. You will be asked to enter this in the "
+"first screen after you launch the FreedomBox web interface. In case you lose "
+"it, you can retrieve it by running the following command:"
+msgstr ""

debian/rules

@@ -1,17 +1,7 @@
 #!/usr/bin/make -f
 
-include /usr/share/dpkg/pkg-info.mk
-
 export DH_VERBOSE=1
 export PYBUILD_DESTDIR=debian/tmp
-export PYBUILD_SYSTEM=custom
-export PYBUILD_CONFIGURE_ARGS=make configure
-export PYBUILD_BUILD_ARGS=make PYTHON={interpreter} build
-export PYBUILD_INSTALL_ARGS=make PYTHON={interpreter} DESTDIR={destdir} install
-export PYBUILD_CLEAN_ARGS=make clean
-export PYBUILD_TEST_ARGS=make PYTHON={interpreter} check-tests
-
-FBX_VERSION := $(shell ./run --develop --version | awk 'NF{ print $$NF }')
 
 %:
 	dh $@ --with python3 --buildsystem=pybuild
@@ -23,12 +13,17 @@ override_dh_auto_install-indep:
 	# Ensure the list of dependencies is not empty.
 	test -s debian/freedombox.substvars || exit 1
 
-	# Check that FreedomBox version number is matching.
-ifneq ($(FBX_VERSION),$(DEB_VERSION))
-	>&2 echo "WARNING: FreedomBox version $(FBX_VERSION) does not match package version $(DEB_VERSION)."
-endif
+# pybuild can run pytest. However, when the top level directory is included in
+# the path (done using manage.py), it results in import problems.
+# https://www.mail-archive.com/debian-python@lists.debian.org/msg17997.html
+override_dh_auto_test:
+	PYBUILD_SYSTEM=custom \
+	PYBUILD_TEST_ARGS="{interpreter} -m pytest" dh_auto_test
 
 override_dh_installsystemd:
-	# Do not enable or start any service other than FreedomBox service.
-	dh_installsystemd --package=freedombox plinth.service \
-		freedombox-privileged.socket
+	# Do not enable or start any service other than FreedomBox service. Use
+	# of --tmpdir is a hack to workaround an issue with dh_installsystemd
+	# (as of debhelper 13.5.2) that still has hardcoded search path of
+	# /lib/systemd/system for searching systemd services. See #987989 and
+	# reversion of its changes.
+	dh_installsystemd --tmpdir=debian/tmp/usr --package=freedombox plinth.service

debian/source/lintian-overrides

@@ -5,4 +5,8 @@
 very-long-line-length-in-source-file * [doc/manual/*.raw.wiki:*]
 
 # Misc. files which can't be fixed to have short line lengths.
+very-long-line-length-in-source-file * [plinth/modules/deluge/tests/data/sample.torrent:*]
+very-long-line-length-in-source-file * [plinth/modules/transmission/tests/data/sample.torrent:*]
+very-long-line-length-in-source-file * [doc/visual_design/FreedomBox-Logo.7z:*]
+very-long-line-length-in-source-file * [plinth/modules/i2p/tests/data/router.config:*]
 very-long-line-length-in-source-file * [COPYING.md:*]

debian/tests/access-web-interface

@@ -1,38 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# Wait for FreedomBox first-boot setup to complete and the web server to
-# start listening. App setup order is not deterministic, so a fixed sleep can
-# expire before the apache app configures port 443. Poll instead of guessing.
-echo "Waiting for first-boot setup to complete..."
-
-SETUP_COMPLETE=0
-
-for _ in $(seq 1 120); do
-    if curl --fail --insecure --silent --output /tmp/fbx_status.json \
-            https://localhost/freedombox/status/; then
-
-        if grep -q '"is_first_setup_running"[[:space:]]*:[[:space:]]*false' /tmp/fbx_status.json; then
-            SETUP_COMPLETE=1
-            break
-        fi
-    fi
-    sleep 2
-done
-
-# Print final status in test log
-cat /tmp/fbx_status.json || true
-
-rm -f /tmp/fbx_status.json
-
-journalctl --unit=plinth --unit=freedombox-privileged
-
-# Access FreedomBox interface
-curl --location --cookie "" --fail --write-out "%{response_code}" --insecure \
-     --stderr - https://localhost/freedombox/
-
-if [ "$SETUP_COMPLETE" -eq 0 ]; then
-    echo "Error: first-boot setup did not complete in the allotted time." >&2
-    exit 1
-fi

debian/tests/control

@@ -8,21 +8,10 @@
 #   - Module inititailzation for essential modules
 #
 Test-Command: plinth --list-apps 2> /dev/null
-Restrictions: needs-root, breaks-testbed
+Restrictions: needs-root
 
 #
 # Run unit and integration tests on installed files.
 #
 Test-Command: PYTHONPATH='/usr/lib/python3/dist-packages/' py.test-3 -p no:cacheprovider --cov=plinth --cov-report=html:debci/htmlcov --cov-report=term
-Depends: e2fsprogs, git, python3-pytest, python3-pytest-cov, python3-pytest-django, @
-Restrictions: breaks-testbed
-
-#
-# Try to access the FreedomBox web interface.
-#
-# iptables package installs alternatives files, with iptables-nft as default alternative.
-# Without it, firewalld has this error: INVALID_IPV: 'ipv4' is not a valid backend or is unavailable
-#
-Tests: access-web-interface
-Depends: iptables, @
-Restrictions: needs-root, isolation-machine, breaks-testbed
+Depends: git, python3-openssl, python3-pytest, python3-pytest-cov, python3-pytest-django, python3-tomli | python3-coverage (<< 6.0), @

doc/Makefile

@@ -1,19 +1,21 @@
 #!/usr/bin/make -f
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
+OUTPUTS=freedombox-manual.pdf plinth.1 manual-pages
+
 MANUAL_LANGUAGES=en es
 
 MANUAL_URL="https://wiki.debian.org/{lang-fragment}FreedomBox/Manual?action=show&mimetype=text%2Fdocbook"
 MANUAL_URL_RAW="https://wiki.debian.org/{lang-fragment}FreedomBox/Manual?action=raw"
 MANUAL_PAGE_URL_RAW="https://wiki.debian.org/{page}?action=raw"
 
+DESTDIR=
 INSTALL_DIR=$(DESTDIR)/usr/share/freedombox
-MAN_INSTALL_DIR=$(DESTDIR)/usr/share/man
 SCRIPTS_DIR=scripts
 
 manual-pdfs=$(foreach lang,$(MANUAL_LANGUAGES),manual/$(lang)/freedombox-manual.pdf)
 manual-xmls=$(patsubst %.pdf,%.xml,$(manual-pdfs))
-OUTPUTS=$(manual-pdfs) plinth.1 freedombox-cmd.1
+OUTPUTS=$(manual-pdfs) plinth.1 manual-pages
 
 INSTALL_OPTS=-D --mode=644
 
@@ -30,10 +32,9 @@ ifneq ($(DEBUG),)
 endif
 
 .PHONY: all install
-all: $(OUTPUTS) manual-pages
+all: $(OUTPUTS)
 
 install: all
-	install $(INSTALL_OPTS) -t $(MAN_INSTALL_DIR)/man1 plinth.1
 	for file in $(manual-pages-part-html) $(manual-pdfs); do \
 		install $(INSTALL_OPTS) -t $(INSTALL_DIR)/$$(dirname $${file}) \
 			$${file} ; \
@@ -66,7 +67,7 @@ fetch: $(fetch-main-list) $(fetch-pages-list)
 
 # Remove raw wiki pages and images before fetching to drop items deleted
 # upstream.
-fetch-cleanup-%: lang = $*
+featch-cleanup-%: lang = $*
 $(fetch-cleanup-list): fetch-cleanup-%:
 	rm -f manual/$(lang)/*.raw.wiki
 	rm -f manual/$(lang)/images/*.png manual/$(lang)/images/*.jpg
@@ -109,25 +110,20 @@ manual-pages-xml:=$(patsubst %.raw.wiki, %.xml, $(manual-pages-raw-wiki))
 manual-pages: $(manual-pages-part-html)
 
 $(manual-pdfs): %.pdf: %.xml
-	@echo "[PDF]       $<"
-	@xmlto $(XMLTO_DEBUG_FLAGS) --with-dblatex pdf -o $(dir $@) $< 2> /dev/null
+	xmlto $(XMLTO_DEBUG_FLAGS) --with-dblatex pdf -o $(dir $@) $<
 
 $(manual-pages-part-html): %.part.html: %.xml
-	@echo "[XSLT]      $<"
-	@xsltproc /usr/share/xml/docbook/stylesheet/docbook-xsl/xhtml5/docbook.xsl $< 2> /dev/null | \
+	xsltproc /usr/share/xml/docbook/stylesheet/docbook-xsl/xhtml5/docbook.xsl $< | \
 	perl -pe 'BEGIN {undef $$/} s/.*<body[^>]*>(.*)<\/body\s*>.*/$$1/si' > $@
-	@rm -f docbook.css
+	@rm -f $(dir $@)docbook.css
 
 $(manual-xmls) $(manual-pages-xml): %.xml: %.raw.wiki $(SCRIPTS_DIR)/wikiparser.py
-	@echo "[WIKIPARSE] $<"
-	@$(SCRIPTS_DIR)/wikiparser.py $< | xmllint --format - > $@
+	$(SCRIPTS_DIR)/wikiparser.py $< | xmllint --format - > $@
 
 %.1: %.xml
-	@echo "[MAN]       $<"
-	@xmlto man $< 2> /dev/null
+	xmlto man $<
 
 .PHONY: clean
 clean:
-	@echo "[RM]        {part-htmls} {xmls} {manuals} {outputs}"
-	@rm -f $(manual-pages-part-html) $(manual-pages-xml) $(manual-xmls)
-	@rm -f $(OUTPUTS)
+	rm -f $(manual-pages-part-html) $(manual-pages-xml) $(manual-xmls)
+	rm -f $(OUTPUTS)

doc/dev/README.rst

@@ -19,12 +19,6 @@ Install the following Debian packages:
 
 * python3-sphinx
 * python3-sphinx-autobuild
-* python3-sphinx-book-theme
-* python3-django
-* python3-django-axes
-* python3-django-captcha
-* python3-django-ipware
-* python3-django-stronghold
 
 If your preferred text editor doesn't have support for the reStructuredText
 format, you can install a simple desktop application called ReText. It has live

doc/dev/_templates/layout.html

@@ -0,0 +1,15 @@
+{%- extends "alabaster/layout.html" %}
+
+{%- block footer %}
+  <div class="footer">
+    {% if show_copyright %}&copy;{{ copyright }} | {% endif %}
+    Licensed under the <a href="https://creativecommons.org/licenses/by-sa/4.0/">
+    CC BY-SA 4.0</a> license
+    {%- if show_source and has_source and sourcename %}
+      {% if show_copyright or theme_show_powered_by %}|{% endif %}
+      <a href="{{ pathto('_sources/' + sourcename, true)|e }}"
+         rel="nofollow">{{ _('Page source') }}</a>
+    {%- endif %}
+  </div>
+
+{% endblock %}

doc/dev/conf.py

@@ -15,19 +15,14 @@ list see the documentation: http://www.sphinx-doc.org/en/master/config
 #
 import os
 import sys
-from datetime import datetime
-
-import django
 
 sys.path.insert(0, os.path.abspath('../../'))
-os.environ['DJANGO_SETTINGS_MODULE'] = 'plinth.settings'
-django.setup()
 
 # -- Project information -----------------------------------------------------
 
 # pylint: disable=invalid-name
 project = 'FreedomBox'
-copyright = f'2021-{datetime.now().year}'
+copyright = '2021-2023, FreedomBox Authors'
 author = 'FreedomBox Authors'
 
 # The short X.Y version
@@ -83,23 +78,15 @@ pygments_style = None
 # The theme to use for HTML and HTML Help pages.  See the documentation for
 # a list of builtin themes.
 #
-html_theme = 'sphinx_book_theme'
+html_theme = 'alabaster'
 
 # Theme options are theme-specific and customize the look and feel of a theme
 # further.  For a list of options available for each theme, see the
 # documentation.
 #
 html_theme_options = {
-    'home_page_in_toc': True,
-    'repository_provider': 'gitlab',
-    'repository_url': 'https://salsa.debian.org/freedombox-team/freedombox/',
-    'use_edit_page_button': True,
-    'use_source_button': True,
-    'use_repository_button': True,
-    'use_issues_button': True,
-    'path_to_docs': 'doc/dev/',
-    'extra_footer': 'Licensed under the <a href="https://creativecommons.org/'
-                    'licenses/by-sa/4.0/">CC BY-SA 4.0</a> license.',
+    'fixed_sidebar': True,
+    'show_related': True,
 }
 
 # Add any paths that contain custom static files (such as style sheets) here,
@@ -215,11 +202,13 @@ autodoc_mock_imports = [
     'captcha',
     'cherrypy',
     'configobj',
-    'cryptography',
     'dbus',
+    'django',
     'gi',
     'markupsafe',
+    'OpenSSL',
     'pam',
+    'paramiko',
     'psutil',
     'pytest',
     'requests',
@@ -230,4 +219,3 @@ autodoc_mock_imports = [
 ]
 
 html_favicon = './_static/favicon.ico'
-html_logo = './_static/logo.svg'

doc/dev/reference/components/container.rst

@@ -1,7 +0,0 @@
-.. SPDX-License-Identifier: CC-BY-SA-4.0
-
-Container
-^^^^^^^^^
-
-.. autoclass:: plinth.container.Container
-   :members:

doc/dev/reference/components/daemon.rst

@@ -8,6 +8,3 @@ Daemon
 
 .. autoclass:: plinth.daemon.RelatedDaemon
    :members:
-
-.. autoclass:: plinth.daemon.SharedDaemon
-   :members:

doc/dev/reference/components/index.rst

@@ -4,7 +4,6 @@ Components
 ----------
 
 .. toctree::
-   :maxdepth: 2
    :caption: Available components:
 
    info
@@ -22,7 +21,6 @@ Components
    staticfiles
    backups
    coturn
-   container
 
 Base Classes
 ^^^^^^^^^^^^
@@ -39,8 +37,8 @@ Base Classes
 Other Classes
 ^^^^^^^^^^^^^
 
-.. autoclass:: plinth.diagnostic_check.DiagnosticCheck
+.. autoclass:: plinth.modules.diagnostics.check.DiagnosticCheck
    :members:
 
-.. autoclass:: plinth.diagnostic_check.Result
+.. autoclass:: plinth.modules.diagnostics.check.Result
    :members:

doc/dev/reference/components/webserver.rst

@@ -6,5 +6,5 @@ Webserver
 .. autoclass:: plinth.modules.apache.components.Webserver
    :members:
 
-.. autoclass:: plinth.modules.apache.components.WebserverRoot
+.. autoclass:: plinth.modules.apache.components.Uwsgi
    :members:

doc/dev/reference/index.rst

@@ -11,7 +11,6 @@ all the FreedomBox apps currently reside in FreedomBox source repository itself
 and are updated when the API is updated.
 
 .. toctree::
-   :maxdepth: 2
 
    app
    components/index

doc/dev/tutorial/components.rst

@@ -30,21 +30,23 @@ function normally.
       def __init__(self):
         ...
 
-        info = app_module.Info(
-            app_id=self.app_id, version=1, name=_('Transmission'),
-            icon_filename='transmission', description=_description,
-            manual_page='Transmission', clients=manifest.clients,
-            donation_url='https://transmissionbt.com/donate/',
-            tags=manifest.tags)
+        info = app_module.Info(app_id=self.app_id, version=1,
+                               name=_('Transmission'),
+                               icon_filename='transmission',
+                               short_description=_('BitTorrent Web Client'),
+                               description=description,
+                               manual_page='Transmission',
+                               clients=manifest.clients,
+                               donation_url='https://transmissionbt.com/donate/')
         self.add(info)
 
 The first argument is app_id that is same as the ID for the app. The version is
 the version number for this app that must be incremented whenever setup() method
-needs to be called again. name, icon_filename, description, manual_page,
-clients, and tags provide information that is shown on the app's main page. The
-donation_url encourages our users to contribute to upstream projects in order
-ensure their long term sustainability. More information about the parameters is
-available in :class:`~plinth.app.Info` class documentation.
+needs to be called again. name, icon_filename, short_description, description,
+manual_page and clients provide information that is shown on the app's main
+page. The donation_url encourages our users to contribute to upstream projects
+in order ensure their long term sustainability. More information about the
+parameters is available in :class:`~plinth.app.Info` class documentation.
 
 The description of app should provide basic information on what the app is about
 and how to use it. It is impractical, however, to explain everything about the
@@ -291,8 +293,10 @@ file ``transmission-plinth.conf``, add the following.
 
   <Location /transmission>
       ...
-      Use AuthOpenIDConnect
-      Use RequireGroup bit-torrent
+      Include          includes/freedombox-single-sign-on.conf
+      <IfModule mod_auth_pubtkt.c>
+          TKTAuthToken "admin" "bit-torrent"
+      </IfModule>
   </Location>
 
 Showing a shortcut in the front page
@@ -318,24 +322,22 @@ when they visit FreedomBox. To provide this shortcut, a
       def __init__(self):
           ...
 
-          shortcut = frontpage.Shortcut('shortcut-transmission', info.name,
-                                        icon=info.icon_filename,
-                                        url='/transmission',
-                                        clients=info.clients, tags=info.tags,
-                                        login_required=True,
-                                        allowed_groups=list(groups))
+          shortcut = frontpage.Shortcut(
+              'shortcut-transmission', name, short_description=short_description,
+              icon='transmission', url='/transmission', clients=clients,
+              login_required=True, allowed_groups=[group[0]])
           self.add(shortcut)
 
-The first parameter, as usual, is a unique ID. The next two parameters are basic
-information about the app similar to the menu item. The URL parameter specifies
-the URL that the user should be directed to when the shortcut is clicked. This
-is the web interface provided by our app. The next parameter provides a list of
-clients. This is useful for the FreedomBox mobile app when the information is
-used to suggest installing mobile apps. This is described in a later section of
-this tutorial. The next parameter specifies the list of tags to show on the
-shortcut. The next parameter specifies whether anonymous users who are not
-logged into FreedomBox should be shown this shortcut. The final parameter
-further restricts to which group of users this shortcut must be shown.
+The first parameter, as usual, is a unique ID. The next three parameters are
+basic information about the app similar to the menu item. The URL parameter
+specifies the URL that the user should be directed to when the shortcut is
+clicked. This is the web interface provided by our app. The next parameter
+provides a list of clients. This is useful for the FreedomBox mobile app when
+the information is used to suggest installing mobile apps. This is described in
+a later section of this tutorial. The next parameter specifies whether anonymous
+users who are not logged into FreedomBox should be shown this shortcut. The
+final parameter further restricts to which group of users this shortcut must be
+shown.
 
 Adding backup/restore functionality
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

doc/dev/tutorial/other.rst

@@ -89,23 +89,22 @@ the Django's localization methods to make that happen.
 
         info = app_module.Info(...
                                name=_('Transmission'),
-                               description=[_('Transmission is a...'),
-                                            _('BitTorrent is a peer-to-peer...')],
                                ...
-                               tags=[_('File sharing'), _('BitTorrent'), ...])
+                               short_description=_('BitTorrent Web Client'),
                                ...)
 
-Notice that the app's name, description, tags, etc. are wrapped in the ``_()``
-method calls. This needs to be done for the rest of our app. We use the
+Notice that the app's name, description, etc. are wrapped in the ``_()`` method
+call. This needs to be done for the rest of our app. We use the
 :obj:`~django.utils.translation.gettext_lazy` in some cases and we use the
-regular :obj:`~django.utils.translation.gettext` in other cases. This is because
-in the second case the :obj:`~django.utils.translation.gettext` lookup is made
-once and reused for every user looking at the interface. These users may each
-have a different language set for their interface. Lookup made for one language
-for a user should not be used for other users. The ``_lazy`` methods provided by
-Django makes sure that the return value is an object that will actually be
-converted to string at the final moment when the string is being displayed. In
-the first case, the lookup is made and string is returned immediately.
+regular :obj:`~django.utils.translation.gettext` in other cases. This is
+because in the second case the :obj:`~django.utils.translation.gettext` lookup
+is made once and reused for every user looking at the interface. These users may
+each have a different language set for their interface. Lookup made for one
+language for a user should not be used for other users. The ``_lazy`` methods
+provided by Django makes sure that the return value is an object that will
+actually be converted to string at the final moment when the string is being
+displayed. In the first case, the lookup is made and string is returned
+immediately.
 
 All of this is the usual way internationalization is done in Django. See
 :doc:`Internationalization and localization <django:topics/i18n/index>`

doc/dev/tutorial/skeleton.rst

@@ -40,11 +40,11 @@ in a step-by-step manner::
 The file ``__init__.py`` indicates that the directory in which it is present is
 a Python module. For now, it is an empty file.
 
-FreedomBox's build system will automatically install the
+FreedomBox's setup script ``setup.py`` will automatically install the
 ``plinth/modules/transmission`` directory (along with other files described
 later) to an appropriate location. If you are creating an app that stays
-independent and outside of FreedomBox source tree, then build system in your
-source tree will need to install it to a proper location on the system. The
+independent and outside of FreedomBox source tree, then ``setup.py`` script in
+your source tree will need to install it to a proper location on the system. The
 ``plinth/modules/`` directory is a Python3 `namespace package
 <https://www.python.org/dev/peps/pep-0420/>`_. So, you can install it with the
 ``plinth/modules/`` directory structure into any Python path and still be
@@ -64,11 +64,12 @@ us create this file ``transmission``:
   plinth.modules.transmission
 
 This file is automatically installed to
-``/usr/share/freedombox/modules-enabled/`` by FreedomBox's build system. If we
-are writing a module that resides independently outside the FreedomBox's source
-code, the setup script will need to copy it to the target location. Further, it
-is not necessary for the app to be part of the ``plinth.modules`` namespace. It
-can, for example, be ``freedombox_transmission``.
+``/usr/share/freedombox/modules-enabled/`` by FreedomBox's installation script
+``setup.py``. If we are writing a module that resides independently outside the
+FreedomBox's source code, the setup script will need to copy it to the target
+location. Further, it is not necessary for the app to be part of the
+``plinth.modules`` namespace. It can, for example, be
+``freedombox_transmission``.
 
 Creating the App class
 ^^^^^^^^^^^^^^^^^^^^^^

doc/dev/tutorial/view.rst

@@ -45,7 +45,7 @@ a link in FreedomBox web interface. Let us add a link in the apps list. In
           ...
 
           menu_item = menu.Menu('menu-transmission', 'Transmission',
-                                'transmission', info.tags,
+                                'BitTorrrent Web Client', 'transmission',
                                 'transmission:index', parent_url_name='apps')
           self.add(menu_item)
 
@@ -61,12 +61,12 @@ menu item we want to present.
 * The second parameter is the display name to use for our menu item which
   happens to be the name of the app as well.
 
-* The third parameter is the name of the icon to use when showing the menu
+* The third parameter is a short description for the menu item.
+
+* The fourth parameter is the name of the icon to use when showing the menu
   item. An SVG file and a PNG should be created in the
   ``plinth/modules/transmission/static/icons/`` directory.
 
-* The fourth parameter is the list of tags to show on the menu item.
-
 * The fifth parameter is the URL that the user should be directed to when the
   menu item is clicked. This is a Django URL name and we have already created a
   URL with this name. Note that when including our app's URLs, FreedomBox will

doc/freedombox-cmd.xml

@@ -1,160 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN" "http://www.docbook.org/xml/4.4/docbookx.dtd">
-<!--
-# SPDX-License-Identifier: AGPL-3.0-or-later
--->
-<refentry>
-  <refmeta>
-    <refentrytitle><application>freedombox-cmd</application></refentrytitle>
-    <manvolnum>1</manvolnum>
-    <refmiscinfo class="manual">FreedomBox Command Line Utility</refmiscinfo>
-    <refmiscinfo class="version"> </refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname><application>freedombox-cmd</application></refname>
-    <refpurpose>
-      command line utility to perform FreedomBox operations
-    </refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>freedombox-cmd</command>
-      <arg><option>-h, </option><option>--help</option></arg>
-      <arg choice="req">module</arg>
-      <arg choice="req">action</arg>
-      <arg><option>--no-args</option></arg>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>Description</title>
-    <para>
-      FreedomBox is a community project to develop, design and promote
-      personal servers running free software for private, personal
-      communications.  It is a networking appliance designed to allow
-      interfacing with the rest of the Internet under conditions of
-      protected privacy and data security.  It hosts applications such
-      as blog, wiki, website, social network, email, web proxy and a
-      Tor relay on a device that can replace a wireless router so that
-      data stays with the users.
-    </para>
-    <para>
-      freedombox-cmd is a command line interface to some of the operations
-      performed by FreedomBox. It is typically not needed by the end users who
-      use FreedomBox's web interface. The command may be used in some cases
-      while debugging problems, especially where the web interface is not
-      accessible or when a piece of functionality that is not provided in the
-      web interface needs to be triggered.
-    </para>
-    <para>
-      The command is simply a client to the FreedomBox's privileged daemon and
-      relays user's request to it. It waits for the request to complete and
-      prints the output of the operation or an error message collected form the
-      daemon. The daemon only allows connections from an pre-allowed list of
-      user accounts. So, be sure to run the command as 'root' superuser.
-    </para>
-  </refsect1>
-
-  <refsect1>
-    <title>Options</title>
-    <variablelist>
-      <varlistentry>
-        <term><option>module</option></term>
-        <listitem>
-          <para>
-            Name of the module from which to execute an action.
-          </para>
-        </listitem>
-      </varlistentry>
-      <varlistentry>
-        <term><option>action</option></term>
-        <listitem>
-          <para>
-            Name of the action to execute. It should found in the provided
-            module.
-          </para>
-        </listitem>
-      </varlistentry>
-      <varlistentry>
-        <term><option>--no-args</option></term>
-        <listitem>
-          <para>
-            Don't try to read the arguments to the command on the standard
-            input. Instead, assume that the operation does not have any
-            arguments and execute the method without arguments.
-          </para>
-        </listitem>
-      </varlistentry>
-      <varlistentry>
-        <term><option>--help</option></term>
-        <listitem>
-          <para>
-            Show brief help about arguments allowed for this command.
-          </para>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-  </refsect1>
-
-  <refsect1>
-    <title>Examples</title>
-
-    <example>
-      <title>Re-run FreedomBox network setup</title>
-      <synopsis>$ sudo freedombox-cmd networks setup --no-args</synopsis>
-      <para>
-        When FreedomBox starts for the first time, it will setup Network Manager
-        connections suitable for the hardware found. If you wish to re-create
-        these connections at a later time, you can re-run setup for the Networks
-        app using the web interface or run this command on a terminal.
-      </para>
-    </example>
-
-    <example>
-      <title>Delete a user account from LDAP database</title>
-      <synopsis>$ echo '{"args": ["USERNAME", "AUTH_USER", "AUTH_PASSWORD"], "kwargs": {}}' | sudo freedombox-cmd users remove_user</synopsis>
-      <para>
-        USERNAME is the name of the user account that must be removed. AUTH_USER
-        is name of the user account that is authorizing this operation.
-        AUTH_PASSWORD is the password for user account that is authorizing this
-        operation. This operation may be needed if FreedomBox's sqlite3 database
-        is wiped, removing the user accounts in the database but the
-        corresponding entries from LDAP database are not removed. A new user
-        with that name can't be created until the LDAP account is also removed.
-      </para>
-    </example>
-
-    <example>
-      <title>Set the logging mode to persistent</title>
-      <synopsis>$ echo '{"args": ["persistent"], "kwargs": {}}' | sudo freedombox-cmd config set_logging_mode</synopsis>
-      <para>
-        By default, FreedomBox sets up systemd-journald to 'volatile' logging.
-        This means that logs will not be stored on the disk and will be lost
-        after a reboot. If you are tackling a problem and wish to store the logs
-        persistently, you can change the setting in the web interface or run
-        this command.
-      </para>
-    </example>
-  </refsect1>
-
-  <refsect1>
-    <title>Bugs</title>
-    <para>
-      See <ulink
-      url="https://salsa.debian.org/freedombox-team/freedombox/issues">FreedomBox
-      issue tracker</ulink> for a full list of known issues and TODO items.
-    </para>
-  </refsect1>
-
-  <refsect1>
-    <title>Author</title>
-    <para>
-      <author>
-        <firstname>FreedomBox Developers</firstname>
-        <contrib>Original author</contrib>
-      </author>
-    </para>
-  </refsect1>
-</refentry>

doc/manual/en/A20-OLinuXino-Lime2.raw.wiki

@@ -43,7 +43,7 @@ An alternative to downloading these images is to [[InstallingDebianOn/Allwinner|
 
 === Known Issues ===
 
- * Revision G2 (written on the board): The current stable Debian11/bullseye image (from 2021-08-27) '''will not start an Ethernet connection!''' This means you can not continue with the installation process at first. This can be fixed by following [[https://wiki.debian.org/InstallingDebianOn/Allwinner#Olimex_A20-OLinuXino-LIME2__rev._F_and_newer_and_Debian11.2F_bullseye_kernel | this description]] after you [[https://wiki.debian.org/FreedomBox/Download#Installation | copied the image to your SD card]]. Or you Download and use the [[https://ftp.freedombox.org/pub/freedombox/hardware/pioneer/|Pioneer Edition image]] to fix the issue. It contains a slightly [[https://salsa.debian.org/freedombox-team/u-boot/commit/2cb18893ef|modified u-boot]].
+ * Revision G2 (written on the board): The current stable Debian11/bullseye image (from 2021-08-27) '''will not start an Ethernet connection!''' This means you can not continue with the installation process at first. This can be fixed by following [[https://wiki.debian.org/InstallingDebianOn/Allwinner#Olimex_A20-OLinuXino-LIME2__rev._F_and_newer_and_Debian11.2F_bullseye_kernel | this description]] after you [[https://wiki.debian.org/FreedomBox/Download#Installation | copied the image to your SD card]]. Or you Download and use the [[https://ftp.freedombox.org/pub/freedombox/pioneer/|Pioneer Edition image]] to fix the issue. It contains a slightly [[https://salsa.debian.org/freedombox-team/u-boot/commit/2cb18893ef|modified u-boot]].
  * Revision G2 hardware has also [[DebianBug:927397|poor performance when transmitting Ethernet data in Gigabit mode]] for older FreedomBox releases. The procedure above or for rev. C fixes this.
 
  * Revision C hardware has [[DebianBug:845128|poor performance when receiving Ethernet data in Gigabit mode]]. To workaround the problem, you can switch to 100 Mbps mode instead of Gigabit mode. Login to your !FreedomBox as root (or plugin the SD card into another computer) and create the file /etc/NetworkManager/dispatcher.d/20-fix-ethernet-problem with the following contents:

doc/manual/en/APU.raw.wiki

@@ -2,7 +2,7 @@
 
 {{attachment:apu1d.jpg|PC Engines APU 1D|width=632,height=319}}
 
-[[https://www.pcengines.ch/apu.htm|PC Engines APU]] boards are single board computers with 3 Gigabit ethernet ports, a powerful AMD64 APU and Coreboot firmware.  !FreedomBox images built for AMD64 machines are tested to work well for [[http://www.pcengines.ch/apu1d.htm|APU1D]] and [[http://www.pcengines.ch/apu3b2.htm|APU3B ]] models and are expected to work also well on the other, very similar versions.
+[[http://www.pcengines.ch/apu1d.htm|PC Engines APU 1D]] is a single board computer with 3 Gigabit ethernet ports, a powerful AMD APU and Coreboot firmware.  !FreedomBox images built for AMD64 machines are tested to work well for it.
 
 '''Important:''' Read [[FreedomBox/Hardware|general advice]] about hardware before building a !FreedomBox with this single board computer.
 
@@ -21,26 +21,31 @@ Although untested, the following similar hardware is also likely to work well wi
   * [[http://www.pcengines.ch/apu2c4.htm|apu2c4]]
   * [[http://www.pcengines.ch/apu3a2.htm|apu3a2]]
   * [[http://www.pcengines.ch/apu3a4.htm|apu3a4]]
+  * [[http://www.pcengines.ch/apu3b2.htm|apu3b2]]
   * [[http://www.pcengines.ch/apu3b4.htm|apu3b4]]
 
-=== Installation ===
+ * Using i386 image:
+  * [[http://www.pcengines.ch/alix1d.htm|alix1d]]
+  * [[http://www.pcengines.ch/alix1e.htm|alix1e]]
+  * [[http://www.pcengines.ch/alix2d2.htm|alix2d2]]
+  * [[http://www.pcengines.ch/alix2d3.htm|alix2d3]]
+  * [[http://www.pcengines.ch/alix2d13.htm|alix2d13]]
+  * [[http://www.pcengines.ch/alix3d2.htm|alix3d2]]
+  * [[http://www.pcengines.ch/alix3d3.htm|alix3d3]]
+  * [[http://www.pcengines.ch/alix6f2.htm|alix6f2]]
+
+=== Download ===
 
 !FreedomBox disk [[FreedomBox/Download|images]] for this hardware are available.  Follow the instructions on the [[FreedomBox/Download|download]] page to create a !FreedomBox SD card, USB disk, SSD or hard drive and boot into !FreedomBox.  Pick the image meant for all amd64 machines.
 
 An alternative to downloading these images is to [[InstallingDebianOn/Alix3d2|install Debian]] on the APU and then [[FreedomBox/Hardware/Debian|install FreedomBox]] on it.
 
-An [[https://github.com/huubsch/APU-Installation-HomeAssistant-Freedombox|installation manual]] tested on the APU3B is available on GitHub, including flashing with UEFI-BIOS
-
 === Networking ===
 
 The first network port, the left most one in the above picture, is configured by !FreedomBox to be an upstream Internet link and the remaining 2 ports are configured for local computers to connect to.
 
 === Availability ===
 
-PCEngines announced the [[https://www.pcengines.ch/eol.htm|phase-out]] of these boards in June 2023.
-
-In 2024 [[https://pcengines.github.io/|Dasharo announced the support of APU-boards]] : coreboot + SeaBIOS and coreboot+UEFI.
-
  * Price: 110 - 170 USD (depending on the board and supplier)
  * [[http://www.pcengines.ch/order.htm|PC Engines]]
  * [[http://www.pcengines.ch/order.htm|Full list of suppliers]]
@@ -48,17 +53,18 @@ In 2024 [[https://pcengines.github.io/|Dasharo announced the support of APU-boar
 === Hardware ===
 
  * Open Hardware: No
- * CPU: [[http://www.amd.com/en-gb/products/embedded/processors/g-series|AMD G series T40E]]; [[https://teklager.se/en/amd-gx-412tc-cpu-specification/|GX-412TC]], 1 GHz quad core (depending on model)
- * RAM: 2 GB DDR3-1066 DRAM - 4 GB (depending on model)
- * Storage: SD card, External USB, mSATA module
+ * CPU: [[http://www.amd.com/en-gb/products/embedded/processors/g-series|AMD G series T40E]]
+ * RAM: 2 GB DDR3-1066 DRAM
+ * Storage: SD card, External USB
  * Architecture: amd64
  * Ethernet: 3 Gigabit Ethernet ports
- * WiFi: wle200nx / wle600vx / wle900vx miniPCI express wireless modules
- * SATA: 1 mSATA-module and 1 SATA
+ * !WiFi: None, use a [[FreedomBox/Hardware/USBWiFi|USB WiFi device]]
+ * SATA: 1 m-SATA and 1 SATA
 
 === Non-Free Status ===
 
  * Non-free blobs required: No
+ * !WiFi: Not available
  * Boot firmware: [[http://www.pcengines.ch/apu1d.htm|Coreboot]]
 
 ## END_INCLUDE
@@ -66,4 +72,4 @@ In 2024 [[https://pcengines.github.io/|Dasharo announced the support of APU-boar
 <<Include(FreedomBox/Portal)>>
 
 ----
-CategoryFreedomBox CategoryFreedomBox
+CategoryFreedomBox

doc/manual/en/Apache_userdir.raw.wiki

@@ -14,15 +14,13 @@
 
 === What is User Websites? ===
 
-User websites is a feature that allows any (even non-admin) user on a !FreedomBox to host their own website simply by copying files to well known location in their home directory on the !FreedomBox server. The URL for the website will look like `https://mydomain.example/~myusername/`. The website will be available on the local network and/or the internet according to the network and firewall setup. If the copied files are HTML pages, they will show up as a website. If they are other types of files such as photos or documents. A list of those files is shown and a visitor will be able to view or download them.
+User websites is a standard location for webservers to allow host users to expose static files on the filesystem as a website to the local network and/or the internet according to the network and firewall setup.
 
-Apache is the web server used in !FreedomBox and this feature is implemented using an Apache module.
+The standard webserver in !FreedomBox is Apache and this is implemented by means of a specific Apache module.
 
 === Screenshot ===
 
-{{attachment:user-websites-folder.png|User Website copied to FreedomBox using GNOME File Browser}}
-
-{{attachment:user-websites-browser.png|User Website accessed using a browser}}
+/* Add when/if an interface is made for FreedomBox */
 
 === Using User Websites ===
 
@@ -32,8 +30,9 @@ To serve documents, place the files in the designated directory in a !FreedomBox
 
 This directory is: '''public_html'''
 
-Thus, the absolute path for the directory of a user named ''fbx'' with home directory in ''/home/fbx'' will be '''/home/fbx/public_html'''.
-The User Websites feature will serve documents placed in this directory when requests for documents with the URI path ''~fbx'' are received. For example, if  `mydomain.example` is your domain then a request for the URL `https://mydomain.example/~fbx/photo.jpg` will display the file in `/home/fbx/public_html/photo.jpg`. If a file named ''index.html'' is placed in the directory, it will shown when no file name is provided in the URL. So, the URL `https://mydomain.example/~fbx/` will show the HTML page `/home/fbx/public_html/index.html`
+Thus the absolute path for the directory of a user named fbx with home directory in /home/fbx will be '''/home/fbx/public_html'''.
+User websites will serve documents placed in this directory when requests for documents with the URI path "~fbx" are received. For the the `example.org` domain thus a request for the document `example.org/~fbx/index.html` will transfer the file in `/home/fbx/public_html/index.html`.
+
 
 === Creating public_html folder and uploading documents ===
 
@@ -45,7 +44,7 @@ Linux standard desktop file managers use to support remote filesystem access thr
     * Gnome's Nautilus:
       1. To lauch Nautilus you can seek its archive icon, or search ether its name or the word "file".
       1. At the bottom of the left pane you'll find an option "+ Other locations".
-      1. It leads you to a list of locations. Find "`freedombox SFTP server`" (english literal for all desktop languages). Click on it. If you don't find this, you can instead type `sftp://username@freedombox.local` in the address bar.
+      1. It leads you to a list of locations. Find "`freedombox SFTP server`" (english literal for all desktop languages). Click on it.
       1. The first time you'll be asked for your user and password. Enter your !FreedomBox user and its password. The dialog will also offer you some options to remember it for some time.
     * Plasma file manager AKA Dolphin:
       1. Click on the location bar at the top of the window.
@@ -77,8 +76,7 @@ Usually any Unix system, including Linux in all (most) of its flavours and Mac,
 Examples:
 
 Connect to !FreedomBox via SSH:
- 1. (replacing `username` with a valid !FreedomBox user name and `freedombox.local` with your !FreedomBox's domain name or IP):
- {{{
+ 1. (replacing `username` with a valid !FreedomBox user name and `freedombox.local` with your !FreedomBox's domain name or IP): {{{
 $ ssh username@freedombox.local
 }}}
  1. If your data is ok and your !FreedomBox reachable, the first time you'll be asked to confirm its signature.
@@ -87,52 +85,43 @@ $ ssh username@freedombox.local
  1. The prompt changes to `username@freedombox:~$`.
 
 Once connected create your website folder with:
-{{{
+ {{{
 username@freedombox:~$ mkdir ~/public_html
 }}}
 
 ...or one for another user:
- 1. use the `sudo` prefix like
- {{{
+ 1. use the `sudo` prefix like {{{
 username@freedombox:~$ sudo mkdir /home/<the_other_user>/public_html
+}}}, and introduce your password.
+ 1. When you create a folder, by default it belongs to you no matter where it is created. Thus you'll then need to set its ownership to the other user: {{{
+username@freedombox:~$ sudo chown <the_other_user>:<the_other_user> /home/<the_other_user>/public_htm
 }}}
- and introduce your password.
- 1. When you create a folder, by default it belongs to you no matter where it is created. Thus you'll then need to set its ownership to the other user:
- {{{
-username@freedombox:~$ sudo chown <the_other_user>:<the_other_user> /home/<the_other_user>/public_html
-}}}
- 1. Better check it before you disconnect that `public_html` is listed among the contents of the other user's home folder.
+ 1. Better check it before you disconnect that `public_html' is listed among the contents of the other user's home folder.
  {{{
 username@freedombox:~$ ls -l /home/<the_other_user>
 ...
 drwxr-xr-x  2 <the_other_user> <the_other_user>   4096 jan 29 17:39  public_html
 ...
-}}}
- The name of the other user must appear '''twice''' in the `public_html` line and its permissions should be '''`drwxr-xr-x`'''.
+}}}. The name of the other user must appear '''twice''' in the `public_html` line and its permissions should be '''`drwxr-xr-x`'''.
 
 Then any user can upload their files to their respective folders with any of the graphical clients. Ask them to check it.
 
 It is a good security practice to exit instead of to just wait for the connection to time out:
-{{{
+ {{{
 username@freedombox:~$ exit
 }}}
 
 If then you want to also upload the web content through the command line you can
 {{{
 $ scp path/to/files username@freedombox.local:public_html/
-}}}
-It will ask your password in !FreedomBox. You should then be able to navigate your browser to the corresponding url and see the files.
+}}}. It will ask your password in !FreedomBox. You should then be able to navigate your browser to the corresponding url and see the files.
 
 Learn more about ssh, scp and sftp with `$ man ssh`, `$ man scp` and `$ man sftp`.
 
 
 === External Links ===
-
- * Upstream Project: https://httpd.apache.org/
- * Upstream Documentation: 
-  * https://httpd.apache.org/docs/2.4/mod/mod_userdir.html
-  * https://httpd.apache.org/docs/2.4/howto/public_html.html
- * Debian Apache Wiki: https://wiki.debian.org/Apache
+ * Upstream project website: https://httpd.apache.org/docs/2.4/mod/mod_userdir.html
+ * User documentation: https://httpd.apache.org/docs/2.4/howto/public_html.html
 
 ## END_INCLUDE
 

doc/manual/en/Calibre.raw.wiki

@@ -32,8 +32,7 @@ calibre can be accessed after installation through the web client at {{{https://
 
 === External links ===
 
- * Upstream project: https://calibre-ebook.com
- * Upstream end user documentation: https://calibre-ebook.com/help
+ * Official website: https://calibre-ebook.com
 
 
 ## END_INCLUDE

doc/manual/en/Contribute.raw.wiki

@@ -131,7 +131,7 @@ If you are a user experience designer, you can help !FreedomBox with the followi
 
  * UI experience for the !FreedomBox Service web interface
  * Web design for [[https://freedombox.org|freedombox.org]], [[https://freedomboxfoundation.org|freedomboxfoundation.org]] and the [[FreedomBox|wiki]] pages
- * Logo and branding (we currently have [[https://salsa.debian.org/freedombox-team/freedombox/tree/main/static/themes/default|an identity manual and logos]])
+ * Logo and branding (we currently have [[https://salsa.debian.org/freedombox-team/freedombox/tree/master/static/themes/default|an identity manual and logos]])
  * Possible designs for custom !FreedomBox cases on single board computers
  * [[../Design|User experience design]]
 

doc/manual/en/Coturn.raw.wiki

@@ -53,7 +53,6 @@ If your !FreedomBox is behind a router, you will need to set up port forwarding
 === External links ===
 
  * Upstream project: https://github.com/coturn/coturn
- * Upstream end user documentation: https://github.com/coturn/coturn/wiki/
 
 
 ## END_INCLUDE

doc/manual/en/Cubieboard2.raw.wiki

@@ -37,4 +37,4 @@ The Cubieboard 2 is a single board computer based on the Allwinner A20 processor
 CategoryFreedomBox
 
 
-Cubieboard 2 image is licensed under the [[https://creativecommons.org/licenses/by-sa/2.0/|Creative Commons Attribution-Share Alike 2.0 Generic license]] by [[https://commons.wikimedia.org/wiki/File:Cubieboard_2_-_Top_(14673300334).jpg|Gareth Halfacree]].
+Cubieboard 2 image is licensed under a Creative Commons Attribution-!ShareAlike 2.0 Generic License by [[https://www.flickr.com/photos/120586634@N05/14673300334/in/photolist-pMbdDm-omCuYN-o5kVMu-dy9jTD-dy99Kz|Flickr]].

doc/manual/en/Customization.raw.wiki

@@ -1,86 +0,0 @@
-#language en
-
-##TAG:TRANSLATION-HEADER-START
-~- [[FreedomBox/Customization|English]] - [[es/FreedomBox/Customization|Español]] - [[DebianWiki/EditorGuide#translation|(+)]] -~
-##TAG:TRANSLATION-HEADER-END
-
-== FreedomBox Customization ==
-
-<<TableOfContents()>>
-
-## BEGIN_INCLUDE
-Though !FreedomBox's philosophy is to have the user make as few decisions as possible about the !FreedomBox itself, a few options for customization have been provided to facilitate some advanced use cases. 
-
-
-=== Change Default App ===
-
-''Available since version:'' 0.36.0 <<BR>>
-''Skill level:'' Basic
-
-''Use Case'': A !FreedomBox that primarily runs only one public-facing application whose web application is set as the landing page when someone visits the domain name of the !FreedomBox over the internet. <<BR>>
-e.g. A university using !MediaWiki running on !FreedomBox as a course wiki wants its students typing in the domain name into their browser to directly go to the wiki bypassing the !FreedomBox home page.
-
-''Configuration:'' Change the [[FreedomBox/Manual/Configure#Default_App|Default App]] in the configure page to whichever app you want to be served as default.
-
-=== Custom Shortcuts ===
-
-''Available since version:'' 0.40.0 <<BR>>
-''Skill level:'' Advanced
-
-''Use Case:'' The administrator of a community deployment of !FreedomBox manually installs a few additional unsupported applications on the !FreedomBox and wants users to be able to transparently access them through the web and mobile applications of !FreedomBox.
-
-''Note:'' This feature is meant to be used with applications that are end-user facing, i.e have a web or mobile client.
-
-'''Configuration:'''
-
-!FreedomBox reads custom shortcuts you have created from various files paths on the server. A shortcuts file can be any file with `.json` extension in the following directories: `/etc/freedombox/custom-shortcuts.json.d/`, `/var/lib/freedombox/custom-shortcuts.json.d/` and `/usr/share/freedombox/custom-shortcuts.json.d/`. Or they can be a file named `custom-shortcuts.json` in these directories: `/etc/freedombox/`, `/etc/plinth/` (only for compatibility), `/var/lib/freedombox/` and `/usr/share/freedombox/`. The file should follow the same JSON schema as the !FreedomBox API. You can refer to the JSON schema by visiting `https://<my-freedombox-url>/plinth/api/1/shortcuts`.
-
-As an example, to add one additional shortcut for [[https://nextcloud.com|NextCloud]] app, create a file called `/etc/freedombox/custom-shortcuts.json.d/nextcloud.json` (create directories as needed).
-
-{{{#!highlight json
-{
-    "shortcuts": [{
-        "name": "NextCloud",
-        "description": ["Nextcloud is a suite of client-server software for creating and using file hosting services."],
-        "icon_url": "/plinth/custom/static/icons/nextcloud.png",
-        "clients": [{
-            "name": "nextcloud",
-            "platforms": [{
-                "type": "web",
-                "url": "/nextcloud"
-            }]
-        }],
-        "tags" : ["Groupware", "File sync"]
-    }]
-}
-}}}
-
-The corresponding icons for the shortcuts listed in the above file should be placed in the directory `/var/www/plinth/custom/static/icons/`. The file names of the icons should match with those provided in `/etc/freedombox/custom-shortcuts.json.d/nextcloud.json`.
-
-After adding an entry for !NextCloud in `nextcloud.json` and an icon, restart Plinth by executing the command {{{ systemctl restart plinth }}} on the !FreedomBox. You can also restart the !FreedomBox from the web interface.
-
-After restart the Plinth home page will display an additional shortcut for !NextCloud as shown below: <<BR>>
-{{attachment:nextcloud-frontpage-shortcut.png|NextCloud custom shortcut on the Plinth home page}}
-
-The same shortcut will also be displayed in any Android apps connected to the !FreedomBox. <<BR>>
-
-{{attachment:android-app-custom-shortcut.jpg|NextCloud custom shortcut in the Android app}}
-
-=== Custom Styling ===
-
-''Available since version:'' 24.25 <<BR>>
-''Skill level:'' Advanced
-
-''Use Case:'' The administrator of a community or home deployment of !FreedomBox wants to customize the web page styling of !FreedomBox.
-
-''Configuration'': Create a file in the path `/var/www/plinth/custom/static/css/user.css` and write [[https://developer.mozilla.org/en-US/docs/Web/CSS|CSS]] styling rules. This 
-file has the highest priority as per the [[https://developer.mozilla.org/en-US/docs/Web/CSS/Cascade|cascading rules]]. Use the web browser's developer console to understand which rules to override and how much [[https://developer.mozilla.org/en-US/docs/Web/CSS/Specificity|specificity]] is needed.
-
-{{attachment:customization_styling.png|Home page with customized styling}}
-
-## END_INCLUDE
-
-<<Include(FreedomBox/Portal)>>
-
-----
-CategoryFreedomBox

doc/manual/en/Debian.raw.wiki

@@ -13,7 +13,7 @@
 
 !FreedomBox is a [[DebianPureBlends|pure blend]] of Debian.  This means that all the work on !FreedomBox is available in Debian as packages.  It also means that any machine running Debian can be turned into a !FreedomBox.
 
-This page describes the process of installing !FreedomBox on a Debian system. Currently, !FreedomBox works in Debian Stable (bookworm), Testing (trixie), and Unstable (sid).
+This page describes the process of installing !FreedomBox on a Debian system. Currently, !FreedomBox works in Debian Stable (Bullseye), Testing (Bookworm), and Unstable (Sid).
 
 '''Important:''' Read [[FreedomBox/Hardware|general advice]] about hardware before building a !FreedomBox with this approach.
 
@@ -23,11 +23,17 @@ This page describes the process of installing !FreedomBox on a Debian system. Cu
 Installing !FreedomBox changes your Debian system in many important ways.  This includes installing a firewall and regenerating server certificates.  It is hence recommended that you install !FreedomBox on a fresh Debian installation instead of an existing setup.
 }}}
 
-=== Installing on Debian 12 (bookworm) or newer ===
+{{{#!wiki caution
+'''Console/GUI logins for non-admin users will be disabled'''
+
+After !FreedomBox is fully setup, your system will no longer allow users not belonging to the ''admin'' group to log in to the system via console, secure shell (SSH) or graphical login. This behaviour can be disabled from the [[FreedomBox/Manual/Security|Security]] page. Use the administrator account created during !FreedomBox first boot for console logins and add further user accounts to ''admin'' group, if necessary.
+}}}
+
+=== Installing on Debian 11 (Bullseye) or newer ===
 
 Check the Troubleshooting section below, for any tips or workarounds that might help during the install.
 
- 1. [[InstallingDebianOn|Install Debian]] 12 (Bookworm) or newer on your hardware. During installation choosing "Btrfs" for root filesystem type is recommended as !FreedomBox uses it take regular snapshots of the system.
+ 1. [[InstallingDebianOn|Install Debian]] 11 (Bullseye), or Unstable (Sid) on your hardware.
 
  1. Update your package list.
 

doc/manual/en/DebianUpgradeNotes.raw.wiki

@@ -1,28 +0,0 @@
-<<TableOfContents(3)>>
-
-## BEGIN_INCLUDE
-
-!FreedomBox is built on the Debian operating system. Approximately every two years, there is a new stable Debian release. !FreedomBox provides the option of [[FreedomBox/Manual/Upgrades#Auto-Update_to_Next_Stable_Release|automatically handling the upgrade]] to the new version of Debian after it is released. A distribution update will bring in major features and changes. Sometimes, old features will stop working. This page documents the expected changes and transitions during a distribution upgrade. If you dislike these changes, you can keep each distribution for at least [[LTS|5 years]] before updating.
-
-The current stable release is Debian 12 "bookworm". It was released on June 10, 2023. Below are additional considerations to have in mind when upgrading to a new release of Debian.
-
-== Debian 13 "trixie" ==
-
-Estimated release date is around August 2025.
-
-=== TT-RSS no longer supported ===
-
-The [[DebianPts:tt-rss]] package has been removed from the next Debian release. It is recommended to move to one of the following options as a replacement:
- * [[FreedomBox/Manual/Miniflux|Miniflux]]
- * [[FreedomBox/Manual/Nextcloud|Nextcloud News]]
-
-=== Searx app no longer supported ===
-
-The [[DebianPts:searx]] package has been removed from the next Debian release. There is currently no replacement for Searx app in !FreedomBox. Searx app will no longer received security updates, so it is recommended to stop using the app, and to uninstall it.
-
-## END_INCLUDE
-
-<<Include(FreedomBox/Portal)>>
-
-----
-CategoryFreedomBox

doc/manual/en/Deluge.raw.wiki

@@ -50,8 +50,12 @@ At this point, you are ready to begin using Deluge. You can make further changes
 
 === External links ===
 
- * Upstream project: https://www.deluge-torrent.org
- * Upstream end user documentation: https://dev.deluge-torrent.org/wiki/UserGuide
+ * Upstream projects:
+   * Deluge: https://www.deluge-torrent.org
+   * !BitTorrent: https://www.bittorrent.org
+ * Protocol description:
+  * Upstream: https://www.bittorrent.org/introduction.html
+  * At Wikipedia: https://en.wikipedia.org/wiki/BitTorrent
 
 ## END_INCLUDE
 

doc/manual/en/Download.raw.wiki

@@ -44,11 +44,36 @@ It is important to verify the images you have downloaded to ensure that the file
 
   * First open a terminal and import the public keys of the !FreedomBox developers who built the images:
   {{{
+$ gpg --keyserver keyserver.ubuntu.com --recv-keys BCBEBD57A11F70B23782BC5736C361440C9BC971
+$ gpg --keyserver keyserver.ubuntu.com --recv-keys 7D6ADB750F91085589484BE677C0C75E7B650808
+# This is the FreedomBox CI server's key
+$ gpg --keyserver keyserver.ubuntu.com --recv-keys 013D86D8BA32EAB4A6691BF85D4153D6FE188FC8
 # This is the new FreedomBox CI server's key
 $ gpg --keyserver keyserver.ubuntu.com --recv-keys D4B069124FCF43AA1FCD7FBC2ACFC1E15AF82D8C
 }}}
   * Next, verify the fingerprint of the public keys:
   {{{
+$ gpg --fingerprint BCBEBD57A11F70B23782BC5736C361440C9BC971
+pub   4096R/0C9BC971 2011-11-12
+      Key fingerprint = BCBE BD57 A11F 70B2 3782  BC57 36C3 6144 0C9B C971
+uid                  Sunil Mohan Adapa <sunil@medhas.org>
+sub   4096R/4C1D4B57 2011-11-12
+
+$ gpg --fingerprint 7D6ADB750F91085589484BE677C0C75E7B650808
+pub   4096R/7B650808 2015-06-07 [expires: 2020-06-05]
+      Key fingerprint = 7D6A DB75 0F91 0855 8948  4BE6 77C0 C75E 7B65 0808
+uid                  James Valleroy <jvalleroy@mailbox.org>
+uid                  James Valleroy <jvalleroy@freedombox.org>
+sub   4096R/25D22BF4 2015-06-07 [expires: 2020-06-05]
+sub   4096R/DDA11207 2015-07-03 [expires: 2020-07-01]
+sub   2048R/2A624357 2015-12-22
+
+$ gpg --fingerprint 013D86D8BA32EAB4A6691BF85D4153D6FE188FC8
+pub   rsa4096 2018-06-06 [SC]
+      013D 86D8 BA32 EAB4 A669  1BF8 5D41 53D6 FE18 8FC8
+uid           [ unknown] FreedomBox CI (Continuous Integration server) <admin@freedombox.org>
+sub   rsa4096 2018-06-06 [E]
+
 $ gpg --fingerprint D4B069124FCF43AA1FCD7FBC2ACFC1E15AF82D8C
 pub   rsa4096 2022-03-09 [SC]
       D4B0 6912 4FCF 43AA 1FCD  7FBC 2ACF C1E1 5AF8 2D8C
@@ -57,7 +82,7 @@ sub   rsa4096 2022-03-09 [E]
 }}}
   * Finally, verify your downloaded image with its signature file `.sig`. For example:
   {{{
-$ gpg --verify freedombox-bookworm_all-amd64.img.xz.sig
+$ $ gpg --verify freedombox-bookworm_all-amd64.img.xz.sig
 gpg: assuming signed data in 'freedombox-bookworm_all-amd64.img.xz'
 gpg: Signature made Wed 14 Jun 2023 03:22:04 PM PDT
 gpg:                using RSA key D4B069124FCF43AA1FCD7FBC2ACFC1E15AF82D8C
@@ -151,7 +176,7 @@ On MacOS (OSX) you can use programs like ''balenaetcher'' and ''rosaimagewriter'
 
 === From within FreedomBox ===
 
-!FreedomBox is made up of several software programs and you can obtain the source code to any of them. These instructions are similar to obtaining and [[https://www.debian.org/doc/manuals/maint-guide/build.en.html|building]] [[https://wiki.debian.org/Packaging/SourcePackage#How_to_Download_a_source_package|source code]] [[https://wiki.debian.org/BuildingTutorial|for Debian]] since !FreedomBox is a pure blend of Debian. Using this process you can obtain the source code to the exact version of the package you are currently using in !FreedomBox.
+!FreedomBox is made up of several software programs and you can obtain the source code to any of them. These instructions are similar to obtaining and [[https://www.debian.org/doc/manuals/maint-guide/build.en.html|building]] [[https://www.debian.org/doc/manuals/apt-howto/ch-sourcehandling.en.html|source code]] [[https://wiki.debian.org/BuildingTutorial|for Debian]] since !FreedomBox is a pure blend of Debian. Using this process you can obtain the source code to the exact version of the package you are currently using in !FreedomBox.
 
  1. To see the list of software packages installed on your !FreedomBox, run the following in a terminal:
  {{{
@@ -198,7 +223,7 @@ cd <source_directory>
 
 === Building Disk Images ===
 
-You can also build !FreedomBox disk images for various hardware platforms using the freedom-maker tool. This is also available as a Debian package and source code for it may be obtained using the above methods. [[https://salsa.debian.org/freedombox-team/freedom-maker/blob/main/README.md|Build instructions]] for creating disk images are available as part of the source code for freedom-maker package.
+You can also build !FreedomBox disk images for various hardware platforms using the freedom-maker tool. This is also available as a Debian package and source code for it may be obtained using the above methods. [[https://salsa.debian.org/freedombox-team/freedom-maker/blob/master/README.md|Build instructions]] for creating disk images are available as part of the source code for freedom-maker package.
 
 !FreedomBox disk images are built and uploaded to official servers using automated Continuous Integration infrastructure. This infrastructure is available as [[https://salsa.debian.org/freedombox-team/infrastructure|source code]] too and provides accurate information on how !FreedomBox images are built.
 
@@ -225,37 +250,6 @@ dd if=temp/usr/lib/u-boot/A20-OLinuXino-Lime2/u-boot-sunxi-with-spl.bin of=<lime
 
 The resulting image will have the modified u-boot in it. 
 
-=== Old Signing Keys ===
-
-Some very old disk images of !FreedomBox have been signed by different GPG keys than the one listed above. Those signatures are still valid and can be verified using the older keys.
-
-{{{
-$ gpg --keyserver keyserver.ubuntu.com --recv-keys BCBEBD57A11F70B23782BC5736C361440C9BC971
-$ gpg --keyserver keyserver.ubuntu.com --recv-keys 7D6ADB750F91085589484BE677C0C75E7B650808
-# This is the FreedomBox CI server's key
-$ gpg --keyserver keyserver.ubuntu.com --recv-keys 013D86D8BA32EAB4A6691BF85D4153D6FE188FC8
-$ gpg --fingerprint BCBEBD57A11F70B23782BC5736C361440C9BC971
-pub   4096R/0C9BC971 2011-11-12
-      Key fingerprint = BCBE BD57 A11F 70B2 3782  BC57 36C3 6144 0C9B C971
-uid                  Sunil Mohan Adapa <sunil@medhas.org>
-sub   4096R/4C1D4B57 2011-11-12
-
-$ gpg --fingerprint 7D6ADB750F91085589484BE677C0C75E7B650808
-pub   4096R/7B650808 2015-06-07 [expires: 2020-06-05]
-      Key fingerprint = 7D6A DB75 0F91 0855 8948  4BE6 77C0 C75E 7B65 0808
-uid                  James Valleroy <jvalleroy@mailbox.org>
-uid                  James Valleroy <jvalleroy@freedombox.org>
-sub   4096R/25D22BF4 2015-06-07 [expires: 2020-06-05]
-sub   4096R/DDA11207 2015-07-03 [expires: 2020-07-01]
-sub   2048R/2A624357 2015-12-22
-
-$ gpg --fingerprint 013D86D8BA32EAB4A6691BF85D4153D6FE188FC8
-pub   rsa4096 2018-06-06 [SC]
-      013D 86D8 BA32 EAB4 A669  1BF8 5D41 53D6 FE18 8FC8
-uid           [ unknown] FreedomBox CI (Continuous Integration server) <admin@freedombox.org>
-sub   rsa4096 2018-06-06 [E]
-}}}
-
 ## END_INCLUDE
 
 <<Include(FreedomBox/Portal)>>

doc/manual/en/DynamicDNS.raw.wiki

@@ -16,12 +16,6 @@ Dynamic DNS service providers assist in working around a problem.  First they pr
 
 For this to work, every time you connect to the Internet, you will have to tell your Dynamic DNS provider what your current IP address is.  Hence you need special software on your server to perform this operation. The Dynamic DNS function in !FreedomBox will allow users without a static public IP address to push the current public IP address to a Dynamic DNS Server.  This allows you to expose services on !FreedomBox, such as ownCloud, to the Internet.
 
-=== A Free Domain for your FreedomBox ===
-
-You can get a free domain name for your !FreedomBox using the free Dynamic DNS service provided by the !FreedomBox community at https://ddns.freedombox.org . With this service, your domain name will look like ''myaccount.fbx.one'' or ''myaccount.freedombox.rocks'' where ''myaccount'' is the account you created on the service.
-
-The service also provides you with free unlimited number of subdomains. For this, login to the account, go to ''Change Settings'', check the option ''Wild Card'', and click ''Save Changes''. After this you can add any number of subdomains like ''foo.myaccount.fbx.one'' to your !FreedomBox in ''System -> Names -> Add Domain (regular)''. TLS certificates (for HTTPS) will be automatically obtained by !FreedomBox using Let's Encrypt for these subdomains. Subdomains are especially useful for applications that require being hosted on a separate domain, such as [[FreedomBox/Manual/HomeAssistant|Home Assistant]].
-
 === GnuDIP vs. Update URL ===
 
 There are two main mechanism to notify the Dynamic DNS server of your new IP address; using the ''GnuDIP'' protocol and using the ''Update URL'' mechanism.
@@ -33,6 +27,7 @@ On the other hand, the GnuDIP protocol will only transport a salted MD5 value of
 === Using the GnuDIP protocol ===
 
  1. Register an account with any Dynamic DNS service provider.  A free service provided by the !FreedomBox community is available at https://ddns.freedombox.org .
+
  1. In !FreedomBox UI, enable the Dynamic DNS Service.
 
  1. Select ''GnuDIP'' as ''Service type'', enter your Dynamic DNS service provider address (for example, ddns.freedombox.org) into ''GnuDIP Server Address'' field.

doc/manual/en/Email.raw.wiki

@@ -2,7 +2,7 @@
 #language en
 
 ##TAG:TRANSLATION-HEADER-START
-~- [[FreedomBox/Manual/Email|English]] - [[es/FreedomBox/Manual/Email|Español]] - [[uk/FreedomBox/Manual/Email|Українська]] - [[DebianWiki/EditorGuide#translation|(+)]] -~
+~- [[FreedomBox/Manual/Email|English]] - [[es/FreedomBox/Manual/Email|Spanish]] - [[uk/FreedomBox/Manual/Email|Українська]] - [[DebianWiki/EditorGuide#translation|(+)]] -~
 ##TAG:TRANSLATION-HEADER-END
 <<TableOfContents()>>
 
@@ -207,22 +207,12 @@ Please provide your feedback on usage on [[https://discuss.freedombox.org/t/emai
 
 [[https://salsa.debian.org/freedombox-team/freedombox/-/merge_requests/2077|This salsa issue]] is driving the implementation. Feel free to join discussions and provide technical ideas.
 
-
 === External links ===
 
- * Upstream projects:
-  * https://www.dovecot.org
-  * http://www.postfix.org
-  * https://www.rspamd.com
-
- * Debian community wiki:
-  * [[https://wiki.debian.org/Dovecot|Dovecot]]
-  * [[https://wiki.debian.org/Postfix|Postfix]]
-
-==== Client Apps ====
-Links to recommended email client apps can be found in !FreedomBox by select the Apps page, selecting the Dovecot/Postfix tile, and clicking the '''> Client Apps''' button.
-
- * [[FreedomBox/Manual/Roundcube|FreedomBox includes Roundcube client software.]]
+ * Upstream websites:
+   * http://www.postfix.org
+   * https://www.dovecot.org
+   * https://www.rspamd.com
 
 ## END_INCLUDE
 

doc/manual/en/ExposeLocalService.raw.wiki

@@ -1,158 +0,0 @@
-#language en
-
-##TAG:TRANSLATION-HEADER-START
-~- [[FreedomBox/Guide/ExposeLocalService|English]] - [[es/FreedomBox/Guide/ExposeLocalService|Español]] - [[DebianWiki/EditorGuide#translation|(+)]] -~
-##TAG:TRANSLATION-HEADER-END
-
-<<TableOfContents>>
-
-## BEGIN_INCLUDE
-
-== Expose a Local Service to Internet using FreedomBox ==
-
-This guide describes to expose a local service you have on your LAN to the internet using a !FreedomBox that is already exposed on the internet.
-
-=== Goal ===
-
- * ''You have a !FreedomBox running'' with a working domain already setup. You are able to access your !FreedomBox using a URL such as `https://www.mysite.example/` .
- * ''You have a different server running a local service'' on LAN that you wish to expose to the Internet on the same domain as your !FreedomBox. The local service must be a web service using the HTTP protocol (it is also possible to setup non-HTTP service, but that is a different approach). Optionally, you can have special domain assigned specifically for this local service.
- * You wish for ''!FreedomBox to handle the TLS certificates'' for this domain as !FreedomBox typically does. Your local service need not setup and manage TLS certificates.
- * Optionally, you may want to ''limit access to local service using !FreedomBox credentials''. Only users with a !FreedomBox account (and belonging to a chosen group) will be able to access this service. The local service will not be available to general public on the Internet. This way you can host local services that don’t implement their own authentication or local services with their own authentication mechanisms disabled.
-
-=== Exposing Local LAN servers ===
-
- * To expose the service, create an Apache configuration file in `/etc/apache2/conf-available/` and write a `ProxyPass` directive. Assuming your local service is running on a computer with IP address `192.168.0.20` on port `3000`, you can do this by running a command (as a root user on the terminal):
-
- {{{#!highlight bash
-cat > /etc/apache2/conf-available/my-local-service.conf <<EOL
-ProxyPass /myservice http://192.168.0.20:3000/
-EOL
-}}}
-
- * Then, enable this Apache configuration. Run the following command:
- {{{#!highlight bash
-a2enconf my-local-service
-}}}
- * Then reload Apache web server.
- {{{#!highlight bash
-systemctl reload apache2
-}}}
-
-You can now access your local service at the following URL `https://www.mysite.example/myservice/` . Note that the URL is a secure URL with `https://`. The certificates will be managed by FreedomBox/Let’s Encrypt. All your other apps and services work as usual. You can add any number services you want this way.
-
-=== Running the Service on FreedomBox Itself ===
-
-The above approach will also work if the local service is running on !FreedomBox itself. In this case, the `ProxyPass` directive in the configuration should be modified to look like `ProxyPass /myservice http://127.0.0.1:3000/`.
-
-=== Disabling the service ===
-
-To disable exposing the local service:
-
- 1. Disable the Apache configuration file.
- {{{#!highlight bash
-a2disconf my-local-service
-}}}
- 1. Then, reload Apache web server.
- {{{#!highlight bash
-systemctl reload apache2
-}}}
-
-=== Adding Authentication ===
-
-You can configure the service to be available to only users with !FreedomBox account. This is a good choice if:
-
- * The local service that is exposed to the Internet should not be available to everyone. And,
- * The local service does not provide its own authentication mechanism. Or,
- * The local service provides it’s own authentication but you don’t want to maintain a different set of user accounts for that service and want to reuse your !FreedomBox user accounts.
-
- 1. Update the Apache configuration file `/etc/apache2/conf-available/my-local-service.conf` to look like the following.
- {{{#!highlight apache
-<Location /myservice/>
-    Include includes/freedombox-single-sign-on.conf
-
-    ProxyPass http://192.168.0.20:3000/
-</Location>
-}}}
- 1. Then, reload Apache web server.
- {{{#!highlight bash
-systemctl reload apache2
-}}}
-
-If you wish for only some groups of users to be able to access the service, another change to the configuration is needed. Make the configuration look like the following if you wish to allow users of “web-search” group and also users of “admin” group to access the local service. All other users even if they have a valid !FreedomBox account will be denied access.
-
-{{{#!highlight apache
-<Location /myservice/>
-    Include includes/freedombox-single-sign-on.conf
-
-    <IfModule mod_auth_pubtkt.c>
-        TKTAuthToken "web-search" "admin"
-    </IfModule>
-
-    ProxyPass http://192.168.0.20:3000/
-</Location>
-}}}
-
-=== Hosting the Service on a Separate Domain ===
-
-Some services and web applications hosted under a URL fragment such as `/myservice/` do not work well. They require an entire domain or subdomain to be dedicated to them. In these cases too, !FreedomBox can expose local services.
-
- 1. First acquire a domain or a subdomain.
-  * If your domain is a custom domain that you own, go to the DNS settings on your domain name provider and add a subdomain. You can create a CNAME record that simply points to the main domain.
-  * If you are using !FreedomBox Dynamic DNS service, then login into https://ddns.freedombox.org and enable the “Wildcard” option. With this change, for a domain (such as `example.fbx.one`), all subdomains (such as `myservice.example.fbx.one`) of your domain will point to your main domain. 
- 1. Add the new domain into !FreedomBox. Goto System → Name Services → Domain (regular) → Add. For example, add `myservice.mysite.example`.
- 1. Then create an Apache configuration file at `/etc/apache2/includes/<domainname>-include.conf`. For our example this is: `/etc/apache2/includes/myservice.mysite.example-include.conf`. The contents of the file should be:
- {{{#!highlight apache
-ProxyPass / http://192.168.0.20:3000/
-}}}
- 1. Modify the above file for authentication if necessary by adding the `Include` and `<IfModule>` configuration directives as shown in the authentication section above.
-
-=== Troubleshooting ===
-
-When your setup does not work as expected, to debug, run a temporary web service on your !FreedomBox.
-
- 1. Create a temporary directory with an index.html page on the !FreedomBox.
- {{{#!highlight bash
-mkdir temp
-cd temp
-cat > index.html <<EOL
-<!DOCTYPE html>
-<html>
-  <head>
-    <title>My test page</title>
-  </head>
-  <body>
-    <h1>Hello, World!</h1>
-  </body>
-</html>
-EOL
-}}}
- 1. Run a temporary web server (press Control-C to terminate):
- {{{#!highlight bash
-python3 -m http.server 3000
-}}}
- 1. Update the Apache configuration to point to this temporary service on !FreedomBox.
- {{{#!highlight apache
-ProxyPass /myservice http://127.0.0.1:3000/
-}}}
-
-=== Extras ===
-
-There are many additional features that Apache can provide to improve the local service. For these, [[https://httpd.apache.org/docs/current/|explore Apache documentation]]. Some features include:
-
- * Serving static files such as JS, CSS, and media files from local directory without invoking the local service to improve performance.
- * Caching the responses from the local service to improve performance.
- * Setting additional headers for security, cache control, etc.
- * Modify the HTTP header responses from the service when it does not work well to hosting under a URL fragment such as `/myservice/`.
- * Perform redirects from `http://` URL to `https://` and setting HSTS header.
- * Load balancing among multiple local services for high availability, scaling, etc.
- * And more.
-
-
-## END_INCLUDE
-
-Back to [[FreedomBox/Features|Features introduction]] or [[FreedomBox/Manual|manual]] pages.
-
-<<Include(FreedomBox/Portal)>>
-
-----
-CategoryFreedomBox

doc/manual/en/FeatherWiki.raw.wiki

@@ -1,85 +0,0 @@
-#language en
-
-##TAG:TRANSLATION-HEADER-START
-~- [[FreedomBox/Manual/FeatherWiki|English]] - [[es/FreedomBox/Manual/FeatherWiki|Español]] - [[DebianWiki/EditorGuide#translation|(+)]]-~
-##TAG:TRANSLATION-HEADER-END
-
-<<TableOfContents()>>
-
-## BEGIN_INCLUDE
-
-== Feather Wiki (Personal Notebooks) ==
-||<tablestyle="float: right;"> {{attachment:Feather-Wiki-on-FreedomBox.png|Feather Wiki icon}} ||
-
-'''Available since''': version 24.17
-
-Feather Wiki is a simple tool to create personal wikis on the web. Each wiki is self-contained within a single HTML file stored on your !FreedomBox. Only !FreedomBox users can read or write to the wiki files. It is also possible to "publish" a Feather Wiki file from within the application.
-
-=== A Nest of Feather Wikis ===
-
-Feather Wiki is a web application that runs entirely in the browser. !FreedomBox implements a Feather Wiki Nest, i.e. an application that can store and manage several Feather Wiki files.
-
-Feather Wiki is a web quine, like its more popular, older and more feature-rich cousin !TiddlyWiki. Every wiki file contains an entire copy of the source code (HTML, CSS and !JavaScript) along with your content, which makes it extremely portable.
-
-The Nest is essentially a !WebDAV server provided by !FreedomBox's Apache web server, so Feather Wiki doesn't require installation of any additional packages. It requires no additional system resources either, since Apache is always running.
-
-=== Setting up wikis ===
-
-Creating and deleting wiki files is handled by the !FreedomBox app itself. Every new wiki file is created from the latest available version of the empty Feather Wiki file downloaded from the official website. Deletion cannot be undone. You have to either restore the deleted file from a backup or import any saved local copy into a new wiki file. Uploading your existing Feather Wiki files is supported if they are at least v1.8.0 (Skylark). For older Feather Wiki files, you can use the import option as described below.
-
-To import an old Feather Wiki file, first create a new wiki on your !FreedomBox.The page called "Wiki Settings" in Feather Wiki provides a button that lets you import the contents of an existing wiki file into a new wiki by uploading the file from your local machine. 
-
-Upgrading Feather Wiki is a manual process that is very similar to importing.
- 1. Save a local copy of the wiki file.
- 2. Delete the wiki file from the server.
- 3. Create a new empty wiki file (this will be of the latest version by default).
- 4. Open the new wiki.
- 5. Import the contents of your local copy into the new wiki from the "Wiki Settings" page.
-
-{{attachment:Feather-Wiki-Settings.png|Wiki Settings page|width=800}}
-
-=== Publishing a wiki ===
-
-The Feather Wiki app on !FreedomBox doesn't provide a "public access" option, unlike !MediaWiki. To share your wiki file with someone who doesn't have an account on your !FreedomBox or to publish the file on the Internet, follow these steps:
-
- 1. Save a local copy of the wiki file.
- 2. Open the local copy in a web browser.
- 3. Go to "Wiki Settings" page and enable the "Publish" setting. (This makes the wiki non-editable. Hence the local copy.)
- 4. Save the local copy.
-
-Now you can share the HTML file or publish it on the web using [[FreedomBox/Manual/Apache_userdir|Apache userdir]] or placing it under the /var/www/html directory on your !FreedomBox.
-
-=== As many wikis as you need ===
-
-The source code of Feather Wiki is tiny - less than 60 kilobytes. You are encouraged to create as many wiki files as you need, since the storage cost of each file is negligible, even on a !FreedomBox running from an SD card. 
-
-The shortcut for Feather Wiki app opens a page with the list of wiki files stored on !FreedomBox. Creating a front page shortcut for each wiki file (like Ikiwiki does) would clutter the front page, considering the number of Feather Wiki files people might create.
-
-=== Use cases ===
-
- * '''Notebook:''' A student can use Feather Wiki as a web notebook with one wiki file per course. About 40 files for a bachelor's degree!
- * '''Self-publishing:''' An author can self-publish an online book using Feather Wiki as a !GitBook alternative.
- * '''Refile:''' One wiki file as a general notes dump that can be refiled later into more organized formats.
- * One wiki file for each issue of a magazine (indie web zine) maybe with some custom CSS added.
- * Simple internal websites for organizations to publish information.
- * One Feather Wiki file for each of your projects. Keep all project-related notes and tasks in one file.
- * Shipping documentation/user-guide with your product, in a single file.
-
-For more inspiration, see the [[https://feather.wiki/?page=gallery|Gallery]] on the official website.
-
-You might want to configure your wiki with different [[https://feather.wiki/?page=extensions|extensions]] for Feather Wiki depending on the use case.
-
-=== External links ===
-
- * Website: https://feather.wiki
- * Source code for Feather Wiki: https://codeberg.org/Alamantus/FeatherWiki
-
-## END_INCLUDE
-
-Back to [[FreedomBox/Features|Features introduction]] or [[FreedomBox/Manual|manual]] pages.
-
-
-<<Include(FreedomBox/Portal)>>
-
-----
-CategoryFreedomBox

doc/manual/en/GitWeb.raw.wiki

@@ -67,9 +67,7 @@ snapshot = tgz
 
 === External links ===
 
- * Upstream project: https://git-scm.com/
- * Upstream end user documentation: https://git-scm.com/docs/gitweb
- * Debian community wikis: https://wiki.debian.org/CategoryGit
+ * User documentation: https://git-scm.com/docs/gitweb
 
 
 ## END_INCLUDE

doc/manual/en/Hardware.raw.wiki

@@ -12,17 +12,7 @@ In addition to supporting various single board computers and other devices, any
 
 == Recommended Hardware ==
 
-=== Libre Crafts FreedomBox ===
-
-Libre Crafts in an endeavor from the !FreedomBox developers themselves to bring you a powerful !FreedomBox device capable of hosting even the most demanding home server needs. The device is crafted, tested, and delivered to you by !FreedomBox developers. Your purchase helps !FreedomBox development.
-
-This hardware features a powerful CPU, plenty of main memory, a fast OS disk, ability to add two high capacity hard disk drives, dual multi-gigabit Ethernet ports, all with a low power consumption. Use it to host all your photos, to backup all home devices, as a NAS, as home automation hub, as a desktop computer, and more all at once. 
-
-||<style="text-align: center;"> [[FreedomBox/Hardware/LibreCrafts|{{attachment:libre-crafts.png|Libre Crafts FreedomBox|height=300}}]]<<BR>> [[FreedomBox/Hardware/LibreCrafts|Libre Crafts FreedomBox]] ||
-
-=== Olimex's FreedomBox Pioneer Edition ===
-
-On April 22nd, 2019, the !FreedomBox Foundation announced the [[https://freedomboxfoundation.org/buy/|sales]] of the Pioneer Edition !FreedomBox Home Server Kits. This pre-installed hardware is for all users who don't wish to build their own !FreedomBox by choosing the right components, downloading the image and preparing an SD card with !FreedomBox.
+On April 22nd, 2019, the !FreedomBox Foundation announced the [[https://freedomboxfoundation.org/buy/|sales]] of the Pioneer Edition !FreedomBox Home Server Kits. This is the recommended pre-installed hardware for all users who don't wish to build their own !FreedomBox by choosing the right components, downloading the image and preparing an SD card with !FreedomBox.
 
 The kit includes all the hardware needed for launching a !FreedomBox home server on an Olimex A20-OLinuXino-LIME2 board. This product provides the perfect combination of open source hardware and free and open source software. By purchasing this product, you also support the !FreedomBox Foundation's efforts to create and promote its free and open source server software.
 
@@ -170,6 +160,7 @@ All !FreedomBox disk images for different hardware is built by the project using
 
 || '''Image''' || '''Includes main?''' || '''Includes non-free-firmware?''' || '''Non-free firmware included''' ||
 || 32-bit ARM (armhf) || (./) || || ||
+|| 32-bit x86 (i386) || (./) || (./) || DebianPkg:amd64-microcode, DebianPkg:intel-microcode (see [[Microcode]]) ||
 || 64-bit ARM (arm64) || (./) || || ||
 || 64-bit x86 (amd64) || (./) || (./) || DebianPkg:amd64-microcode, DebianPkg:intel-microcode (see [[Microcode]]) ||
 || A20 OLinuXino Lime || (./) || || ||
@@ -187,6 +178,7 @@ All !FreedomBox disk images for different hardware is built by the project using
 || Pine A64+ || (./) || || ||
 || Pioneer Edition !FreedomBox || (./) || || ||
 || QEMU/KVM amd64 || (./) || || ||
+|| QEMU/KVM i386 || (./) || || ||
 || Raspberry Pi 2 || (./) || (./) || DebianPkg:raspi-firmware ||
 || Raspberry Pi 3 Model B || (./) || (./) || DebianPkg:raspi-firmware, DebianPkg:firmware-brcm80211 ||
 || Raspberry Pi 3 Model B+ || (./) || (./) || DebianPkg:raspi-firmware, DebianPkg:firmware-brcm80211 ||
@@ -194,6 +186,7 @@ All !FreedomBox disk images for different hardware is built by the project using
 || Rock64 || (./) || || ||
 || !RockPro64 || (./) || || ||
 || !VirtualBox for amd64 || (./) || || ||
+|| !VirtualBox for i386 || (./) || || ||
 
 ## END_INCLUDE
 

doc/manual/en/HomeAssistant.raw.wiki

@@ -1,78 +0,0 @@
-#language en
-
-##TAG:TRANSLATION-HEADER-START
-~- [[FreedomBox/Manual/HomeAssistant|English]] - [[es/FreedomBox/Manual/HomeAssistant|Español]] - [[DebianWiki/EditorGuide#translation|(+)]]-~
-##TAG:TRANSLATION-HEADER-END
-
-<<TableOfContents()>>
-
-## BEGIN_INCLUDE
-
-== Home Assistant ==
-||<tablestyle="float: right;"> {{attachment:homeassistant.png|Home Assistant icon}} ||
-
-'''Available since''': version 25.10
-
-Home Assistant is a home automation hub with emphasis on local control and privacy. It integrates with thousands of devices including smart bulbs, alarms, presence sensors, door bells, thermostats, irrigation timers, energy monitors, etc.
-
-Please note that Home Assistant is installed and run inside a container provided by the Home Assistant project. Security, quality, privacy and legal reviews are done by the upstream project and not by Debian/FreedomBox. Updates are performed following an independent cycle.
-
-Home Assistant app is considered experimental in !FreedomBox as it is fairly new to our ecosystem. You may face issues working with it or the app may undergo major breaking changes.
-
-=== Hardware ===
-
-Home Assistant can detect, configure, and use various devices on the local network. For example, if a device is connected using Wi-Fi or LAN to the same network as !FreedomBox, Home Assistant can detect, configure, and use the device. Other home automation protocols such as Thread, !ZigBee, and Z-Wave are also supported but require additional hardware to be connected to your !FreedomBox. For example, if you have a door sensor that speaks !ZigBee, you need to attach a !ZigBee USB dongle to your !FreedomBox. Home Assistant can then detect and use the door sensor on the !ZigBee network. '''Note:''' if you attach any such hardware to FreedomBox after you install the Home Assistant app, then you need to disable and re-enable the Home Assistant app before the hardware can be discovered and used by Home Assistant.
-
-Home Assistant is a comprehensive solution for your home automation needs supporting thousands of devices. You can check whether a device is supported by Home Assistant by visiting the [[https://www.home-assistant.io/integrations/|integrations]] page. Other devices which are not listed may also be supported when they are similar to supported devices. It is recommended that you purchase hardware that advertises support for Home Assistant.
-
-Many home automation devices connect to or send data to their manufacturers' servers. This can be a serious violation of your home's privacy. These devices may also stop working when their manufacturer goes bankrupt, decides to close the product line, or forces you to purchase newer models. It is strongly recommended that you purchase hardware that works locally with a home automation hub (in this case Home Assistant) without connecting to manufacturer's servers. These are listed under the categories "Local Push" or "Local Polling" in the Home Assistant's integrations page.
-
-=== Need for Subdomain ===
-
-Unlike most other apps in !FreedomBox which work on a path like `https://mydomain.example/app`, Home Assistant requires a separate dedicated subdomain such as `https://homeassistant.mydomain.example`. Before configuring the Home Assistant app, you must create a subdomain using System -> [[FreedomBox/Manual/NameServices|Name Services]]. See the documentation for Name Services to understand how you can acquire a subdomain.
-
-=== Setup ===
-
-After the app is installed, Home Assistant web interface must be setup. An administrator account is created at this time. Home Assistant maintains its own user accounts separate from user accounts created on !FreedomBox.
-
-{{attachment:homeassistant-setup-step-1.png|Setup - Step 1}}
-
-{{attachment:homeassistant-setup-step-2.png|Setup - Step 2}}
-
-{{attachment:homeassistant-setup-step-3.png|Setup - Step 3}}
-
-{{attachment:homeassistant-setup-step-4.png|Setup - Step 4}}
-
-{{attachment:homeassistant-setup-step-5.png|Setup - Step 5}}
-
-When new USB dongles are added to make Home Assistant talk to devices on networks like Thread, !ZigBee, and Z-Wave, then setup operation must be re-run on the app. This operation is available in the Extras menu drop down with gears icon in the Home Assistant app page. Setup must also be re-run when the hardware is removed. Otherwise, Home Assistant service will fail to start.
-
-=== Usage ===
-
-Home Assistant provides a fully functional web application and a mobile application. Simply login and start using:
-
-{{attachment:homeassistant-login.png|Login}}
-
-{{attachment:homeassistant-ui.png|Web UI}}
-
-
-{{attachment:homeassistant-app.png|Mobile App}}
-
-=== Advanced Manual Configuration ===
-
-If you wish to perform your own customization to Home Assistant setup, feel free to edit Home Assistant configuration files manually. Configuration, scenes, automations, scripts, secrets, database, and log files are all stored in the directory `/var/lib/home-assistant-freedombox/config` directory. You will need to disable and re-enable the app after configuration changes for them to take effect. Note that when !FreedomBox itself modifies these files, it will not preserve comments and other formatting.
-
-=== External links ===
-
- * Website: https://www.home-assistant.io/
- * Source code for Home Assistant: https://github.com/home-assistant/core
- * Source code for Home Assistant container image: https://github.com/home-assistant/docker
-
-## END_INCLUDE
-
-Back to [[FreedomBox/Features|Features introduction]] or [[FreedomBox/Manual|manual]] pages.
-
-<<Include(FreedomBox/Portal)>>
-
-----
-CategoryFreedomBox