Translated using Weblate (Czech)

Currently translated at 100.0% (1954 of 1954 strings)

.ci/Containerfile.functional-tests-stable

@@ -7,7 +7,7 @@ USER root:root
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-RUN echo "deb http://deb.debian.org/debian bookworm-backports main" > /etc/apt/sources.list.d/backports.list; echo "deb-src http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/sources.list.d/backports.list
+RUN echo "deb http://deb.debian.org/debian trixie-backports main" > /etc/apt/sources.list.d/backports.list; echo "deb-src http://deb.debian.org/debian trixie-backports main" >> /etc/apt/sources.list.d/backports.list
 
 RUN apt-get update
 
@@ -15,14 +15,14 @@ RUN apt-get update
 RUN apt-get dist-upgrade -y
 
 # Install freedombox package so that plint:plinth user/group are created etc.
-RUN apt-get install -y freedombox/bookworm-backports
-RUN systemctl mask plinth.service
+RUN apt-get install -y freedombox/trixie-backports
+RUN systemctl disable plinth.service
 
 # Don't ask for the secret in first wizard
 RUN rm -f /var/lib/plinth/firstboot-wizard-secret
 
 # Dependencies of the freedombox Debian package
-RUN apt-get build-dep -y freedombox/bookworm-backports
+RUN apt-get build-dep -y freedombox/trixie-backports
 
 # Build and test dependencies
 RUN apt-get install -y \

.ci/functional-tests.yml

@@ -14,9 +14,9 @@
     - $GITLAB_USER_LOGIN == "weblate"
   before_script:
     - apt-get update
-    - sudo -u plinth ./run --develop > plinth.log 2>&1 &
-    - 'echo -e "Cmnd_Alias FREEDOMBOX_ACTION_DEV = /usr/share/plinth/actions/actions, `pwd`/actions/actions\nDefaults!FREEDOMBOX_ACTION_DEV closefrom_override\nplinth    ALL=(ALL:ALL) NOPASSWD:SETENV : FREEDOMBOX_ACTION_DEV\n" > /etc/sudoers.d/01-freedombox-development'
-    - while ! grep -q "Setup thread finished" plinth.log; do sleep 1; echo -n .; done
+    - apt-get -y install make
+    - make provision-dev
+    - make wait-while-first-setup
   script:
     - FREDOMBOX_URL=https://localhost FREEDOMBOX_SSH_PORT=22 FREEDOMBOX_SAMBA_PORT=445 pytest -v --durations=10 --include-functional --splinter-headless --instafail --template=html1/index.html --report=functional-tests.html
   artifacts:

.gitignore

@@ -4,7 +4,7 @@
 doc/manual/*/*.pdf
 doc/manual/*/*.html
 doc/manual/*/*.xml
-doc/plinth.1
+doc/*.1
 doc/dev/_build
 \#*
 .#*

.gitlab-ci.yml

@@ -50,16 +50,13 @@ doc-tests:
 run-functional-tests-stable:
   extends: .run-functional-tests
 
-extract-source:
-    extends: .provisioning-extract-source
-
 build:
     extends: .build-package
 
 build-backports:
     extends: .build-package
     variables:
-      RELEASE: bookworm-backports
+      RELEASE: trixie-backports
 
 build i386:
     extends: .build-package-i386

.vagrant-scripts/plinth-user-permissions.py

@@ -1,16 +0,0 @@
-#!/usr/bin/python3
-# -*- mode: python -*-
-# SPDX-License-Identifier: AGPL-3.0-or-later
-"""Set required permissions for user "plinth" to run plinth in dev setup."""
-
-import pathlib
-
-content = '''
-Cmnd_Alias FREEDOMBOX_ACTION_DEV = /usr/share/plinth/actions/actions, /freedombox/actions/actions
-Defaults!FREEDOMBOX_ACTION_DEV closefrom_override
-plinth ALL=(ALL:ALL) NOPASSWD:SETENV : FREEDOMBOX_ACTION_DEV
-fbx    ALL=(ALL:ALL) NOPASSWD : ALL
-'''
-
-sudoers_file = pathlib.Path('/etc/sudoers.d/01-freedombox-development')
-sudoers_file.write_text(content)

COPYING.md

@@ -1,9 +1,9 @@
 # License to Copy FreedomBox Service (Plinth)
 
 FreedomBox Service (Plinth) is Copyright 2011, 2012, 2013, 2014, 2015, 2016,
-2017, 2018, 2019, 2020, 2021, 2022, 2023, 2024 FreedomBox Authors. See Git log
-in the source repository for a full list of authors. It is distributed under the
-GNU Affero General Public License, Version 3 or later. A copy of AGPLv3 is
+2017, 2018, 2019, 2020, 2021, 2022, 2023, 2024, 2025 FreedomBox Authors. See Git
+log in the source repository for a full list of authors. It is distributed under
+the GNU Affero General Public License, Version 3 or later. A copy of AGPLv3 is
 available [from the Free Software
 Foundation](http://www.gnu.org/licenses/agpl.html).
 

HACKING.md

@@ -66,7 +66,7 @@ development environment inside a systemd-nspawn container.
     folder: (This step requires at least 16GB of free disk space)
 
     ```bash
-    host$ ./container up
+    host$ ./container start
     ```
 
 1. To run unit tests:
@@ -97,23 +97,43 @@ development environment inside a systemd-nspawn container.
    1. Using an environment variable.
 
    ```bash
-   host$ DISTRIBUTION=stable ./container up
+   host$ DISTRIBUTION=stable ./container start
    host$ DISTRIBUTION=stable ./container ssh
    ```
 
    ```bash
    host$ export DISTRIBUTION=stable
-   host$ ./container up
+   host$ ./container start
    host$ ./container ssh
    ```
 
    2. Using the `--distribution` option for each command.
 
    ```bash
-   host$ ./container up --distribution=stable
+   host$ ./container start --distribution=stable
    host$ ./container ssh --distribution=stable
    ```
 
+#### Using KVM Virtual Machine
+
+The `./container` script, shipped with FreedomBox source code, can manage the
+development environment inside a KVM-based virtual machine using libvirt. This
+is an alternative to using containers described above (but the name of the
+script is still 'container' even when managing virtual machines). Some hardware,
+such as additional disks, can be better tested with virtual machine than with
+containers.
+
+Containers and a virtual machines of the same or different distribution all be
+used simultaneously as they all use different disk images.
+
+1.  To use virtual machines instead of container, append the option
+    '--machine-type=vm' to all the ./container commands described above. For
+    example, to bring up a virtual machine instead of a container run:
+
+    ```bash
+    host$ ./container start --machine-type=vm
+    ```
+
 #### Using after Setup
 
 After logging into the container, the source code is available in `/freedombox`
@@ -123,12 +143,12 @@ directory:
 guest$ cd /freedombox
 ```
 
-Run the development version of FreedomBox Service in the container using the
-following command. This command continuously deploys your code changes into the
-container providing a quick feedback cycle during development.
+FreedomBox Service runs as plinth.service in the container. This service
+restarts when it detects a change to the source code file. This provides a quick
+feedback cycle during development. To watch service logs run:
 
 ```bash
-guest$ freedombox-develop
+guest$ sudo freedombox-logs
 ```
 
 If you have changed any system configuration files during your development,
@@ -136,16 +156,17 @@ you will need to run the following to install those files properly on to the
 system and their changes to reflect properly.
 
 ```bash
-guest$ sudo make build install
+guest$ sudo make build install ;
+guest$ sudo systemctl restart plinth.service
 ```
 
 Note: This development container has automatic upgrades disabled by default.
 
 #### Troubleshooting
 
-* Sometimes `host$ ./container destroy && ./container up` doesn't work. In such
+* Sometimes `host$ ./container destroy && ./container start` doesn't work. In such
   cases, try to delete the hidden `.container` folder and then `host$
-  ./container up`.
+  ./container start`.
 * Not all kinds of changes are automatically updated. Try `guest$ sudo mount -o
   remount /freedombox`.
 * I am getting an error that says `lo` is not managed by Network Manager
@@ -157,7 +178,7 @@ Note: This development container has automatic upgrades disabled by default.
     ```bash
     host$ sudo touch /etc/NetworkManager/conf.d/10-globally-managed-devices.conf
     host$ sudo service network-manager restart
-    host$ ./container destroy && ./container up
+    host$ ./container destroy && ./container start
     ```
 * File/directory not found errors when running tests can be fixed by clearing `__pycache__` directories.
 
@@ -353,13 +374,12 @@ After logging into the virtual machine (VM), the source code is available in
 vm$ cd /freedombox
 ```
 
-Run the development version of FreedomBox Service (Plinth) from your source
-directory in the virtual machine using the following command. This command
-continuously deploys your code changes into the virtual machine providing a
-quick feedback cycle during development.
+FreedomBox Service runs as plinth.service in the virtual machine. This service
+restarts when it detects a change to the source code file. This provides a quick
+feedback cycle during development. To watch service logs run:
 
 ```bash
-vm$ freedombox-develop
+vm$ sudo freedombox-logs
 ```
 
 If you have changed any system configuration files during your development,
@@ -396,7 +416,7 @@ for more details.
 ### Translating literals (contributing translations)
 
 The easiest way to start translating is with your browser, by using
-[Weblate](https://hosted.weblate.org/projects/freedombox/plinth/).
+[Weblate](https://hosted.weblate.org/projects/freedombox/freedombox/).
 Your changes will automatically get pushed to the code repository.
 
 Alternatively, you can directly edit the `.po` file in your language directory

INSTALL.md

@@ -35,7 +35,7 @@ FreedomBox [Manual](https://wiki.debian.org/FreedomBox/Manual/)'s
 
 3.  Access FreedomBox UI:
 
-    UI should be accessible at http://localhost:8000/plinth
+    UI should be accessible at http://localhost:8000/freedombox
 
 If you are installing FreedomBox Service (Plinth) for development purposes, see
 HACKING.md instead.

Makefile

@@ -20,7 +20,9 @@ DISABLED_APPS_TO_REMOVE := \
     repro \
     tahoe \
     mldonkey \
-    i2p
+    i2p \
+    ttrss \
+    sso
 
 APP_FILES_TO_REMOVE := $(foreach app,$(DISABLED_APPS_TO_REMOVE),$(ENABLED_APPS_PATH)/$(app))
 
@@ -37,6 +39,7 @@ DIRECTORIES_TO_CREATE := \
 
 STATIC_FILES_DIRECTORY := $(DESTDIR)/usr/share/plinth/static
 BIN_DIR := $(DESTDIR)/usr/bin
+LIB_DIR := $(DESTDIR)/usr/lib
 
 FIND_ARGS := \
     -not -iname "*.log" \
@@ -58,7 +61,11 @@ ROOT_DATA_FILES := $(shell find data -type f $(FIND_ARGS))
 MODULE_DATA_FILES := $(shell find $(wildcard plinth/modules/*/data) -type f $(FIND_ARGS))
 
 update-translations:
-	cd plinth; $(DJANGO_ADMIN) makemessages --all --domain django --keep-pot --verbosity=1
+	$(DJANGO_ADMIN) makemessages --all --domain django --keep-pot \
+		--verbosity=1 --ignore conftest.py --ignore doc --ignore build \
+		--ignore htmlcov --ignore screenshots --ignore debian --ignore \
+		actions --ignore preseed --ignore static --ignore data \
+		--settings plinth.settings --pythonpath .
 
 configure:
 	# Nothing to do
@@ -95,12 +102,12 @@ install:
         $(INSTALL) -d $(DESTDIR)$${lib_dir} && \
 	rm -rf $(DESTDIR)$${lib_dir}/plinth $(DESTDIR)$${lib_dir}/plinth*.dist-info && \
         mv $${temp}/plinth $${temp}/plinth*.dist-info $(DESTDIR)$${lib_dir} && \
-	rm -f $(DESTDIR)$${lib_dir}/plinth*.dist-info/COPYING.md && \
+	rm -f $(DESTDIR)$${lib_dir}/plinth*.dist-info/licenses/COPYING.md && \
 	rm -f $(DESTDIR)$${lib_dir}/plinth*.dist-info/direct_url.json && \
         $(INSTALL) -D -t $(BIN_DIR) bin/plinth
-
-	# Actions
-	$(INSTALL) -D -t $(DESTDIR)/usr/share/plinth/actions actions/actions
+	$(INSTALL) -D -t $(LIB_DIR)/freedombox bin/freedombox-privileged
+	$(INSTALL) -D -t $(BIN_DIR) bin/freedombox-cmd
+	$(INSTALL) -D -t $(BIN_DIR) bin/freedombox-change-password
 
 	# Static web server files
 	rm -rf $(STATIC_FILES_DIRECTORY)
@@ -135,7 +142,7 @@ check-tests-cov:
 
 # Code quality checking using flake8
 check-code:
-	$(PYTHON) -m flake8 plinth actions/actions container
+	$(PYTHON) -m flake8 plinth container
 
 # Static type checking using mypy
 check-type:
@@ -150,6 +157,23 @@ clean:
 	rm -rf Plinth.egg-info
 	find plinth/locale -name *.mo -delete
 
+define DEVELOP_SERVICE_CONF
+[Service]
+Environment=FREEDOMBOX_DEVELOP=1
+Environment=PYTHONPATH=/freedombox/
+endef
+export DEVELOP_SERVICE_CONF
+
+define DEVELOP_LOGS_SCRIPT
+#!/usr/bin/bash
+
+set -e
+set -x
+
+journalctl --follow --unit=plinth.service --unit=freedombox-privileged.service
+endef
+export DEVELOP_LOGS_SCRIPT
+
 # Run basic setup for a developer environment (VM or container)
 provision-dev:
 	# Install newer build dependencies if any
@@ -159,9 +183,29 @@ provision-dev:
 	# Install latest code over .deb
 	$(MAKE) build install
 
+	# Configure privileged and web daemon for development setup
+	mkdir -p /etc/systemd/system/freedombox-privileged.service.d/
+	echo "$$DEVELOP_SERVICE_CONF" > /etc/systemd/system/freedombox-privileged.service.d/develop.conf
+	mkdir -p /etc/systemd/system/plinth.service.d/
+	echo "$$DEVELOP_SERVICE_CONF" > /etc/systemd/system/plinth.service.d/develop.conf
+
+	# Create a command to easily watch service logs
+	echo "$$DEVELOP_LOGS_SCRIPT" > /usr/bin/freedombox-logs
+	chmod 755 /usr/bin/freedombox-logs
+
 	# Reload newer systemd units, ignore failure
 	-systemctl daemon-reload
 
+	# Enable privileged daemon
+	-systemctl stop freedombox-privileged.service
+
+	-test -d /run/systemd/system && \
+		systemctl enable --now freedombox-privileged.socket
+
+	# Enable and restart plinth service if it is running
+	-systemctl enable plinth.service
+	-systemctl restart plinth.service
+
 	# Stop any ongoing upgrade, ignore failure
 	-killall -9 unattended-upgr
 
@@ -186,6 +230,12 @@ provision-dev:
 	DEBIAN_FRONTEND=noninteractive apt-get install --yes ncurses-term \
 	    sshpass bash-completion
 
+wait-while-first-setup:
+	while [ x$$(curl -k https://localhost/freedombox/status/ 2> /dev/null | \
+	    json_pp 2> /dev/null | grep 'is_first_setup_running' | \
+            tr -d '[:space:]' | cut -d':' -f2 ) != 'xfalse' ] ; do \
+	    sleep 1; echo -n .; done
+
 .PHONY: \
     build \
     check \
@@ -198,4 +248,5 @@ provision-dev:
     configure \
     install \
     provision \
-    update-translations
+    update-translations \
+    wait-while-first-setup

README.md

@@ -62,7 +62,7 @@ See the [HACKING.md](https://salsa.debian.org/freedombox-team/freedombox/blob/ma
 
 # Localization
 
-[![Translation status](https://hosted.weblate.org/widgets/freedombox/-/287x66-white.png)](https://hosted.weblate.org/engage/freedombox/?utm_source=widget)
+[![Translation status](https://hosted.weblate.org/widget/freedombox/horizontal-auto.svg)](https://hosted.weblate.org/engage/freedombox/)
 
 # License
 

Vagrantfile

@@ -6,13 +6,13 @@ require 'etc'
 
 Vagrant.configure(2) do |config|
   config.vm.box = "freedombox/freedombox-testing-dev"
-  config.vm.network "forwarded_port", guest: 443, host: 4430
-  config.vm.network "forwarded_port", guest: 445, host: 4450
+  config.vm.network "public_network"
   config.vm.synced_folder ".", "/freedombox", owner: "plinth", group: "plinth"
   config.vm.provider "virtualbox" do |vb|
     vb.cpus = Etc.nprocessors
     vb.memory = 2048
     vb.linked_clone = true
+    vb.customize ["modifyvm", :id, "--firmware", "efi"]
   end
   config.vm.provision "shell", run: 'always', inline: <<-SHELL
     # Disable automatic upgrades
@@ -24,24 +24,18 @@ Vagrant.configure(2) do |config|
   config.vm.provision "shell", inline: <<-SHELL
     cd /freedombox/
     make provision-dev
-
-    echo 'alias freedombox-develop="cd /freedombox; sudo -u plinth /freedombox/run --develop"' >> /home/vagrant/.bashrc
   SHELL
   config.vm.provision "tests", run: "never", type: "shell", path: "plinth/tests/functional/install.sh"
   config.vm.post_up_message = "FreedomBox virtual machine is ready
-for development. You can run the development version of Plinth using
-the following command.
+for development. To get the IP address:
 $ vagrant ssh
-$ freedombox-develop
-Plinth will be available at https://localhost:4430/plinth (with
-an invalid SSL certificate).
+$ ip address show
+
+FreedomBox interface will be available at https://<ip address>/freedombox
+(with an invalid SSL certificate). To watch logs:
+$ vagrant ssh
+$ sudo freedombox-logs
 "
 
-  config.trigger.after [:up, :resume, :reload] do |trigger|
-    trigger.info = "Set plinth user permissions for development environment"
-    trigger.run_remote = {
-      path: ".vagrant-scripts/plinth-user-permissions.py"
-    }
-  end
   config.vm.boot_timeout=1200
 end

actions/actions

@@ -1,7 +0,0 @@
-#!/usr/bin/python3
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-from plinth.actions import privileged_main
-
-if __name__ == '__main__':
-    privileged_main()

bin/freedombox-change-password

@@ -0,0 +1,61 @@
+#!/usr/bin/python3
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""
+Utility to change user password in FreedomBox's Django database.
+
+Usage:
+$ freedombox-change-password <username>
+"""
+
+import argparse
+import getpass
+import sys
+
+import plinth.web_framework
+from plinth.modules.users import privileged
+
+
+def main():
+    """Ask for new password, setup Django and update a user's password."""
+    try:
+        plinth.web_framework.init()
+    except Exception:
+        _print('Error initializing Django.')
+        return
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument('username',
+                        help='Username of the account to change password for')
+    args = parser.parse_args()
+
+    username = args.username
+    password = getpass.getpass('Enter new password: ')
+
+    try:
+        _change_password(username, password)
+        privileged._set_user_password(username, password)
+        privileged._set_samba_user(username, password)
+        _print('Password updated in web interface, LDAP, and samba databases.')
+    except Exception as exception:
+        _print('Error setting password:', str(exception))
+
+
+def _print(*args, **kwargs):
+    """Write to stderr."""
+    print(*args, **kwargs, file=sys.stderr)
+
+
+def _change_password(username: str, password: str):
+    """Update the password in SQLite database file."""
+    from django.contrib.auth.models import User
+    try:
+        user = User.objects.get(username=username)
+        user.set_password(password)
+        user.save()
+    except User.DoesNotExist:
+        _print('User account does not exist:', username)
+        raise
+
+
+if __name__ == '__main__':
+    main()

bin/freedombox-cmd

@@ -0,0 +1,6 @@
+#!/usr/bin/python3
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+import plinth.privileged_daemon
+
+plinth.privileged_daemon.client_main()

bin/freedombox-privileged

@@ -0,0 +1,6 @@
+#!/usr/bin/python3
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+import plinth.privileged_daemon
+
+plinth.privileged_daemon.main()

container

@@ -160,8 +160,10 @@ from typing import Callable
 from urllib.request import urlopen
 
 URLS_AMD64 = {
+    'oldstable': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
+                 'amd64/bookworm/freedombox-bookworm_all-amd64.img.xz',
     'stable': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
-              'amd64/bookworm/freedombox-bookworm_all-amd64.img.xz',
+              'amd64/trixie/freedombox-trixie_all-amd64.img.xz',
     'testing': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
                'amd64/testing/freedombox-testing_dev_all-amd64.img.xz',
     'unstable': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
@@ -169,8 +171,10 @@ URLS_AMD64 = {
 }
 
 URLS_ARM64 = {
+    'oldstable': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
+                 'arm64/bookworm/freedombox-bookworm_all-arm64.img.xz',
     'stable': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
-              'arm64/bookworm/freedombox-bookworm_all-arm64.img.xz',
+              'arm64/trixie/freedombox-trixie_all-arm64.img.xz',
     'testing': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
                'arm64/testing/freedombox-testing_dev_all-arm64.img.xz',
     'unstable': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
@@ -192,9 +196,6 @@ cd /freedombox/
 sudo apt-get -y install make
 sudo make provision-dev
 
-echo 'alias freedombox-develop="cd /freedombox; sudo -u plinth /freedombox/run --develop"' \
-  >> /home/fbx/.bashrc
-
 # Make some pytest related files and directories writable to the fbx user
 sudo touch geckodriver.log
 sudo chmod a+rw geckodriver.log
@@ -221,11 +222,12 @@ mount -o remount /freedombox
 if [[ "{distribution}" == "stable"  && ! -e $BACKPORTS_SOURCES_LIST ]]
 then
     echo "> In machine: Enable backports"
-    /freedombox/actions/actions upgrades activate_backports --no-args
+    /freedombox/bin/freedombox-cmd upgrades activate_backports --no-args
 fi
 
 echo "> In machine: Upgrade packages"
 apt-get update
+apt-mark hold freedombox freedombox-doc-en freedombox-doc-es
 DEBIAN_FRONTEND=noninteractive apt-get -yq --with-new-pkgs upgrade
 
 # Install requirements for tests if not already installed as root
@@ -237,25 +239,7 @@ fi
 # Run the plinth server if functional tests are requested
 if [[ "{pytest_command}" =~ "--include-functional" ]]
 then
-    is_plinth_running=0
-    ps -ax -o cmd | grep -q "^sudo -u plinth /freedombox/run" && \
-    is_plinth_running=1
-    ps -ax -o cmd | grep -q "^/usr/bin/python3 /usr/bin/plinth" && \
-    is_plinth_running=1
-
-    if [[ $is_plinth_running -eq 1 ]]
-    then
-        echo "> In machine: Plinth is already running"
-    else
-        echo -n "> In machine: Starting plinth ... "
-        sudo -u plinth /freedombox/run --develop > plinth.log 2>&1 &
-        while ! grep -q "Setup finished" plinth.log
-        do
-            sleep 1
-            echo -n .
-        done
-        echo
-    fi
+    make -C /freedombox wait-while-first-setup
 
     if [[ "{pytest_command}" != *"--splinter-headless"* ]]
     then
@@ -293,7 +277,7 @@ LIBVIRT_DOMAIN_XML_TEMPLATE = '''<domain type="kvm">
     <access mode="shared"/>
   </memoryBacking>
   <vcpu placement="static">{cpus}</vcpu>
-  <os>
+  <os {firmware}>
     <type arch="x86_64" machine="pc-q35-7.2">hvm</type>
     <boot dev="hd"/>
   </os>
@@ -491,14 +475,18 @@ def parse_arguments() -> argparse.Namespace:
             help='Type of the machine, container to virtual machine, to run '
             'operation on')
 
-    # Up
-    subparser = subparsers.add_parser('up', help='Bring up the container',
-                                      formatter_class=formatter_class)
+    # Start
+    subparser = subparsers.add_parser('start', help='Bring up the container',
+                                      formatter_class=formatter_class,
+                                      aliases=['up'])
     _add_common_args(subparser)
     subparser.add_argument('--image-size', default='16G',
                            help='Disk image size to resize to after download')
     subparser.add_argument('--hkp-client', choices=('gpg', 'wget'),
                            default='gpg', help='Client for key retrieval')
+    subparser.add_argument(
+        '--skip-install', action='store_true',
+        help='Skip running make provision-dev in the container')
 
     # Print IP address
     subparser = subparsers.add_parser(
@@ -522,7 +510,8 @@ def parse_arguments() -> argparse.Namespace:
 
     # Stop
     subparser = subparsers.add_parser('stop', help='Stop the container',
-                                      formatter_class=formatter_class)
+                                      formatter_class=formatter_class,
+                                      aliases=['down'])
     _add_common_args(subparser)
 
     # Destroy
@@ -700,10 +689,27 @@ def _verify_signature(hkp_client: str, data_file: pathlib.Path,
 
 def _extract_image(compressed_file: pathlib.Path):
     """Extract the image file."""
-    decompressed_file = compressed_file.with_suffix('')
+    # Strip the .xz extension, then replace .img with .raw
+    decompressed_file = compressed_file.with_suffix('').with_suffix('.raw')
+    older_image = compressed_file.with_suffix('')
+
     if decompressed_file.exists():
         return decompressed_file
 
+    # Rename older image and its corresponding state files.
+    if older_image.exists():
+        logger.info('Renaming .img file to .raw')
+        older_image.rename(decompressed_file)
+
+        for ext in ['.setup', '.provisioned']:
+            old_state = older_image.with_suffix(older_image.suffix + ext)
+            new_state = decompressed_file.with_suffix(
+                decompressed_file.suffix + ext)
+            if old_state.exists():
+                old_state.rename(new_state)
+
+        return decompressed_file
+
     logger.info('Decompressing file %s', compressed_file)
     partial_file = compressed_file.with_suffix('.partial')
     with partial_file.open('w', encoding='utf-8') as file_handle:
@@ -726,7 +732,8 @@ def _get_compressed_image_path(distribution: str) -> pathlib.Path:
 def _get_image_file(distribution: str) -> pathlib.Path:
     """Return the path of the image file."""
     compressed_image = _get_compressed_image_path(distribution)
-    return compressed_image.with_suffix('')
+    # Strip the .xz extension, then replace .img with .raw
+    return compressed_image.with_suffix('').with_suffix('.raw')
 
 
 def _get_project_folder() -> pathlib.Path:
@@ -777,7 +784,8 @@ def _get_partition_info(image_file: pathlib.Path) -> tuple[str, str]:
     return partition_table_type, last_partition_number
 
 
-def _resize_disk_image(image_file: pathlib.Path, new_size: str):
+def _resize_disk_image(image_file: pathlib.Path, new_size: str,
+                       distribution: str):
     """Resize the disk image if has not already been."""
     if new_size[-1] != 'G':
         raise ValueError(f'Invalid size: {new_size}')
@@ -820,10 +828,11 @@ def _resize_disk_image(image_file: pathlib.Path, new_size: str):
     with tempfile.TemporaryDirectory(
             dir=_get_work_directory().resolve()) as mount_point:
         subprocess.run(['sudo', 'mount', partition, mount_point], check=True)
+        time.sleep(2)  # Mount may trigger some re-balancing
         subprocess.run(
             ['sudo', 'btrfs', 'filesystem', 'resize', 'max', mount_point],
             check=True, stdout=subprocess.DEVNULL)
-        _update_fsid(mount_point, partition, old_fsid, new_fsid)
+        _update_fsid(mount_point, partition, old_fsid, new_fsid, distribution)
         subprocess.run(['sudo', 'umount', mount_point], check=True)
 
     subprocess.run(
@@ -841,17 +850,26 @@ def _get_fsid(partition: str) -> str:
 
 
 def _update_fsid(mount_point: str, partition: str, old_fsid: str,
-                 new_fsid: str):
+                 new_fsid: str, distribution: str):
     """After changing btrfs fsid, run grub-install to keep image bootable."""
+    is_efi = (platform.machine() in ('aarch64', 'arm64')
+              or distribution != 'oldstable')
+
     # Guess the loopback device for the filesystem
-    matches = re.match(r'^/dev/mapper/loop(\d+)p\d+$', partition)
+    matches = re.match(r'^/dev/mapper/loop(\d+)p(\d+)$', partition)
     assert matches
     loop_device = f'/dev/loop{matches[1]}'
+    if is_efi:
+        efi_device = f'/dev/mapper/loop{matches[1]}p{int(matches[2]) - 1}'
 
     # Mount /dev, /proc and run grub commands in chroot
     grub_args = []
     if platform.machine() in ('aarch64', 'arm64'):
         grub_args += ['--no-nvram']
+    elif distribution != 'oldstable':
+        grub_args += [
+            '--target=x86_64-efi', '--no-nvram', '--uefi-secure-boot'
+        ]
 
     subprocess.run(
         ['sudo', 'mount', '-o', 'bind', '/dev/', f'{mount_point}/dev'],
@@ -859,6 +877,11 @@ def _update_fsid(mount_point: str, partition: str, old_fsid: str,
     subprocess.run(
         ['sudo', 'mount', '-o', 'bind', '/proc/', f'{mount_point}/proc'],
         check=True)
+    if is_efi:
+        subprocess.run(
+            ['sudo', 'mount', efi_device, f'{mount_point}/boot/efi'],
+            check=True)
+
     subprocess.run(['sudo', 'chroot', mount_point, 'update-grub'], check=True)
     subprocess.run(
         ['sudo', 'chroot', mount_point, 'grub-install', loop_device] +
@@ -867,6 +890,10 @@ def _update_fsid(mount_point: str, partition: str, old_fsid: str,
         'sudo', 'chroot', mount_point, 'sed', '-ie',
         f's|UUID={old_fsid}|UUID={new_fsid}|', '/etc/fstab'
     ], check=True)
+    if is_efi:
+        subprocess.run(['sudo', 'umount', f'{mount_point}/boot/efi'],
+                       check=True)
+
     subprocess.run(['sudo', 'umount', f'{mount_point}/proc'], check=True)
     subprocess.run(['sudo', 'umount', f'{mount_point}/dev'], check=True)
 
@@ -903,11 +930,7 @@ def _setup_users(image_file: pathlib.Path):
            str(gid), 'plinth'], stdout=subprocess.DEVNULL)
 
     logger.info('In image: Setting up sudo for users "fbx" and "plinth"')
-    sudo_config = 'Cmnd_Alias FREEDOMBOX_ACTION_DEV = /usr/share/plinth/' \
-        'actions/actions, /freedombox/actions/actions\n' \
-        'Defaults!FREEDOMBOX_ACTION_DEV closefrom_override\n' \
-        'plinth    ALL=(ALL:ALL) NOPASSWD:SETENV : FREEDOMBOX_ACTION_DEV\n' \
-        'fbx    ALL=(ALL:ALL) NOPASSWD : ALL\n'
+    sudo_config = 'fbx    ALL=(ALL:ALL) NOPASSWD : ALL\n'
     _runc(image_file, ['tee', '/etc/sudoers.d/01-freedombox-development'],
           input=sudo_config.encode(), stdout=subprocess.DEVNULL)
 
@@ -944,7 +967,7 @@ def _setup_ssh(image_file: pathlib.Path):
     _runc(image_file, ['chown', 'fbx:fbx', '/home/fbx/.ssh/authorized_keys'])
 
 
-def _setup_image(image_file: pathlib.Path):
+def _setup_image(image_file: pathlib.Path, skip_install: bool = False):
     """Prepare the image for execution."""
     setup_file = image_file.with_suffix(image_file.suffix + '.setup')
     if setup_file.exists():
@@ -956,9 +979,10 @@ def _setup_image(image_file: pathlib.Path):
     _runc(image_file, ['tee', '/etc/apt/apt.conf.d/20auto-upgrades'],
           input=contents.encode())
 
-    logger.info('In image: Disabling FreedomBox service')
-    _runc(image_file, ['systemctl', 'disable', 'plinth'],
-          stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+    if not skip_install:
+        logger.info('In image: Disabling FreedomBox service')
+        _runc(image_file, ['systemctl', 'disable', 'plinth'],
+              stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
 
     logger.info('In image: Creating virtiofs mount at /freedombox')
     mount = '''[Unit]
@@ -1016,15 +1040,19 @@ def _is_provisioned(distribution: str) -> bool:
     return provision_file.exists()
 
 
-def _provision(image_file: pathlib.Path, machine_type: str, distribution: str):
+def _provision(image_file: pathlib.Path, machine_type: str, distribution: str,
+               skip_install: bool = False):
     """Run app setup inside the container."""
     if _is_provisioned(distribution):
         return
 
-    machine = Machine.get_instance(machine_type, distribution)
-    ssh_command = machine.get_ssh_command()
-    subprocess.run(ssh_command + ['bash'], check=True,
-                   input=PROVISION_SCRIPT.encode())
+    if skip_install:
+        logger.info('Skipping provision step (--skip-install)')
+    else:
+        machine = Machine.get_instance(machine_type, distribution)
+        ssh_command = machine.get_ssh_command()
+        subprocess.run(ssh_command + ['bash'], check=True,
+                       input=PROVISION_SCRIPT.encode())
 
     provision_file = image_file.with_suffix(image_file.suffix + '.provisioned')
     provision_file.touch()
@@ -1054,7 +1082,7 @@ Folder overlay        :    (host, read-only){project_folder}
 
 SSH easily            : {script} ssh {options}
 Run tests             : {script} run-tests {options} [ --pytest-args ... ]
-Run FreedomBox inside : freedombox-develop
+Watch FreedomBox logs : sudo freedombox-logs
 
 Web access            : https://{ip_address}/
 Ports access          : Any port on {ip_address}
@@ -1063,7 +1091,7 @@ Terminal login        : sudo machinectl login fbx-{distribution}
 Open a root shell     : sudo machinectl shell fbx-{distribution}
 Shutdown              : {script} stop {options}
 Destroy               : {script} destroy {options}
-Reset                 : {script} destroy {options}; {script} up {options}'''
+Reset                 : {script} destroy {options}; {script} start {options}'''
     logger.info(message)
 
 
@@ -1327,9 +1355,8 @@ VirtualEthernet=yes
             if result.returncode:
                 raise Exception(f'Image file {image_link} is not a symlink.')
 
-            subprocess.run(['sudo', 'rm', '--force',
-                            str(image_link)], check=False)
-
+        # May be linked to wrong place (such as old .img file)
+        subprocess.run(['sudo', 'rm', '--force', str(image_link)], check=False)
         subprocess.run([
             'sudo', 'ln', '--symbolic',
             str(image_file.resolve()),
@@ -1357,9 +1384,11 @@ class VM(Machine):
             pass
 
         qcow_image = self._create_qcow_image()
+        firmware = 'firmware="efi"' if self.distribution != 'oldstable' else ''
         domain_xml = LIBVIRT_DOMAIN_XML_TEMPLATE.format(
             domain_name=self.machine_name, memory_mib='2048', cpus='4',
-            image_file=qcow_image, source_dir=_get_project_folder())
+            firmware=firmware, image_file=qcow_image,
+            source_dir=_get_project_folder())
 
         with tempfile.NamedTemporaryFile() as file_handle:
             file_handle.write(domain_xml.encode())
@@ -1390,7 +1419,7 @@ class VM(Machine):
 
         logger.info('Running `virsh destroy %s`', self.machine_name)
         try:
-            self._virsh(['undefine', self.machine_name],
+            self._virsh(['undefine', '--nvram', self.machine_name],
                         stdout=subprocess.DEVNULL)
         except subprocess.CalledProcessError:
             pass
@@ -1399,7 +1428,7 @@ class VM(Machine):
         """Remove all traces of the VM from the host."""
         logger.info('Running `virsh undefine %s`', self.machine_name)
         try:
-            self._virsh(['undefine', self.machine_name],
+            self._virsh(['undefine', '--nvram', self.machine_name],
                         stdout=subprocess.DEVNULL)
         except subprocess.CalledProcessError:
             pass
@@ -1458,7 +1487,7 @@ class VM(Machine):
         qcow_image.unlink(missing_ok=True)
 
 
-def subcommand_up(arguments: argparse.Namespace):
+def subcommand_start(arguments: argparse.Namespace):
     """Download, setup and bring up the container."""
     machine = Machine.get_instance(arguments.machine_type,
                                    arguments.distribution)
@@ -1470,11 +1499,13 @@ def subcommand_up(arguments: argparse.Namespace):
     _verify_dependencies()
     image_file = _download_disk_image(arguments.distribution,
                                       arguments.hkp_client)
-    _resize_disk_image(image_file, arguments.image_size)
-    _setup_image(image_file)
+    _resize_disk_image(image_file, arguments.image_size,
+                       arguments.distribution)
+    _setup_image(image_file, arguments.skip_install)
     machine.setup()
     machine.launch()
-    _provision(image_file, arguments.machine_type, arguments.distribution)
+    _provision(image_file, arguments.machine_type, arguments.distribution,
+               arguments.skip_install)
     _print_banner(arguments.machine_type, arguments.distribution)
 
 
@@ -1561,7 +1592,13 @@ def main():
     logging.basicConfig(level='INFO', format='> %(message)s')
     arguments = parse_arguments()
 
-    subcommand = arguments.subcommand.replace('-', '_')
+    aliases = {
+        'up': 'start',
+        'down': 'stop',
+    }
+
+    subcommand: str = arguments.subcommand.replace('-', '_')
+    subcommand = aliases.get(subcommand, subcommand)
     subcommand_method = globals()['subcommand_' + subcommand]
     subcommand_method(arguments)
 

data/etc/apache2/conf-available/freedombox-tls-site-macro.conf

@@ -16,8 +16,14 @@
             SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
 
             # Automatically obtained certificates from Let's Encrypt
-            SSLCertificateFile /etc/letsencrypt/live/$domain/fullchain.pem
-            SSLCertificateKeyFile /etc/letsencrypt/live/$domain/privkey.pem
+            <IfFile /etc/letsencrypt/live/$domain/privkey.pem>
+                SSLCertificateFile /etc/letsencrypt/live/$domain/fullchain.pem
+                SSLCertificateKeyFile /etc/letsencrypt/live/$domain/privkey.pem
+            </IfFile>
+            <IfFile !/etc/letsencrypt/live/$domain/privkey.pem>
+                SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
+                SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
+            </IfFile>
 
             <FilesMatch "\.(cgi|shtml|phtml|php)$">
                 SSLOptions +StdEnvVars
@@ -25,6 +31,19 @@
             <Directory /usr/lib/cgi-bin>
                 SSLOptions +StdEnvVars
             </Directory>
+
+            <IfFile /etc/apache2/includes/all-domains-include-freedombox.conf>
+                Include includes/all-domains-include-freedombox.conf
+            </IfFile>
+            <IfFile /etc/apache2/includes/all-domains-include.conf>
+                Include includes/all-domains-include.conf
+            </IfFile>
+            <IfFile /etc/apache2/includes/$domain-include-freedombox.conf>
+                Include includes/$domain-include-freedombox.conf
+            </IfFile>
+            <IfFile /etc/apache2/includes/$domain-include.conf>
+                Include includes/$domain-include.conf
+            </IfFile>
         </VirtualHost>
     </IfModule>
 </Macro>

data/etc/apache2/conf-available/freedombox-tls.conf

@@ -12,6 +12,7 @@
     # Don't redirect for onion sites as it is not needed and leads to
     # unnecessary warning.
     RewriteCond %{HTTP_HOST} !^.*\.onion$ [NC]
+    RewriteCond %{REQUEST_URI} !^/freedombox/apache/discover-idp/$ [NC]
     ReWriteCond %{HTTPS} !=on
     RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
 </LocationMatch>

data/etc/apache2/conf-available/freedombox.conf

@@ -39,56 +39,16 @@
 </If>
 
 ##
-## Redirect traffic on home to /plinth as part of turning the machine
+## Redirect traffic on home to /freedombox as part of turning the machine
 ## into FreedomBox server.  Plinth then acts as a portal to reach all
 ## other services.
 ##
-RedirectMatch "^/$" "/plinth"
+<IfFile !/etc/apache2/conf-enabled/freedombox-apache-homepage.conf>
+    RedirectMatch "^/$" "/freedombox"
+</IfFile>
 
 ##
-## Disable sending Referer (sic) header from FreedomBox web interface to
-## external websites. This improves privacy by not disclosing FreedomBox
-## domains/URLs to external domains. Apps such as blogs which want to popularize
-## themselves with referrer header may still do so.
-##
-## A strict Content Security Policy.
-## - @fonts are allowed only from FreedomBox itself.
-## - <frame>/<iframe> sources are disabled.
-## - <img> sources are allowed only from FreedomBox itself.
-## - Manifest file is not allowed as there is none yet.
-## - <audio>, <video>, <track> tags are not allowed yet.
-## - <object>, <embed>, <applet> tags are not allowed yet.
-## - Allow JS from FreedomBox itself (no inline and attribute scripts).
-## - Allow inline CSS and CSS files from Freedombox itself.
-## - Web worker sources are allowed only from FreedomBox itself (for JSXC).
-## - All other fetch sources including Ajax are not allowed from FreedomBox
-##   itself.
-## - <base> tag is not allowed.
-## - No plugins types are alllowed since object-src is 'none'.
-## - Form action should be to FreedomBox itself.
-## - This interface may be not embedded in <frame>, <iframe>, etc. tags.
-## - When serving HTTPS, don't allow HTTP assets.
-##
-## Enable strict sandboxing enabled with some exceptions:
-## - Allow running Javascript.
-## - Allow popups as sometimes we use <a target=_blank>
-## - Allow popups to have different sandbox requirements as we launch apps' web
-##   clients.
-## - Allow forms to support configuration forms.
-## - Allow policies to treat same origin differently from other origins
-## - Allow downloads such as backup tarballs.
-##
-## Disable browser guessing of MIME types. FreedoBox already sets good content
-## types for all the common file types.
-##
-<LocationMatch "^/(plinth|freedombox)">
-    Header set Referrer-Policy 'same-origin'
-    Header set Content-Security-Policy "font-src 'self'; frame-src 'none'; img-src 'self' data:; manifest-src 'none'; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self'; default-src 'self'; base-uri 'none'; sandbox allow-scripts allow-popups allow-popups-to-escape-sandbox allow-forms allow-same-origin allow-downloads; form-action 'self'; frame-ancestors 'none'; block-all-mixed-content;"
-    Header set X-Content-Type-Options 'nosniff'
-</LocationMatch>
-
-##
-## On all sites, provide FreedomBox on a default path: /plinth
+## On all sites, provide FreedomBox on a default path: /freedombox
 ##
 ## Requires the following Apache modules to be enabled:
 ##   mod_headers
@@ -96,7 +56,8 @@ RedirectMatch "^/$" "/plinth"
 ##   mod_proxy_http
 ##
 <Location /freedombox>
-    ProxyPass        http://127.0.0.1:8000/plinth
+    ProxyPass        http://127.0.0.1:8000/freedombox
+    ProxyPreserveHost On
     ## Send the scheme from user's request to enable Plinth to redirect
     ## URLs, set cookies, set absolute URLs (if any) properly.
     RequestHeader    set X-Forwarded-Proto 'https' env=HTTPS
@@ -110,7 +71,20 @@ RedirectMatch "^/$" "/plinth"
     RequestHeader    unset X-Forwarded-For
 </Location>
 <Location /plinth>
-    ProxyPass        http://127.0.0.1:8000/plinth
+    ProxyPass        http://127.0.0.1:8000/freedombox
+    ProxyPreserveHost On
+    RequestHeader    set X-Forwarded-Proto 'https' env=HTTPS
+    RequestHeader    unset X-Forwarded-For
+</Location>
+<Location /.well-known/openid-configuration>
+    ProxyPass        http://127.0.0.1:8000/freedombox/o/.well-known/openid-configuration
+    ProxyPreserveHost On
+    RequestHeader    set X-Forwarded-Proto 'https' env=HTTPS
+    RequestHeader    unset X-Forwarded-For
+</Location>
+<Location /.well-known/jwks.json>
+    ProxyPass        http://127.0.0.1:8000/freedombox/o/.well-known/jwks.json
+    ProxyPreserveHost On
     RequestHeader    set X-Forwarded-Proto 'https' env=HTTPS
     RequestHeader    unset X-Forwarded-For
 </Location>
@@ -122,7 +96,7 @@ RedirectMatch "^/$" "/plinth"
 <Location ~ ^/favicon\.ico$>
     <IfModule mod_rewrite.c>
         RewriteEngine On
-        RewriteRule /favicon\.ico$ "/plinth/static/theme/img/favicon.ico" [PT]
+        RewriteRule /favicon\.ico$ "/freedombox/static/theme/img/favicon.ico" [PT]
     </IfModule>
 </Location>
 
@@ -152,3 +126,12 @@ ErrorLog "|/usr/bin/systemd-cat --identifier=apache-error"
 # records its own timestamp.
 ErrorLogFormat "[%-m:%l] [pid %P:tid %{g}T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i"
 CustomLog "|/usr/bin/systemd-cat --identifier=apache-access" vhost_combined
+
+## When showing an index page for a directory listing, ensure that viewport's
+## width is the same as the device's width. Directory index pages generated by
+## mod_autoindex are reasonably suitable for mobile devices. However, without
+## the directive, mobile devices will assume the page to be not-mobile friendly
+## and use a larger view port than the device size.
+<IfModule mod_autoindex.c>
+    IndexHeadInsert "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">"
+</IfModule>

data/etc/sudoers.d/plinth

@@ -1,11 +1,3 @@
-#
-# Allow plinth user to run plinth action scripts with superuser privileges
-# without needing a password.
-#
-Cmnd_Alias FREEDOMBOX_ACTION = /usr/share/plinth/actions/actions
-Defaults!FREEDOMBOX_ACTION closefrom_override
-plinth    ALL=(ALL:ALL) NOPASSWD:FREEDOMBOX_ACTION
-
 #
 # On FreedomBox, allow all users in the 'admin' LDAP group to execute
 # commands as root.

data/usr/lib/systemd/system/freedombox-privileged.service

@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+[Unit]
+Description=FreedomBox Privileged Service
+Documentation=https://wiki.debian.org/FreedomBox/
+# Don't hit the start rate limiting.
+StartLimitIntervalSec=0
+# Stop/restart along with .socket unit (invoked from dpkg scripts).
+PartOf=freedombox-privileged.socket
+# Uploaded files in /var/tmp/ are shared with FreedomBox web service.
+JoinsNamespaceOf=plinth.service
+
+[Service]
+Type=notify
+ExecStart=/usr/lib/freedombox/freedombox-privileged
+TimeoutSec=300s
+User=root
+Group=root
+NotifyAccess=main
+# Uploaded files in /var/tmp/ are shared with FreedomBox web service by joining
+# namespaces.
+PrivateTmp=yes
+Restart=on-failure
+# Don't restart too fast
+RestartSec=1
+RestartSteps=3
+RestartMaxDelaySec=5

data/usr/lib/systemd/system/freedombox-privileged.socket

@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+[Unit]
+Description=FreedomBox Privileged Service Socket
+Documentation=https://wiki.debian.org/FreedomBox/
+
+[Socket]
+Accept=no
+ListenStream=/run/freedombox/privileged.socket
+SocketUser=root
+SocketGroup=root
+SocketMode=0666
+DirectoryMode=755
+
+[Install]
+WantedBy=sockets.target

data/usr/lib/systemd/system/plinth.service

@@ -5,6 +5,8 @@ Description=FreedomBox Service (Plinth)
 Documentation=man:plinth(1)
 After=network.target
 StartLimitIntervalSec=0
+# Uploaded files in /var/tmp/ are shared with FreedomBox privileged service.
+JoinsNamespaceOf=freedombox-privileged.service
 
 [Service]
 Type=notify
@@ -15,9 +17,9 @@ RestartSec=5
 ExecReload=/bin/kill -HUP $MAINPID
 User=plinth
 Group=plinth
-StandardOutput=null
-StandardError=null
 NotifyAccess=main
+# Uploaded files in /var/tmp/ are shared with FreedomBox privileged service by
+# joining namespaces.
 PrivateTmp=yes
 
 [Install]

debian/control

@@ -1,69 +1,66 @@
 Source: freedombox
 Section: web
-Priority: optional
 Maintainer: FreedomBox packaging team <freedombox-pkg-team@lists.alioth.debian.org>
 Uploaders:
- Tzafrir Cohen <tzafrir@debian.org>,
- Piotr Ożarowski <piotr@debian.org>,
  Petter Reinholdtsen <pere@debian.org>,
  Sunil Mohan Adapa <sunil@medhas.org>,
- Nick Daly <Nick.M.Daly@gmail.com>,
  Federico Ceratto <federico@debian.org>,
  James Valleroy <jvalleroy@mailbox.org>,
 Build-Depends:
  debhelper-compat (= 13),
+ dh-sequence-installsysusers,
  dblatex,
  dh-python,
  docbook-xsl,
- e2fsprogs,
+ e2fsprogs <!nocheck>,
  gir1.2-nm-1.0,
- libjs-bootstrap5,
+ libjs-bootstrap5 <!nocheck>,
+ libjs-htmx <!nocheck>,
 # Older libjs-bootstrap5 does not have proper dependency on popper.js >= 2.0
- node-popper2,
+ node-popper2 <!nocheck>,
  pybuild-plugin-pyproject,
  python3-all:any,
- python3-apt,
+ python3-apt <!nocheck>,
  python3-augeas,
- python3-bootstrapform,
+ python3-bootstrapform <!nocheck>,
  python3-build,
  python3-cherrypy3,
- python3-configobj,
- python3-cryptography,
+ python3-configobj <!nocheck>,
+ python3-cryptography <!nocheck>,
  python3-dbus,
  python3-django,
- python3-django-axes,
- python3-django-captcha,
+ python3-django-axes <!nocheck>,
+ python3-django-captcha <!nocheck>,
 # Explictly depend on ipware as it is optional dependecy of django-axes
- python3-django-ipware,
- python3-django-stronghold,
+ python3-django-ipware <!nocheck>,
+ python3-django-oauth-toolkit <!nocheck>,
+ python3-django-stronghold <!nocheck>,
+ python3-fido2 <!nocheck>,
  python3-gi,
  python3-markupsafe,
- python3-mypy,
- python3-pampy,
+ python3-mypy <!nocheck>,
+ python3-pampy <!nocheck>,
  python3-pexpect,
  python3-pip,
  python3-psutil,
- python3-pytest,
- python3-pytest-cov,
- python3-pytest-django,
- python3-pytest-runner,
+ python3-pytest <!nocheck>,
+ python3-pytest-cov <!nocheck>,
+ python3-pytest-django <!nocheck>,
+ python3-pytest-runner <!nocheck>,
  python3-requests,
  python3-ruamel.yaml,
+ python3-segno <!nocheck>,
  python3-setuptools,
- python3-setuptools-git,
  python3-systemd,
-# python3-tomli is needed by python3-coverage when pyproject.toml is used
- python3-tomli,
- python3-typeshed,
+ python3-typeshed <!nocheck>,
  python3-yaml,
- sshpass,
+ sshpass <!nocheck>,
  xmlto,
  xsltproc
-Standards-Version: 4.6.2
+Standards-Version: 4.7.3
 Homepage: https://salsa.debian.org/freedombox-team/freedombox
 Vcs-Git: https://salsa.debian.org/freedombox-team/freedombox.git
 Vcs-Browser: https://salsa.debian.org/freedombox-team/freedombox
-Rules-Requires-Root: no
 
 Package: freedombox
 Breaks:
@@ -76,13 +73,10 @@ Depends:
  ${python3:Depends},
  ${misc:Depends},
  ${freedombox:Depends},
- adduser,
  augeas-tools,
  bind9-dnsutils,
  curl,
  debconf,
- fonts-fork-awesome,
- fonts-lato,
 # sgdisk is used in storage app to expand GPT disks
  gdisk,
  gettext,
@@ -93,6 +87,7 @@ Depends:
 # For gdbus used to call hooks into service
  libglib2.0-bin,
  libjs-bootstrap5,
+ libjs-htmx,
  lsof,
  netcat-openbsd,
  network-manager,
@@ -112,7 +107,9 @@ Depends:
  python3-django-captcha,
 # Explictly depend on ipware as it is optional dependecy of django-axes
  python3-django-ipware,
+ python3-django-oauth-toolkit,
  python3-django-stronghold,
+ python3-fido2,
  python3-gi,
  python3-markupsafe,
  python3-pampy,
@@ -138,8 +135,6 @@ Recommends:
  libnss-mdns,
 # Resolve current hostname without /etc/hosts
  libnss-myhostname,
-# Block repeated failed PAM login attempts
- libpam-abl,
 # Priority: standard
  locales,
 # Precompiled data for all locales

debian/copyright

@@ -2,7 +2,7 @@ Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Source: https://salsa.debian.org/freedombox-team/freedombox
 
 Files: *
-Copyright: 2011-2024 FreedomBox Authors
+Copyright: 2011-2026 FreedomBox Authors
 License: AGPL-3+
 
 Files: plinth/modules/jsxc/static/icons/jsxc.png
@@ -15,7 +15,7 @@ Files: doc/*.xml
        doc/*.png
        doc/*.jpg
        doc/*.wiki
-Copyright: 2011-2023 FreedomBox Authors
+Copyright: 2011-2025 FreedomBox Authors
 License: CC-BY-SA-4.0
 
 Files: doc/visual_design/apple-touch-icon*
@@ -32,12 +32,16 @@ Copyright: 2012 FreedomBox Foundation
 Comment: Original Author: Robert Martinez
 License: GPL-3+
 
-Files: static/themes/default/icons/app-store.png
-       static/themes/default/icons/app-store.svg
+Files: static/themes/default/icons/app-store.svg
 Copyright: Marie Van den Broeck (https://thenounproject.com/marie49/)
 Comment: https://thenounproject.com/icon/162372/
 License: CC-BY-SA-3.0
 
+Files: static/themes/default/js/color-modes.js
+Copyright: 2011-2025 The Bootstrap Authors
+Comment: https://getbootstrap.com/docs/5.3/customize/color-modes/
+License: CC-BY-3.0
+
 Files: plinth/modules/bepasty/static/icons/bepasty.svg
 Copyright: (c) 2014 by the Bepasty Team, see the AUTHORS file.
 Comment: https://github.com/bepasty/bepasty-server/blob/master/src/bepasty/static/app/bepasty.svg
@@ -74,6 +78,7 @@ Files: plinth/modules/ejabberd/static/icons/ejabberd.png
        plinth/modules/rssbridge/static/icons/rssbridge.svg
        plinth/modules/zoph/static/icons/zoph.png
        plinth/modules/zoph/static/icons/zoph.svg
+       static/themes/default/img/application.svg
        static/themes/default/img/network-connection.svg
        static/themes/default/img/network-connection-vertical.svg
        static/themes/default/img/network-ethernet.svg
@@ -95,14 +100,6 @@ Copyright: 2020 Adwaita Icon Theme Authors, GNOME Project
 Comment: https://github.com/GNOME/adwaita-icon-theme/ http://www.gnome.org
 License: LGPL-3 or CC-BY-SA-3.0-US
 
-Files: static/themes/default/icons/f-droid.png
-       static/themes/default/icons/f-droid.svg
-Copyright: 2012 William Theaker
-           2013 Robert Martinez
-           2015 Andrew Nayenko
-Comment: https://gitlab.com/fdroid/artwork/blob/master/fdroid-logo-2015/fdroid-logo.svg
-License: CC-BY-SA-3.0 or GPL-3+
-
 Files: plinth/modules/featherwiki/static/icons/featherwiki.png
        plinth/modules/featherwiki/static/icons/featherwiki.svg
 Copyright: 2022 Robbie Antenesse <dev@alamantus.com>
@@ -115,14 +112,11 @@ Copyright: 2010 Git Authors
 Comment: https://github.com/git/git/blob/master/gitweb/static/git-logo.png
 License: GPL-2
 
-Files: static/themes/default/icons/google-play.png
-Copyright: Chameleon Design (https://thenounproject.com/Chamedesign/)
-Comment: https://thenounproject.com/icon/887917/
-License: CC-BY-3.0-US
-
-Files: static/themes/default/icons/gnu-linux.png
-Copyright: 2017 Cowemoji
-License: CC0-1.0
+Files: plinth/modules/homeassistant/static/icons/homeassistant.png
+       plinth/modules/homeassistant/static/icons/homeassistant.svg
+Copyright: Home Assistant Core Developers
+Comment: https://github.com/home-assistant/core/blob/dev/tests/components/image_upload/logo.png
+License: Apache-2.0
 
 Files: plinth/modules/ikiwiki/static/icons/ikiwiki.png
        plinth/modules/ikiwiki/static/icons/ikiwiki.svg
@@ -137,7 +131,10 @@ License: ISC
 
 Files: plinth/modules/janus/static/icons/janus.png
        plinth/modules/janus/static/icons/janus.svg
-Copyright: 2014-2022 Meetecho
+       plinth/modules/janus/static/janus-video-room.css
+       plinth/modules/janus/static/janus-video-room.js
+       plinth/modules/janus/templates/janus_video_room.html
+Copyright: 2014-2025 Meetecho
 License: GPL-3 with OpenSSL exception
 
 Files: plinth/modules/kiwix/static/icons/kiwix.png
@@ -146,12 +143,6 @@ Copyright: 2020 The other Kiwix guy
 Comment: https://commons.wikimedia.org/wiki/File:Kiwix_logo_v3.svg
 License: CC-BY-SA-4.0
 
-Files: static/themes/default/icons/macos.png
-       static/themes/default/icons/macos.svg
-Copyright: Vectors Market (https://thenounproject.com/vectorsmarket/)
-Comment: https://thenounproject.com/icon/1203053/
-License: CC-BY-SA-3.0
-
 Files: plinth/modules/matrixsynapse/static/icons/matrixsynapse.png
 Copyright: 2017 Kishan Raval
 Comment: https://github.com/thekishanraval/Logos
@@ -169,7 +160,7 @@ License: CC-BY-SA-3.0
 
 Files: plinth/modules/minetest/static/icons/minetest.svg
 Copyright: 2015 Calinou, Nils Dagsson Moskopp
-Comment: https://github.com/minetest/minetest/blob/master/misc/minetest.svg
+Comment: https://github.com/luanti-org/luanti/blob/master/misc/luanti.svg
 License: CC-BY-SA-3.0
 
 Files: plinth/modules/miniflux/static/icons/miniflux.png
@@ -312,14 +303,12 @@ Copyright: Transmission Authors
 Comment: https://github.com/transmission/transmission/blob/master/gtk/icons/hicolor_apps_scalable_transmission.svg
 License: GPL-3
 
-Files: plinth/modules/ttrss/static/icons/ttrss.png
-Copyright: Mark James <mjames@gmail.com>
-License: CC-BY-3.0
-
-Files: plinth/modules/ttrss/static/icons/ttrss.svg
-Copyright: 2005 Andrew Dolgov
-Comment: https://git.tt-rss.org/fox/tt-rss/src/master/images/favicon-72px.png
-License: GPL-3+
+Files: plinth/modules/upgrades/data/usr/share/augeas/lenses/aptsources.aug
+       plinth/modules/upgrades/data/usr/share/augeas/lenses/tests/test_aptsources.aug
+Copyright: 2007-2025 David Lutterkort
+Comment: https://github.com/hercules-team/augeas/blob/master/lenses/aptsources.aug
+         https://github.com/hercules-team/augeas/blob/master/lenses/tests/test_aptsources.aug
+License: LGPL-2.1+
 
 Files: plinth/modules/wordpress/static/icons/wordpress.png
        plinth/modules/wordpress/static/icons/wordpress.svg
@@ -327,12 +316,6 @@ Copyright: 2011-2021 WordPress Contributors
 Comment: https://github.com/WordPress/wordpress-develop/blob/master/src/wp-admin/images/wordpress-logo.svg
 License: GPL-2+
 
-Files: static/themes/default/icons/windows.png
-       static/themes/default/icons/windows.svg
-Copyright: 2007 ruli (https://thenounproject.com/2007ruli/)
-Comment: https://thenounproject.com/icon/1206946/
-License: CC-BY-SA-3.0
-
 Files: plinth/modules/wireguard/static/icons/wireguard.png
        plinth/modules/wireguard/static/icons/wireguard.svg
 Copyright: 2019 WireGuard LLC
@@ -344,13 +327,88 @@ Copyright: 2008 GNOME icon artists
 Comment: https://commons.wikimedia.org/wiki/File:Gnome-computer.svg
 License: LGPL-3+ or CC-BY-SA-3.0
 
-Files: static/themes/default/lato/*
-Copyright: (c) 2010-2014, Łukasz Dziedzic
+Files: static/themes/default/icons/adjust.svg
+       static/themes/default/icons/android.svg
+       static/themes/default/icons/arrow-right.svg
+       static/themes/default/icons/ban.svg
+       static/themes/default/icons/bar-chart.svg
+       static/themes/default/icons/bars.svg
+       static/themes/default/icons/bell-o.svg
+       static/themes/default/icons/book.svg
+       static/themes/default/icons/check-circle.svg
+       static/themes/default/icons/check.svg
+       static/themes/default/icons/chevron-right.svg
+       static/themes/default/icons/clock-o.svg
+       static/themes/default/icons/cog.svg
+       static/themes/default/icons/comments.svg
+       static/themes/default/icons/compass.svg
+       static/themes/default/icons/debian.svg
+       static/themes/default/icons/download.svg
+       static/themes/default/icons/eject.svg
+       static/themes/default/icons/exclamation-triangle.svg
+       static/themes/default/icons/external-link.svg
+       static/themes/default/icons/eye-slash.svg
+       static/themes/default/icons/eye.svg
+       static/themes/default/icons/f-droid.svg
+       static/themes/default/icons/files-o.svg
+       static/themes/default/icons/film.svg
+       static/themes/default/icons/flag.svg
+       static/themes/default/icons/freedombox.svg
+       static/themes/default/icons/frown-o.svg
+       static/themes/default/icons/globe-w.svg
+       static/themes/default/icons/gnu-linux.svg
+       static/themes/default/icons/google-play.svg
+       static/themes/default/icons/hdd-o.svg
+       static/themes/default/icons/heartbeat.svg
+       static/themes/default/icons/heart.svg
+       static/themes/default/icons/home.svg
+       static/themes/default/icons/hourglass-o.svg
+       static/themes/default/icons/info-circle.svg
+       static/themes/default/icons/key.svg
+       static/themes/default/icons/life-ring.svg
+       static/themes/default/icons/line-chart.svg
+       static/themes/default/icons/lock.svg
+       static/themes/default/icons/macos.svg
+       static/themes/default/icons/moon.svg
+       static/themes/default/icons/pencil-square-o.svg
+       static/themes/default/icons/plus.svg
+       static/themes/default/icons/power-off.svg
+       static/themes/default/icons/question-circle.svg
+       static/themes/default/icons/refresh.svg
+       static/themes/default/icons/repeat.svg
+       static/themes/default/icons/rocket.svg
+       static/themes/default/icons/shield.svg
+       static/themes/default/icons/signal.svg
+       static/themes/default/icons/smile-o.svg
+       static/themes/default/icons/spinner.svg
+       static/themes/default/icons/star.svg
+       static/themes/default/icons/sun.svg
+       static/themes/default/icons/tags.svg
+       static/themes/default/icons/tag.svg
+       static/themes/default/icons/terminal.svg
+       static/themes/default/icons/th.svg
+       static/themes/default/icons/times.svg
+       static/themes/default/icons/trash-o.svg
+       static/themes/default/icons/trash.svg
+       static/themes/default/icons/upload.svg
+       static/themes/default/icons/user.svg
+       static/themes/default/icons/users.svg
+       static/themes/default/icons/wifi.svg
+       static/themes/default/icons/windows.svg
+       static/themes/default/icons/wrench.svg
+Copyright: 2018, Fork Awesome
+Comment: https://github.com/ForkAwesome/Fork-Awesome/tree/master/src/icons/svg/
 License: OFL-1.1
 
+Files: static/themes/default/icons/fedora.svg
+       static/themes/default/icons/homebrew.svg
+Copyright: 2026, Simple Icons
+Comment: https://github.com/simple-icons/simple-icons/
+License: CC0-1.0
+
 Files: debian/*
 Copyright: 2013 Tzafrir Cohen
-           2013-2024 FreedomBox Authors
+           2013-2026 FreedomBox Authors
 License: GPL-2+
 
 License: AGPL-3+
@@ -2817,90 +2875,6 @@ License: MPL-2.0
  On Debian systems, the complete text of the Mozilla Public License, v. 2.0 can
  be found in "/usr/share/common-licenses/MPL-2.0".
 
-License: OFL-1.1
- PREAMBLE
-  The goals of the Open Font License (OFL) are to stimulate worldwide
- development of collaborative font projects, to support the font creation
- efforts of academic and linguistic communities, and to provide a free and
- open framework in which fonts may be shared and improved in partnership
- with others.
- .
- The OFL allows the licensed fonts to be used, studied, modified and
- redistributed freely as long as they are not sold by themselves. The
- fonts, including any derivative works, can be bundled, embedded,
- redistributed and/or sold with any software provided that any reserved
- names are not used by derivative works. The fonts and derivatives,
- however, cannot be released under any other type of license. The
- requirement for fonts to remain under this license does not apply
- to any document created using the fonts or their derivatives.
- .
- DEFINITIONS
- "Font Software" refers to the set of files released by the Copyright
- Holder(s) under this license and clearly marked as such. This may
- include source files, build scripts and documentation.
- .
- "Reserved Font Name" refers to any names specified as such after the
- copyright statement(s).
- .
- "Original Version" refers to the collection of Font Software components as
- distributed by the Copyright Holder(s).
- .
- "Modified Version" refers to any derivative made by adding to, deleting,
- or substituting -- in part or in whole -- any of the components of the
- Original Version, by changing formats or by porting the Font Software to a
- new environment.
- .
- "Author" refers to any designer, engineer, programmer, technical
- writer or other person who contributed to the Font Software.
- .
- PERMISSION & CONDITIONS
-  Permission is hereby granted, free of charge, to any person obtaining
- a copy of the Font Software, to use, study, copy, merge, embed, modify,
- redistribute, and sell modified and unmodified copies of the Font
- Software, subject to the following conditions:
- .
- 1) Neither the Font Software nor any of its individual components,
-    in Original or Modified Versions, may be sold by itself.
- .
- 2) Original or Modified Versions of the Font Software may be bundled,
-    redistributed and/or sold with any software, provided that each copy
-    contains the above copyright notice and this license. These can be
-    included either as stand-alone text files, human-readable headers or
-    in the appropriate machine-readable metadata fields within text or
-    binary files as long as those fields can be easily viewed by the user.
- .
- 3) No Modified Version of the Font Software may use the Reserved Font
-    Name(s) unless explicit written permission is granted by the corresponding
-    Copyright Holder. This restriction only applies to the primary font
-    name as presented to the users.
- .
- 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
-    Software shall not be used to promote, endorse or advertise any
-    Modified Version, except to acknowledge the contribution(s) of the
-    Copyright Holder(s) and the Author(s) or with their explicit written
-    permission.
- .
- 5) The Font Software, modified or unmodified, in part or in whole,
-    must be distributed entirely under this license, and must not be
-    distributed under any other license. The requirement for fonts to
-    remain under this license does not apply to any document created
-    using the Font Software.
- .
- TERMINATION
-  This license becomes null and void if any of the above conditions are
- not met.
- .
- DISCLAIMER
-  THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
- MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
- OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
- COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
- DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
- OTHER DEALINGS IN THE FONT SOFTWARE.
-
 License: public-domain
  This software has been placed into the public domain by its authors.
 
@@ -2923,3 +2897,94 @@ License: Zlib
  .
  3. This notice may not be removed or altered from any source
  distribution.
+
+License: OFL-1.1
+ This Font Software is licensed under the SIL Open Font License,
+ Version 1.1.
+ .
+ This license is copied below, and is also available with a FAQ at:
+ http://scripts.sil.org/OFL
+ .
+ SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+ .
+ PREAMBLE The goals of the Open Font License (OFL) are to stimulate
+ worldwide development of collaborative font projects, to support the font
+ creation efforts of academic and linguistic communities, and to provide
+ a free and open framework in which fonts may be shared and improved in
+ partnership with others.
+ .
+ The OFL allows the licensed fonts to be used, studied, modified and
+ redistributed freely as long as they are not sold by themselves.
+ The fonts, including any derivative works, can be bundled, embedded,
+ redistributed and/or sold with any software provided that any reserved
+ names are not used by derivative works.  The fonts and derivatives,
+ however, cannot be released under any other type of license.  The
+ requirement for fonts to remain under this license does not apply to
+ any document created using the fonts or their derivatives.
+ .
+ DEFINITIONS
+ "Font Software" refers to the set of files released by the Copyright
+ Holder(s) under this license and clearly marked as such.
+ This may include source files, build scripts and documentation.
+ .
+ "Reserved Font Name" refers to any names specified as such after the
+ copyright statement(s).
+ .
+ "Original Version" refers to the collection of Font Software components
+ as distributed by the Copyright Holder(s).
+ .
+ "Modified Version" refers to any derivative made by adding to, deleting,
+ or substituting ? in part or in whole ?
+ any of the components of the Original Version, by changing formats or
+ by porting the Font Software to a new environment.
+ .
+ "Author" refers to any designer, engineer, programmer, technical writer
+ or other person who contributed to the Font Software.
+ .
+ PERMISSION & CONDITIONS
+ .
+ Permission is hereby granted, free of charge, to any person obtaining a
+ copy of the Font Software, to use, study, copy, merge, embed, modify,
+ redistribute, and sell modified and unmodified copies of the Font
+ Software, subject to the following conditions:
+ .
+ 1) Neither the Font Software nor any of its individual components, in
+    Original or Modified Versions, may be sold by itself.
+ .
+ 2) Original or Modified Versions of the Font Software may be bundled,
+    redistributed and/or sold with any software, provided that each copy
+    contains the above copyright notice and this license. These can be
+    included either as stand-alone text files, human-readable headers or
+    in the appropriate machine-readable metadata fields within text or
+    binary files as long as those fields can be easily viewed by the user.
+ .
+ 3) No Modified Version of the Font Software may use the Reserved Font
+    Name(s) unless explicit written permission is granted by the
+    corresponding Copyright Holder. This restriction only applies to the
+    primary font name as presented to the users.
+ .
+ 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+    Software shall not be used to promote, endorse or advertise any
+    Modified Version, except to acknowledge the contribution(s) of the
+    Copyright Holder(s) and the Author(s) or with their explicit written
+    permission.
+ .
+ 5) The Font Software, modified or unmodified, in part or in whole, must
+    be distributed entirely under this license, and must not be distributed
+    under any other license. The requirement for fonts to remain under
+    this license does not apply to any document created using the Font
+    Software.
+ .
+ TERMINATION
+ This license becomes null and void if any of the above conditions are not met.
+ .
+ DISCLAIMER
+ THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+ OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT.  IN NO EVENT SHALL THE
+ COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+ DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER
+ DEALINGS IN THE FONT SOFTWARE.

debian/freedombox.lintian-overrides

@@ -1,7 +1,3 @@
-# debconf is used only to display a message, and not to get
-# configuration.
-freedombox binary: no-debconf-config
-
 # Apache configuration for the Plinth itself is shipped with proper
 # name plinth.conf.  However, due to the nature of the package, Plinth
 # takes the responsibility of configuring various other services
@@ -19,3 +15,12 @@ freedombox binary: web-application-works-only-with-apache
 # Not documentation
 freedombox: package-contains-documentation-outside-usr-share-doc [usr/share/plinth/static/jslicense.html]
 freedombox: package-contains-documentation-outside-usr-share-doc [usr/lib/python3/dist-packages/plinth-*.dist-info/top_level.txt]
+
+# This executable is meant to executed from systemd service file and is not
+# meant for user. However, don't install to /usr/libexec and follow systemd
+# convention instead.
+freedombox: executable-in-usr-lib [usr/lib/freedombox/freedombox-privileged]
+
+# [Install] section is missing for the privileged daemon service because it is
+# socket activated.
+freedombox: systemd-service-file-missing-install-key [usr/lib/systemd/system/freedombox-privileged.service]

debian/freedombox.manpages

@@ -1 +1,2 @@
+./doc/freedombox-cmd.1
 ./doc/plinth.1

debian/freedombox.postinst

@@ -1,40 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# Source debconf library.
-. /usr/share/debconf/confmodule
-
-# Due to a change in sudo, now it runs PAM modules even on password-less
-# invocations. This leads to plinth not being able to run root privileges. This
-# is because of our own restrictions in /etc/security/access.conf. Since Plinth
-# is locked out after upgrade, we need to do this in postinst.
-sed -i 's+-:ALL EXCEPT root fbx (admin) (sudo):ALL+-:ALL EXCEPT root fbx plinth (admin) (sudo):ALL+' /etc/security/access.conf
-
-case "$1" in
-    configure)
-        if ! getent group plinth >/dev/null; then
-            addgroup --system --quiet plinth
-        fi
-
-        if ! getent passwd plinth >/dev/null; then
-            adduser --system --quiet --ingroup plinth --no-create-home --home /var/lib/plinth plinth
-        fi
-
-        chown plinth: /var/lib/plinth
-        chown plinth: /var/lib/plinth/sessions
-
-        if [ ! -e '/var/lib/freedombox/is-freedombox-disk-image' ]; then
-            umask 377
-            base64 < /dev/urandom | head -c 16 | sed -e 's+$+\n+' > /var/lib/plinth/firstboot-wizard-secret
-            chown plinth:plinth /var/lib/plinth/firstboot-wizard-secret
-            db_subst plinth/firstboot_wizard_secret secret $(cat /var/lib/plinth/firstboot-wizard-secret)
-            db_input high plinth/firstboot_wizard_secret || true
-            db_go
-        fi
-        ;;
-esac
-
-#DEBHELPER#
-
-exit 0

debian/freedombox.postrm

@@ -4,7 +4,6 @@ set -e
 
 case "$1" in
 purge)
-    deluser --system --quiet plinth || true
     rm -rf /var/lib/plinth
 
     # Remove legacy directory too

debian/freedombox.preinst

@@ -1,43 +0,0 @@
-#!/bin/sh
-
-set -e
-
-case "$1" in
-    upgrade)
-        # Handle removing freedombox-setup-repositories.timer from 20.5.
-        if dpkg --compare-versions "$2" le 20.7; then
-            if [ -x "/usr/bin/deb-systemd-invoke" ]; then
-               deb-systemd-invoke stop freedombox-setup-repositories.timer >/dev/null 2>/dev/null || true
-            fi
-
-            if [ -x "/usr/bin/deb-systemd-helper" ]; then
-                deb-systemd-helper purge freedombox-setup-repositories.timer >/dev/null || true
-                deb-systemd-helper unmask freedombox-setup-repositories.timer >/dev/null || true
-            fi
-
-            if [ -d /run/systemd/system ]; then
-                systemctl daemon-reload
-            fi
-        fi
-
-        # Handle removing freedombox-udiskie.service from 20.9.
-        if dpkg --compare-versions "$2" le 20.9; then
-            if [ -x "/usr/bin/deb-systemd-invoke" ]; then
-                deb-systemd-invoke stop freedombox-udiskie.service >/dev/null 2>/dev/null || true
-            fi
-
-            if [ -x "/usr/bin/deb-systemd-helper" ]; then
-                deb-systemd-helper purge freedombox-udiskie.service >/dev/null || true
-                deb-systemd-helper unmask freedombox-udiskie.service >/dev/null || true
-            fi
-
-            if [ -d /run/systemd/system ]; then
-                systemctl daemon-reload
-            fi
-        fi
-        ;;
-esac
-
-#DEBHELPER#
-
-exit 0

debian/freedombox.sysusers

@@ -0,0 +1 @@
+u! plinth - "FreedomBox service" /var/lib/plinth

debian/freedombox.templates

@@ -1,9 +0,0 @@
-Template: plinth/firstboot_wizard_secret
-Type: note
-#flag:translate!:3
-_Description: FreedomBox first wizard secret - ${secret}
- Please note down the above secret. You will be asked to enter this in the
- first screen after you launch the FreedomBox web interface. In case you lose
- it, you can retrieve it by running the following command:
- .
- $ sudo cat /var/lib/plinth/firstboot-wizard-secret

debian/freedombox.tmpfiles

@@ -0,0 +1,2 @@
+d /var/lib/plinth 0755 plinth plinth
+d /var/lib/plinth/sessions 0755 plinth plinth

debian/gbp.conf

@@ -1,6 +1,9 @@
 [DEFAULT]
 debian-branch = main
 
+[buildpackage]
+export-dir = ../build-area/
+
 [dch]
 git-log = --no-merges
 multimaint-merge = True

debian/po/POTFILES.in

@@ -1 +0,0 @@
-[type: gettext/rfc822deb] freedombox.templates

debian/po/ca.po

@@ -1,36 +0,0 @@
-# Catalan translation of plinth's debconf messages
-# Copyright © 2024 Free Software Foundation, Inc.
-# This file is distributed under the same license as the plinth package.
-# poc senderi <pocsenderi@protonmail.com>, 2024.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: plinth\n"
-"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
-"POT-Creation-Date: 2019-11-18 18:11-0500\n"
-"PO-Revision-Date: 2024-11-05 22:18+0100\n"
-"Language: ca\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"Last-Translator: poc senderi <pocsenderi@protonmail.com>\n"
-"Language-Team: Catalan <debian-l10n-catalan@lists.debian.org>\n"
-"X-Generator: Poedit 2.4.2\n"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-msgid "FreedomBox first wizard secret - ${secret}"
-msgstr "Secret per a l'engegada inicial del «wizard» de FreedomBox - ${secret}"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-msgid ""
-"Please note down the above secret. You will be asked to enter this in the "
-"first screen after you launch the FreedomBox web interface. In case you lose "
-"it, you can retrieve it by running the following command:"
-msgstr ""
-"Anoteu el secret anterior. Us serà demanat a la primera pantalla després "
-"d'engegar la interfície web del FreedomBox. En cas que el perdeu, el podeu "
-"recuperar executant la següent ordre:"

debian/po/de.po

@@ -1,37 +0,0 @@
-# Translation of plinth debconf templates to German
-# Copyright (C) 2019 FreedomBox packaging team <freedombox-pkg-team@lists.alioth.debian.org>
-# This file is distributed under the same license as the plinth package.
-# Helge Kreutzmann <debian@helgefjell.de>, 2018, 2019.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: plinth 19.21\n"
-"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
-"POT-Creation-Date: 2019-11-18 18:11-0500\n"
-"PO-Revision-Date: 2019-11-24 06:46+0100\n"
-"Last-Translator: Helge Kreutzmann <debian@helgefjell.de>\n"
-"Language-Team: german <debian-l10n-german@lists.debian.org>\n"
-"Language: de\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"Plural-Forms: nplurals=2; plural=(n != 1);\n"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-msgid "FreedomBox first wizard secret - ${secret}"
-msgstr "Passphrase des Ersteinrichtungsprogramms der FreedomBox - ${secret}"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-msgid ""
-"Please note down the above secret. You will be asked to enter this in the "
-"first screen after you launch the FreedomBox web interface. In case you lose "
-"it, you can retrieve it by running the following command:"
-msgstr ""
-"Bitte schreiben Sie diese geheime Zeichenkette auf. Sie werden auf dem "
-"ersten Bildschirm nach dem Start der FreedomBox-Schnittstelle nach dieser "
-"Zeichenkette gefragt werden. Falls Sie sie verlieren, können Sie sie durch "
-"Ausführung des folgenden Befehls wiedererlangen:"

debian/po/es.po

@@ -1,37 +0,0 @@
-# Translation of plinth debconf templates to Spanish
-# Copyright (C) 2019 FreedomBox packaging team <freedombox-pkg-team@lists.alioth.debian.org>
-# This file is distributed under the same license as the plinth package.
-# Fioddor Superconcentrado <fioddor@gmail.com>, 2019
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: plinth 19.20\n"
-"Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-31 16:07+0000\n"
-"PO-Revision-Date: 2022-08-01 15:13+0200\n"
-"Last-Translator: Camaleón <noelamac@gmail.com>\n"
-"Language-Team: Debian L10n Spanish <debian-l10n-spanish@lists.debian.org>\n"
-"Language: es\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"X-Generator: Poedit 2.4.2\n"
-"Plural-Forms: nplurals=2; plural=(n > 1);\n"
-
-#. Type: note
-#. Description
-#: ../freedombox.templates:1001
-msgid "FreedomBox first wizard secret - ${secret}"
-msgstr "Secreto del asistente al primer arranque de FreedomBox - ${secret}"
-
-#. Type: note
-#. Description
-#: ../freedombox.templates:1001
-msgid ""
-"Please note down the above secret. You will be asked to enter this in the "
-"first screen after you launch the FreedomBox web interface. In case you lose "
-"it, you can retrieve it by running the following command:"
-msgstr ""
-"Por favor, anote esta cadena de texto. Se le pedirá en la primera pantalla "
-"al iniciar la interfaz web de FreedomBox. Si la pierde, podrá recuperarla "
-"ejecutando la siguiente orden:"

debian/po/fr.po

@@ -1,42 +0,0 @@
-# Translation of plinth debconf templates to French
-# Copyright (C) 2018 FreedomBox packaging team <freedombox-pkg-team@lists.alioth.debian.org>
-# This file is distributed under the same license as the plinth package.
-#
-# Jean-Pierre Giraud <jean-pierregiraud@neuf.fr>, 2018, 2019.
-msgid ""
-msgstr ""
-"Project-Id-Version: plinth\n"
-"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
-"POT-Creation-Date: 2019-11-18 18:11-0500\n"
-"PO-Revision-Date: 2019-12-16 10:23+0100\n"
-"Last-Translator: Jean-Pierre Giraud <jean-pierregiraud@neuf.fr>\n"
-"Language-Team: French <debian-l10n-french@lists.debian.org>\n"
-"Language: fr_FR\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"Plural-Forms: nplurals=2; plural=(n > 1);\n"
-"X-Generator: Lokalize 2.0\n"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-msgid "FreedomBox first wizard secret - ${secret}"
-msgstr "Phrase secrète du premier assistant de FreedomBox - ${secret}"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-#| msgid ""
-#| "Please save this string. You will be asked to enter this in the first "
-#| "screen after you launch the FreedomBox interface. In case you lose it, "
-#| "you can find it in the file /var/lib/plinth/firstboot-wizard-secret."
-msgid ""
-"Please note down the above secret. You will be asked to enter this in the "
-"first screen after you launch the FreedomBox web interface. In case you lose "
-"it, you can retrieve it by running the following command:"
-msgstr ""
-"Veuillez noter cette phrase secrète. Le premier écran après le chargement de "
-"l'interface web de FreedomBox vous la demandera. Si vous l'avez oubliée, vous "
-"pourrez la récupérer en exécutant la commande suivante :"
-

debian/po/it.po

@@ -1,35 +0,0 @@
-# freedombox po-debconf italian translation
-# Copyright (C) 2022 freedombox's copyright holder
-# This file is distributed under the same license as the freedombox package.
-# Ceppo <ceppo@oziosi.org>, 2022.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: freedombox\n"
-"Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-08-18 16:09+0000\n"
-"PO-Revision-Date: 2022-08-25 00:00+0000\n"
-"Last-Translator: Ceppo <ceppo@oziosi.org>\n"
-"Language-Team: Italian <debian-l10n-italian@lists.debian.org>\n"
-"Language: it\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-
-#. Type: note
-#. Description
-#: ../freedombox.templates:1001
-msgid "FreedomBox first wizard secret - ${secret}"
-msgstr "Codice del primo wizard di FreedomBox - ${secret}"
-
-#. Type: note
-#. Description
-#: ../freedombox.templates:1001
-msgid ""
-"Please note down the above secret. You will be asked to enter this in the "
-"first screen after you launch the FreedomBox web interface. In case you lose "
-"it, you can retrieve it by running the following command:"
-msgstr ""
-"Annotare il codice indicato sopra. Sarà richiesto di inserirlo nella prima "
-"schermata dopo l'avvio dell'interfaccia web di FreedomBox. Qualora venisse "
-"perso, sarebbe possibile recuperarlo eseguendo il comando seguente:"

debian/po/nl.po

@@ -1,39 +0,0 @@
-# Dutch translation of plinth debconf templates.
-# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the plinth package.
-# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
-# Frans Spiesschaert <Frans.Spiesschaert@yucom.be>, 2018.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: plinth_19.21\n"
-"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
-"POT-Creation-Date: 2019-11-18 18:11-0500\n"
-"PO-Revision-Date: 2019-12-02 21:04+0100\n"
-"Last-Translator: Frans Spiesschaert <Frans.Spiesschaert@yucom.be>\n"
-"Language-Team: Debian Dutch l10n Team <debian-l10n-dutch@lists.debian.org>\n"
-"Language: nl\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"Plural-Forms: nplurals=2; plural=(n != 1);\n"
-"X-Generator: Poedit 2.2.1\n"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-msgid "FreedomBox first wizard secret - ${secret}"
-msgstr "Geheime code voor de initiële wizard van FreedomBox - ${secret}"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-msgid ""
-"Please note down the above secret. You will be asked to enter this in the "
-"first screen after you launch the FreedomBox web interface. In case you lose "
-"it, you can retrieve it by running the following command:"
-msgstr ""
-"Noteer bovenstaande geheime code. Er zal u gevraagd worden om ze in het "
-"openingsscherm in te voeren wanneer u de FreedomBox-interface opstart. In "
-"geval u ze kwijtraakt, kunt u ze terughalen door het volgende commando uit "
-"te voeren:"

debian/po/pt.po

@@ -1,40 +0,0 @@
-# Translation of plinth debconf templates to Portuguese
-# Copyright (C) 2019 FreedomBox packaging team <freedombox-pkg-team@lists.alioth.debian.org>
-# This file is distributed under the same license as the plinth package.
-# Rui Branco - DebianPT <ruipb@debianpt.org>, 2018.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: plinth 0.37.0\n"
-"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
-"POT-Creation-Date: 2019-11-18 18:11-0500\n"
-"PO-Revision-Date: 2018-09-27 15:33+0100\n"
-"Last-Translator: Rui Branco - DebianPT <ruipb@debianpt.org>\n"
-"Language-Team: Portuguese <traduz@debianpt.org>\n"
-"Language: pt\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-msgid "FreedomBox first wizard secret - ${secret}"
-msgstr "Primeiro segredo FreedomBox - ${secret}"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-#, fuzzy
-#| msgid ""
-#| "Please save this string. You will be asked to enter this in the first "
-#| "screen after you launch the FreedomBox interface. In case you lose it, "
-#| "you can find it in the file /var/lib/plinth/firstboot-wizard-secret."
-msgid ""
-"Please note down the above secret. You will be asked to enter this in the "
-"first screen after you launch the FreedomBox web interface. In case you lose "
-"it, you can retrieve it by running the following command:"
-msgstr ""
-"Por favor guarde esta 'string'. Ser-lhe-á pedido para a introduzir na "
-"primeira tela assim que lance a interface FreedomBox. No caso de a perder, "
-"poderá encontrá-la no ficheiro /var/lib/plinth/firstboot-wizard-secret."

debian/po/pt_BR.po

@@ -1,36 +0,0 @@
-# Debconf translations for plinth.
-# Copyright (C) 2020 THE plinth'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the plinth package.
-# Adriano Rafael Gomes <adrianorg@debian.org>, 2020.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: plinth 20.11\n"
-"Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2020-06-24 18:00+0000\n"
-"PO-Revision-Date: 2020-06-24 20:14-0300\n"
-"Last-Translator: Adriano Rafael Gomes <adrianorg@debian.org>\n"
-"Language-Team: Brazilian Portuguese <debian-l10n-portuguese@lists.debian."
-"org>\n"
-"Language: pt_BR\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-
-#. Type: note
-#. Description
-#: ../freedombox.templates:1001
-msgid "FreedomBox first wizard secret - ${secret}"
-msgstr "Segredo do primeiro assistente do FreedomBox - ${secret}"
-
-#. Type: note
-#. Description
-#: ../freedombox.templates:1001
-msgid ""
-"Please note down the above secret. You will be asked to enter this in the "
-"first screen after you launch the FreedomBox web interface. In case you lose "
-"it, you can retrieve it by running the following command:"
-msgstr ""
-"Por favor, anote o segredo acima. Você deverá informá-lo na primeira tela "
-"depois de iniciar a interface web do FreedomBox. Caso você o perca, você "
-"poderá recuperá-lo executando o seguinte comando:"

debian/po/ru.po

@@ -1,38 +0,0 @@
-# Russian translation of plinth debconf template.
-# Copyright (C) 2019 FreedomBox packaging team <freedombox-pkg-team@lists.alioth.debian.org>
-# This file is distributed under the same license as the plinth package.
-# Lev Lamberov <dogsleg@debian.org>, 2020.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: plinth\n"
-"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
-"POT-Creation-Date: 2019-11-18 18:11-0500\n"
-"PO-Revision-Date: 2020-02-10 10:17+0500\n"
-"Last-Translator: Lev Lamberov <dogsleg@debian.org>\n"
-"Language-Team: Debian L10n Russian <debian-l10n-russian@lists.debian.org>\n"
-"Language: ru\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"X-Generator: Poedit 2.2.4\n"
-"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n"
-"%10<=4 && (n%100<12 || n%100>14) ? 1 : 2);\n"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-msgid "FreedomBox first wizard secret - ${secret}"
-msgstr "Секретная строка мастера настройки FreedomBox - ${secret}"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-msgid ""
-"Please note down the above secret. You will be asked to enter this in the "
-"first screen after you launch the FreedomBox web interface. In case you lose "
-"it, you can retrieve it by running the following command:"
-msgstr ""
-"Запишите эту секретную строку. Вам будет необходимо ввести её на самом "
-"первом экране после запуска веб-интерфейса FreedomBox. Если вы потеряете эту "
-"строку, то вы сможете получить её, выполнив следующую команду:"

debian/po/sq.po

@@ -1,37 +0,0 @@
-# SOME DESCRIPTIVE TITLE.
-# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the plinth package.
-# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: plinth\n"
-"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
-"POT-Creation-Date: 2019-11-18 18:11-0500\n"
-"PO-Revision-Date: 2021-04-14 11:43+0300\n"
-"Language-Team: \n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"X-Generator: Poedit 2.4.2\n"
-"Last-Translator: Besnik Bleta <besnik@programeshqip.org>\n"
-"Plural-Forms: nplurals=2; plural=(n != 1);\n"
-"Language: sq\n"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-msgid "FreedomBox first wizard secret - ${secret}"
-msgstr "E fshehtë për skenën e parë të ndihmësit FreedomBox - ${secret}"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-msgid ""
-"Please note down the above secret. You will be asked to enter this in the "
-"first screen after you launch the FreedomBox web interface. In case you lose "
-"it, you can retrieve it by running the following command:"
-msgstr ""
-"Ju lutemi, mbajeni shënim të fshehtën më sipër. Do t’ju kërkohet ta jepni "
-"këtë në skenën e parë pasi të vini në punë ndërfaqen web të FreedomBox-it. "
-"Po e humbët, mund ta rimerrni duke xhiruar urdhrin vijues:"

debian/po/sv.po

@@ -1,35 +0,0 @@
-# Translation of freedombox 23.13 debconf to Swedish.
-# Copyright (C) 2011-2023 FreedomBox Authors
-# This file is distributed under the same license as the freedombox package.
-# Peter Kvillegård <quat@sdfeu.org>, 2023
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: freedombox 23.13\n"
-"Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2023-07-21 16:31+0000\n"
-"PO-Revision-Date: 2023-07-22 15:55+0200\n"
-"Last-Translator: Peter Kvillegård <quat@sdfeu.org>\n"
-"Language-Team: Swedish <debian-l10n-swedish@lists.debian.org>\n"
-"Language: sv\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-
-#. Type: note
-#. Description
-#: ../freedombox.templates:1001
-msgid "FreedomBox first wizard secret - ${secret}"
-msgstr "Hemlighet för FreedomBox första guidade installerare - ${secret}"
-
-#. Type: note
-#. Description
-#: ../freedombox.templates:1001
-msgid ""
-"Please note down the above secret. You will be asked to enter this in the "
-"first screen after you launch the FreedomBox web interface. In case you lose "
-"it, you can retrieve it by running the following command:"
-msgstr ""
-"Skriv ner ovanstående hemlighet. Du kommer att bli ombedd att ange den i "
-"den första skärmen efter att du startat FreedomBox webbgränssnitt. Om du "
-"tappar bort den kan den hämtas igen genom att köra följande kommando:"

debian/po/templates.pot

@@ -1,33 +0,0 @@
-# SOME DESCRIPTIVE TITLE.
-# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the plinth package.
-# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
-#
-#, fuzzy
-msgid ""
-msgstr ""
-"Project-Id-Version: plinth\n"
-"Report-Msgid-Bugs-To: plinth@packages.debian.org\n"
-"POT-Creation-Date: 2019-11-18 18:11-0500\n"
-"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
-"Language-Team: LANGUAGE <LL@li.org>\n"
-"Language: \n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=CHARSET\n"
-"Content-Transfer-Encoding: 8bit\n"
-
-#. Type: note
-#. Description
-#: ../templates:1001
-msgid "FreedomBox first wizard secret - ${secret}"
-msgstr ""
-
-#. Type: note
-#. Description
-#: ../templates:1001
-msgid ""
-"Please note down the above secret. You will be asked to enter this in the "
-"first screen after you launch the FreedomBox web interface. In case you lose "
-"it, you can retrieve it by running the following command:"
-msgstr ""

debian/rules

@@ -1,5 +1,7 @@
 #!/usr/bin/make -f
 
+include /usr/share/dpkg/pkg-info.mk
+
 export DH_VERBOSE=1
 export PYBUILD_DESTDIR=debian/tmp
 export PYBUILD_SYSTEM=custom
@@ -9,6 +11,8 @@ export PYBUILD_INSTALL_ARGS=make PYTHON={interpreter} DESTDIR={destdir} install
 export PYBUILD_CLEAN_ARGS=make clean
 export PYBUILD_TEST_ARGS=make PYTHON={interpreter} check-tests
 
+FBX_VERSION := $(shell ./run --develop --version | awk 'NF{ print $$NF }')
+
 %:
 	dh $@ --with python3 --buildsystem=pybuild
 
@@ -19,10 +23,12 @@ override_dh_auto_install-indep:
 	# Ensure the list of dependencies is not empty.
 	test -s debian/freedombox.substvars || exit 1
 
+	# Check that FreedomBox version number is matching.
+ifneq ($(FBX_VERSION),$(DEB_VERSION))
+	>&2 echo "WARNING: FreedomBox version $(FBX_VERSION) does not match package version $(DEB_VERSION)."
+endif
+
 override_dh_installsystemd:
-	# Do not enable or start any service other than FreedomBox service. Use
-	# of --tmpdir is a hack to workaround an issue with dh_installsystemd
-	# (as of debhelper 13.5.2) that still has hardcoded search path of
-	# /lib/systemd/system for searching systemd services. See #987989 and
-	# reversion of its changes.
-	dh_installsystemd --tmpdir=debian/tmp/usr --package=freedombox plinth.service
+	# Do not enable or start any service other than FreedomBox service.
+	dh_installsystemd --package=freedombox plinth.service \
+		freedombox-privileged.socket

debian/source/lintian-overrides

@@ -5,7 +5,4 @@
 very-long-line-length-in-source-file * [doc/manual/*.raw.wiki:*]
 
 # Misc. files which can't be fixed to have short line lengths.
-very-long-line-length-in-source-file * [plinth/modules/deluge/tests/data/sample.torrent:*]
-very-long-line-length-in-source-file * [plinth/modules/transmission/tests/data/sample.torrent:*]
-very-long-line-length-in-source-file * [doc/visual_design/FreedomBox-Logo.7z:*]
 very-long-line-length-in-source-file * [COPYING.md:*]

debian/tests/access-web-interface

@@ -0,0 +1,38 @@
+#!/bin/sh
+
+set -e
+
+# Wait for FreedomBox first-boot setup to complete and the web server to
+# start listening. App setup order is not deterministic, so a fixed sleep can
+# expire before the apache app configures port 443. Poll instead of guessing.
+echo "Waiting for first-boot setup to complete..."
+
+SETUP_COMPLETE=0
+
+for _ in $(seq 1 120); do
+    if curl --fail --insecure --silent --output /tmp/fbx_status.json \
+            https://localhost/freedombox/status/; then
+
+        if grep -q '"is_first_setup_running"[[:space:]]*:[[:space:]]*false' /tmp/fbx_status.json; then
+            SETUP_COMPLETE=1
+            break
+        fi
+    fi
+    sleep 2
+done
+
+# Print final status in test log
+cat /tmp/fbx_status.json || true
+
+rm -f /tmp/fbx_status.json
+
+journalctl --unit=plinth --unit=freedombox-privileged
+
+# Access FreedomBox interface
+curl --location --cookie "" --fail --write-out "%{response_code}" --insecure \
+     --stderr - https://localhost/freedombox/
+
+if [ "$SETUP_COMPLETE" -eq 0 ]; then
+    echo "Error: first-boot setup did not complete in the allotted time." >&2
+    exit 1
+fi

debian/tests/control

@@ -14,5 +14,15 @@ Restrictions: needs-root, breaks-testbed
 # Run unit and integration tests on installed files.
 #
 Test-Command: PYTHONPATH='/usr/lib/python3/dist-packages/' py.test-3 -p no:cacheprovider --cov=plinth --cov-report=html:debci/htmlcov --cov-report=term
-Depends: e2fsprogs, git, python3-pytest, python3-pytest-cov, python3-pytest-django, python3-tomli, @
+Depends: e2fsprogs, git, python3-pytest, python3-pytest-cov, python3-pytest-django, @
 Restrictions: breaks-testbed
+
+#
+# Try to access the FreedomBox web interface.
+#
+# iptables package installs alternatives files, with iptables-nft as default alternative.
+# Without it, firewalld has this error: INVALID_IPV: 'ipv4' is not a valid backend or is unavailable
+#
+Tests: access-web-interface
+Depends: iptables, @
+Restrictions: needs-root, isolation-machine, breaks-testbed

doc/Makefile

@@ -13,7 +13,7 @@ SCRIPTS_DIR=scripts
 
 manual-pdfs=$(foreach lang,$(MANUAL_LANGUAGES),manual/$(lang)/freedombox-manual.pdf)
 manual-xmls=$(patsubst %.pdf,%.xml,$(manual-pdfs))
-OUTPUTS=$(manual-pdfs) plinth.1
+OUTPUTS=$(manual-pdfs) plinth.1 freedombox-cmd.1
 
 INSTALL_OPTS=-D --mode=644
 
@@ -109,20 +109,25 @@ manual-pages-xml:=$(patsubst %.raw.wiki, %.xml, $(manual-pages-raw-wiki))
 manual-pages: $(manual-pages-part-html)
 
 $(manual-pdfs): %.pdf: %.xml
-	xmlto $(XMLTO_DEBUG_FLAGS) --with-dblatex pdf -o $(dir $@) $<
+	@echo "[PDF]       $<"
+	@xmlto $(XMLTO_DEBUG_FLAGS) --with-dblatex pdf -o $(dir $@) $< 2> /dev/null
 
 $(manual-pages-part-html): %.part.html: %.xml
-	xsltproc /usr/share/xml/docbook/stylesheet/docbook-xsl/xhtml5/docbook.xsl $< | \
+	@echo "[XSLT]      $<"
+	@xsltproc /usr/share/xml/docbook/stylesheet/docbook-xsl/xhtml5/docbook.xsl $< 2> /dev/null | \
 	perl -pe 'BEGIN {undef $$/} s/.*<body[^>]*>(.*)<\/body\s*>.*/$$1/si' > $@
-	@rm -f $(dir $@)docbook.css
+	@rm -f docbook.css
 
 $(manual-xmls) $(manual-pages-xml): %.xml: %.raw.wiki $(SCRIPTS_DIR)/wikiparser.py
-	$(SCRIPTS_DIR)/wikiparser.py $< | xmllint --format - > $@
+	@echo "[WIKIPARSE] $<"
+	@$(SCRIPTS_DIR)/wikiparser.py $< | xmllint --format - > $@
 
 %.1: %.xml
-	xmlto man $<
+	@echo "[MAN]       $<"
+	@xmlto man $< 2> /dev/null
 
 .PHONY: clean
 clean:
-	rm -f $(manual-pages-part-html) $(manual-pages-xml) $(manual-xmls)
-	rm -f $(OUTPUTS)
+	@echo "[RM]        {part-htmls} {xmls} {manuals} {outputs}"
+	@rm -f $(manual-pages-part-html) $(manual-pages-xml) $(manual-xmls)
+	@rm -f $(OUTPUTS)

doc/dev/README.rst

@@ -19,6 +19,7 @@ Install the following Debian packages:
 
 * python3-sphinx
 * python3-sphinx-autobuild
+* python3-sphinx-book-theme
 * python3-django
 * python3-django-axes
 * python3-django-captcha

doc/dev/_templates/layout.html

@@ -1,15 +0,0 @@
-{%- extends "alabaster/layout.html" %}
-
-{%- block footer %}
-  <div class="footer">
-    {% if show_copyright %}&copy;{{ copyright }} | {% endif %}
-    Licensed under the <a href="https://creativecommons.org/licenses/by-sa/4.0/">
-    CC BY-SA 4.0</a> license
-    {%- if show_source and has_source and sourcename %}
-      {% if show_copyright or theme_show_powered_by %}|{% endif %}
-      <a href="{{ pathto('_sources/' + sourcename, true)|e }}"
-         rel="nofollow">{{ _('Page source') }}</a>
-    {%- endif %}
-  </div>
-
-{% endblock %}

doc/dev/conf.py

@@ -15,6 +15,7 @@ list see the documentation: http://www.sphinx-doc.org/en/master/config
 #
 import os
 import sys
+from datetime import datetime
 
 import django
 
@@ -26,7 +27,7 @@ django.setup()
 
 # pylint: disable=invalid-name
 project = 'FreedomBox'
-copyright = '2021-2024, FreedomBox Authors'
+copyright = f'2021-{datetime.now().year}'
 author = 'FreedomBox Authors'
 
 # The short X.Y version
@@ -82,15 +83,23 @@ pygments_style = None
 # The theme to use for HTML and HTML Help pages.  See the documentation for
 # a list of builtin themes.
 #
-html_theme = 'alabaster'
+html_theme = 'sphinx_book_theme'
 
 # Theme options are theme-specific and customize the look and feel of a theme
 # further.  For a list of options available for each theme, see the
 # documentation.
 #
 html_theme_options = {
-    'fixed_sidebar': True,
-    'show_related': True,
+    'home_page_in_toc': True,
+    'repository_provider': 'gitlab',
+    'repository_url': 'https://salsa.debian.org/freedombox-team/freedombox/',
+    'use_edit_page_button': True,
+    'use_source_button': True,
+    'use_repository_button': True,
+    'use_issues_button': True,
+    'path_to_docs': 'doc/dev/',
+    'extra_footer': 'Licensed under the <a href="https://creativecommons.org/'
+                    'licenses/by-sa/4.0/">CC BY-SA 4.0</a> license.',
 }
 
 # Add any paths that contain custom static files (such as style sheets) here,
@@ -221,3 +230,4 @@ autodoc_mock_imports = [
 ]
 
 html_favicon = './_static/favicon.ico'
+html_logo = './_static/logo.svg'

doc/dev/reference/components/container.rst

@@ -0,0 +1,7 @@
+.. SPDX-License-Identifier: CC-BY-SA-4.0
+
+Container
+^^^^^^^^^
+
+.. autoclass:: plinth.container.Container
+   :members:

doc/dev/reference/components/index.rst

@@ -22,6 +22,7 @@ Components
    staticfiles
    backups
    coturn
+   container
 
 Base Classes
 ^^^^^^^^^^^^

doc/dev/reference/components/webserver.rst

@@ -6,5 +6,5 @@ Webserver
 .. autoclass:: plinth.modules.apache.components.Webserver
    :members:
 
-.. autoclass:: plinth.modules.apache.components.Uwsgi
+.. autoclass:: plinth.modules.apache.components.WebserverRoot
    :members:

doc/dev/tutorial/components.rst

@@ -291,10 +291,8 @@ file ``transmission-plinth.conf``, add the following.
 
   <Location /transmission>
       ...
-      Include          includes/freedombox-single-sign-on.conf
-      <IfModule mod_auth_pubtkt.c>
-          TKTAuthToken "admin" "bit-torrent"
-      </IfModule>
+      Use AuthOpenIDConnect
+      Use RequireGroup bit-torrent
   </Location>
 
 Showing a shortcut in the front page

doc/freedombox-cmd.xml

@@ -0,0 +1,160 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN" "http://www.docbook.org/xml/4.4/docbookx.dtd">
+<!--
+# SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+<refentry>
+  <refmeta>
+    <refentrytitle><application>freedombox-cmd</application></refentrytitle>
+    <manvolnum>1</manvolnum>
+    <refmiscinfo class="manual">FreedomBox Command Line Utility</refmiscinfo>
+    <refmiscinfo class="version"> </refmiscinfo>
+  </refmeta>
+
+  <refnamediv>
+    <refname><application>freedombox-cmd</application></refname>
+    <refpurpose>
+      command line utility to perform FreedomBox operations
+    </refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <cmdsynopsis>
+      <command>freedombox-cmd</command>
+      <arg><option>-h, </option><option>--help</option></arg>
+      <arg choice="req">module</arg>
+      <arg choice="req">action</arg>
+      <arg><option>--no-args</option></arg>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+    <para>
+      FreedomBox is a community project to develop, design and promote
+      personal servers running free software for private, personal
+      communications.  It is a networking appliance designed to allow
+      interfacing with the rest of the Internet under conditions of
+      protected privacy and data security.  It hosts applications such
+      as blog, wiki, website, social network, email, web proxy and a
+      Tor relay on a device that can replace a wireless router so that
+      data stays with the users.
+    </para>
+    <para>
+      freedombox-cmd is a command line interface to some of the operations
+      performed by FreedomBox. It is typically not needed by the end users who
+      use FreedomBox's web interface. The command may be used in some cases
+      while debugging problems, especially where the web interface is not
+      accessible or when a piece of functionality that is not provided in the
+      web interface needs to be triggered.
+    </para>
+    <para>
+      The command is simply a client to the FreedomBox's privileged daemon and
+      relays user's request to it. It waits for the request to complete and
+      prints the output of the operation or an error message collected form the
+      daemon. The daemon only allows connections from an pre-allowed list of
+      user accounts. So, be sure to run the command as 'root' superuser.
+    </para>
+  </refsect1>
+
+  <refsect1>
+    <title>Options</title>
+    <variablelist>
+      <varlistentry>
+        <term><option>module</option></term>
+        <listitem>
+          <para>
+            Name of the module from which to execute an action.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term><option>action</option></term>
+        <listitem>
+          <para>
+            Name of the action to execute. It should found in the provided
+            module.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term><option>--no-args</option></term>
+        <listitem>
+          <para>
+            Don't try to read the arguments to the command on the standard
+            input. Instead, assume that the operation does not have any
+            arguments and execute the method without arguments.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term><option>--help</option></term>
+        <listitem>
+          <para>
+            Show brief help about arguments allowed for this command.
+          </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
+    <title>Examples</title>
+
+    <example>
+      <title>Re-run FreedomBox network setup</title>
+      <synopsis>$ sudo freedombox-cmd networks setup --no-args</synopsis>
+      <para>
+        When FreedomBox starts for the first time, it will setup Network Manager
+        connections suitable for the hardware found. If you wish to re-create
+        these connections at a later time, you can re-run setup for the Networks
+        app using the web interface or run this command on a terminal.
+      </para>
+    </example>
+
+    <example>
+      <title>Delete a user account from LDAP database</title>
+      <synopsis>$ echo '{"args": ["USERNAME", "AUTH_USER", "AUTH_PASSWORD"], "kwargs": {}}' | sudo freedombox-cmd users remove_user</synopsis>
+      <para>
+        USERNAME is the name of the user account that must be removed. AUTH_USER
+        is name of the user account that is authorizing this operation.
+        AUTH_PASSWORD is the password for user account that is authorizing this
+        operation. This operation may be needed if FreedomBox's sqlite3 database
+        is wiped, removing the user accounts in the database but the
+        corresponding entries from LDAP database are not removed. A new user
+        with that name can't be created until the LDAP account is also removed.
+      </para>
+    </example>
+
+    <example>
+      <title>Set the logging mode to persistent</title>
+      <synopsis>$ echo '{"args": ["persistent"], "kwargs": {}}' | sudo freedombox-cmd config set_logging_mode</synopsis>
+      <para>
+        By default, FreedomBox sets up systemd-journald to 'volatile' logging.
+        This means that logs will not be stored on the disk and will be lost
+        after a reboot. If you are tackling a problem and wish to store the logs
+        persistently, you can change the setting in the web interface or run
+        this command.
+      </para>
+    </example>
+  </refsect1>
+
+  <refsect1>
+    <title>Bugs</title>
+    <para>
+      See <ulink
+      url="https://salsa.debian.org/freedombox-team/freedombox/issues">FreedomBox
+      issue tracker</ulink> for a full list of known issues and TODO items.
+    </para>
+  </refsect1>
+
+  <refsect1>
+    <title>Author</title>
+    <para>
+      <author>
+        <firstname>FreedomBox Developers</firstname>
+        <contrib>Original author</contrib>
+      </author>
+    </para>
+  </refsect1>
+</refentry>

doc/manual/en/A20-OLinuXino-Lime2.raw.wiki

@@ -43,7 +43,7 @@ An alternative to downloading these images is to [[InstallingDebianOn/Allwinner|
 
 === Known Issues ===
 
- * Revision G2 (written on the board): The current stable Debian11/bullseye image (from 2021-08-27) '''will not start an Ethernet connection!''' This means you can not continue with the installation process at first. This can be fixed by following [[https://wiki.debian.org/InstallingDebianOn/Allwinner#Olimex_A20-OLinuXino-LIME2__rev._F_and_newer_and_Debian11.2F_bullseye_kernel | this description]] after you [[https://wiki.debian.org/FreedomBox/Download#Installation | copied the image to your SD card]]. Or you Download and use the [[https://ftp.freedombox.org/pub/freedombox/pioneer/|Pioneer Edition image]] to fix the issue. It contains a slightly [[https://salsa.debian.org/freedombox-team/u-boot/commit/2cb18893ef|modified u-boot]].
+ * Revision G2 (written on the board): The current stable Debian11/bullseye image (from 2021-08-27) '''will not start an Ethernet connection!''' This means you can not continue with the installation process at first. This can be fixed by following [[https://wiki.debian.org/InstallingDebianOn/Allwinner#Olimex_A20-OLinuXino-LIME2__rev._F_and_newer_and_Debian11.2F_bullseye_kernel | this description]] after you [[https://wiki.debian.org/FreedomBox/Download#Installation | copied the image to your SD card]]. Or you Download and use the [[https://ftp.freedombox.org/pub/freedombox/hardware/pioneer/|Pioneer Edition image]] to fix the issue. It contains a slightly [[https://salsa.debian.org/freedombox-team/u-boot/commit/2cb18893ef|modified u-boot]].
  * Revision G2 hardware has also [[DebianBug:927397|poor performance when transmitting Ethernet data in Gigabit mode]] for older FreedomBox releases. The procedure above or for rev. C fixes this.
 
  * Revision C hardware has [[DebianBug:845128|poor performance when receiving Ethernet data in Gigabit mode]]. To workaround the problem, you can switch to 100 Mbps mode instead of Gigabit mode. Login to your !FreedomBox as root (or plugin the SD card into another computer) and create the file /etc/NetworkManager/dispatcher.d/20-fix-ethernet-problem with the following contents:

doc/manual/en/APU.raw.wiki

@@ -2,7 +2,7 @@
 
 {{attachment:apu1d.jpg|PC Engines APU 1D|width=632,height=319}}
 
-[[http://www.pcengines.ch/apu1d.htm|PC Engines APU 1D]] is a single board computer with 3 Gigabit ethernet ports, a powerful AMD APU and Coreboot firmware.  !FreedomBox images built for AMD64 machines are tested to work well for it.
+[[https://www.pcengines.ch/apu.htm|PC Engines APU]] boards are single board computers with 3 Gigabit ethernet ports, a powerful AMD64 APU and Coreboot firmware.  !FreedomBox images built for AMD64 machines are tested to work well for [[http://www.pcengines.ch/apu1d.htm|APU1D]] and [[http://www.pcengines.ch/apu3b2.htm|APU3B ]] models and are expected to work also well on the other, very similar versions.
 
 '''Important:''' Read [[FreedomBox/Hardware|general advice]] about hardware before building a !FreedomBox with this single board computer.
 
@@ -21,21 +21,26 @@ Although untested, the following similar hardware is also likely to work well wi
   * [[http://www.pcengines.ch/apu2c4.htm|apu2c4]]
   * [[http://www.pcengines.ch/apu3a2.htm|apu3a2]]
   * [[http://www.pcengines.ch/apu3a4.htm|apu3a4]]
-  * [[http://www.pcengines.ch/apu3b2.htm|apu3b2]]
   * [[http://www.pcengines.ch/apu3b4.htm|apu3b4]]
 
-=== Download ===
+=== Installation ===
 
 !FreedomBox disk [[FreedomBox/Download|images]] for this hardware are available.  Follow the instructions on the [[FreedomBox/Download|download]] page to create a !FreedomBox SD card, USB disk, SSD or hard drive and boot into !FreedomBox.  Pick the image meant for all amd64 machines.
 
 An alternative to downloading these images is to [[InstallingDebianOn/Alix3d2|install Debian]] on the APU and then [[FreedomBox/Hardware/Debian|install FreedomBox]] on it.
 
+An [[https://github.com/huubsch/APU-Installation-HomeAssistant-Freedombox|installation manual]] tested on the APU3B is available on GitHub, including flashing with UEFI-BIOS
+
 === Networking ===
 
 The first network port, the left most one in the above picture, is configured by !FreedomBox to be an upstream Internet link and the remaining 2 ports are configured for local computers to connect to.
 
 === Availability ===
 
+PCEngines announced the [[https://www.pcengines.ch/eol.htm|phase-out]] of these boards in June 2023.
+
+In 2024 [[https://pcengines.github.io/|Dasharo announced the support of APU-boards]] : coreboot + SeaBIOS and coreboot+UEFI.
+
  * Price: 110 - 170 USD (depending on the board and supplier)
  * [[http://www.pcengines.ch/order.htm|PC Engines]]
  * [[http://www.pcengines.ch/order.htm|Full list of suppliers]]
@@ -43,18 +48,17 @@ The first network port, the left most one in the above picture, is configured by
 === Hardware ===
 
  * Open Hardware: No
- * CPU: [[http://www.amd.com/en-gb/products/embedded/processors/g-series|AMD G series T40E]]
- * RAM: 2 GB DDR3-1066 DRAM
- * Storage: SD card, External USB
+ * CPU: [[http://www.amd.com/en-gb/products/embedded/processors/g-series|AMD G series T40E]]; [[https://teklager.se/en/amd-gx-412tc-cpu-specification/|GX-412TC]], 1 GHz quad core (depending on model)
+ * RAM: 2 GB DDR3-1066 DRAM - 4 GB (depending on model)
+ * Storage: SD card, External USB, mSATA module
  * Architecture: amd64
  * Ethernet: 3 Gigabit Ethernet ports
- * !WiFi: None, use a [[FreedomBox/Hardware/USBWiFi|USB WiFi device]]
- * SATA: 1 m-SATA and 1 SATA
+ * WiFi: wle200nx / wle600vx / wle900vx miniPCI express wireless modules
+ * SATA: 1 mSATA-module and 1 SATA
 
 === Non-Free Status ===
 
  * Non-free blobs required: No
- * !WiFi: Not available
  * Boot firmware: [[http://www.pcengines.ch/apu1d.htm|Coreboot]]
 
 ## END_INCLUDE
@@ -62,4 +66,4 @@ The first network port, the left most one in the above picture, is configured by
 <<Include(FreedomBox/Portal)>>
 
 ----
-CategoryFreedomBox
+CategoryFreedomBox CategoryFreedomBox

doc/manual/en/Apache_userdir.raw.wiki

@@ -14,13 +14,15 @@
 
 === What is User Websites? ===
 
-User websites is a standard location for webservers to allow host users to expose static files on the filesystem as a website to the local network and/or the internet according to the network and firewall setup.
+User websites is a feature that allows any (even non-admin) user on a !FreedomBox to host their own website simply by copying files to well known location in their home directory on the !FreedomBox server. The URL for the website will look like `https://mydomain.example/~myusername/`. The website will be available on the local network and/or the internet according to the network and firewall setup. If the copied files are HTML pages, they will show up as a website. If they are other types of files such as photos or documents. A list of those files is shown and a visitor will be able to view or download them.
 
-The standard webserver in !FreedomBox is Apache and this is implemented by means of a specific Apache module.
+Apache is the web server used in !FreedomBox and this feature is implemented using an Apache module.
 
 === Screenshot ===
 
-/* Add when/if an interface is made for FreedomBox */
+{{attachment:user-websites-folder.png|User Website copied to FreedomBox using GNOME File Browser}}
+
+{{attachment:user-websites-browser.png|User Website accessed using a browser}}
 
 === Using User Websites ===
 
@@ -30,9 +32,8 @@ To serve documents, place the files in the designated directory in a !FreedomBox
 
 This directory is: '''public_html'''
 
-Thus the absolute path for the directory of a user named fbx with home directory in /home/fbx will be '''/home/fbx/public_html'''.
-User websites will serve documents placed in this directory when requests for documents with the URI path "~fbx" are received. For the the `example.org` domain thus a request for the document `example.org/~fbx/index.html` will transfer the file in `/home/fbx/public_html/index.html`.
-
+Thus, the absolute path for the directory of a user named ''fbx'' with home directory in ''/home/fbx'' will be '''/home/fbx/public_html'''.
+The User Websites feature will serve documents placed in this directory when requests for documents with the URI path ''~fbx'' are received. For example, if  `mydomain.example` is your domain then a request for the URL `https://mydomain.example/~fbx/photo.jpg` will display the file in `/home/fbx/public_html/photo.jpg`. If a file named ''index.html'' is placed in the directory, it will shown when no file name is provided in the URL. So, the URL `https://mydomain.example/~fbx/` will show the HTML page `/home/fbx/public_html/index.html`
 
 === Creating public_html folder and uploading documents ===
 
@@ -44,7 +45,7 @@ Linux standard desktop file managers use to support remote filesystem access thr
     * Gnome's Nautilus:
       1. To lauch Nautilus you can seek its archive icon, or search ether its name or the word "file".
       1. At the bottom of the left pane you'll find an option "+ Other locations".
-      1. It leads you to a list of locations. Find "`freedombox SFTP server`" (english literal for all desktop languages). Click on it.
+      1. It leads you to a list of locations. Find "`freedombox SFTP server`" (english literal for all desktop languages). Click on it. If you don't find this, you can instead type `sftp://username@freedombox.local` in the address bar.
       1. The first time you'll be asked for your user and password. Enter your !FreedomBox user and its password. The dialog will also offer you some options to remember it for some time.
     * Plasma file manager AKA Dolphin:
       1. Click on the location bar at the top of the window.

doc/manual/en/Cubieboard2.raw.wiki

@@ -37,4 +37,4 @@ The Cubieboard 2 is a single board computer based on the Allwinner A20 processor
 CategoryFreedomBox
 
 
-Cubieboard 2 image is licensed under a Creative Commons Attribution-!ShareAlike 2.0 Generic License by [[https://www.flickr.com/photos/120586634@N05/14673300334/in/photolist-pMbdDm-omCuYN-o5kVMu-dy9jTD-dy99Kz|Flickr]].
+Cubieboard 2 image is licensed under the [[https://creativecommons.org/licenses/by-sa/2.0/|Creative Commons Attribution-Share Alike 2.0 Generic license]] by [[https://commons.wikimedia.org/wiki/File:Cubieboard_2_-_Top_(14673300334).jpg|Gareth Halfacree]].

doc/manual/en/Customization.raw.wiki

@@ -33,9 +33,9 @@ e.g. A university using !MediaWiki running on !FreedomBox as a course wiki wants
 
 '''Configuration:'''
 
-Create a file called `custom-shortcuts.json` in Plinth's configuration directory `/etc/plinth` and add additional shortcuts in JSON format. The file should have follow the same JSON schema as the Plinth API. You can refer to the JSON schema by visiting https://<my-freedombox-url>/plinth/api/1/shortcuts.
+!FreedomBox reads custom shortcuts you have created from various files paths on the server. A shortcuts file can be any file with `.json` extension in the following directories: `/etc/freedombox/custom-shortcuts.json.d/`, `/var/lib/freedombox/custom-shortcuts.json.d/` and `/usr/share/freedombox/custom-shortcuts.json.d/`. Or they can be a file named `custom-shortcuts.json` in these directories: `/etc/freedombox/`, `/etc/plinth/` (only for compatibility), `/var/lib/freedombox/` and `/usr/share/freedombox/`. The file should follow the same JSON schema as the !FreedomBox API. You can refer to the JSON schema by visiting `https://<my-freedombox-url>/plinth/api/1/shortcuts`.
 
-An example file adding one additional shortcut for [[https://nextcloud.com|NextCloud]].
+As an example, to add one additional shortcut for [[https://nextcloud.com|NextCloud]] app, create a file called `/etc/freedombox/custom-shortcuts.json.d/nextcloud.json` (create directories as needed).
 
 {{{#!highlight json
 {
@@ -55,9 +55,9 @@ An example file adding one additional shortcut for [[https://nextcloud.com|NextC
 }
 }}}
 
-The corresponding icons for the shortcuts listed in the above file should be placed in the directory `/var/www/plinth/custom/static/icons/`. The file names of the icons should match with those provided in `/etc/plinth/custom-shortcuts.json`.
+The corresponding icons for the shortcuts listed in the above file should be placed in the directory `/var/www/plinth/custom/static/icons/`. The file names of the icons should match with those provided in `/etc/freedombox/custom-shortcuts.json.d/nextcloud.json`.
 
-After adding an entry for !NextCloud in custom-shortcuts.json and an icon, restart Plinth by executing the command {{{ systemctl restart plinth }}} on the !FreedomBox. You can also restart the !FreedomBox from the web interface.
+After adding an entry for !NextCloud in `nextcloud.json` and an icon, restart Plinth by executing the command {{{ systemctl restart plinth }}} on the !FreedomBox. You can also restart the !FreedomBox from the web interface.
 
 After restart the Plinth home page will display an additional shortcut for !NextCloud as shown below: <<BR>>
 {{attachment:nextcloud-frontpage-shortcut.png|NextCloud custom shortcut on the Plinth home page}}

doc/manual/en/Download.raw.wiki

@@ -44,36 +44,11 @@ It is important to verify the images you have downloaded to ensure that the file
 
   * First open a terminal and import the public keys of the !FreedomBox developers who built the images:
   {{{
-$ gpg --keyserver keyserver.ubuntu.com --recv-keys BCBEBD57A11F70B23782BC5736C361440C9BC971
-$ gpg --keyserver keyserver.ubuntu.com --recv-keys 7D6ADB750F91085589484BE677C0C75E7B650808
-# This is the FreedomBox CI server's key
-$ gpg --keyserver keyserver.ubuntu.com --recv-keys 013D86D8BA32EAB4A6691BF85D4153D6FE188FC8
 # This is the new FreedomBox CI server's key
 $ gpg --keyserver keyserver.ubuntu.com --recv-keys D4B069124FCF43AA1FCD7FBC2ACFC1E15AF82D8C
 }}}
   * Next, verify the fingerprint of the public keys:
   {{{
-$ gpg --fingerprint BCBEBD57A11F70B23782BC5736C361440C9BC971
-pub   4096R/0C9BC971 2011-11-12
-      Key fingerprint = BCBE BD57 A11F 70B2 3782  BC57 36C3 6144 0C9B C971
-uid                  Sunil Mohan Adapa <sunil@medhas.org>
-sub   4096R/4C1D4B57 2011-11-12
-
-$ gpg --fingerprint 7D6ADB750F91085589484BE677C0C75E7B650808
-pub   4096R/7B650808 2015-06-07 [expires: 2020-06-05]
-      Key fingerprint = 7D6A DB75 0F91 0855 8948  4BE6 77C0 C75E 7B65 0808
-uid                  James Valleroy <jvalleroy@mailbox.org>
-uid                  James Valleroy <jvalleroy@freedombox.org>
-sub   4096R/25D22BF4 2015-06-07 [expires: 2020-06-05]
-sub   4096R/DDA11207 2015-07-03 [expires: 2020-07-01]
-sub   2048R/2A624357 2015-12-22
-
-$ gpg --fingerprint 013D86D8BA32EAB4A6691BF85D4153D6FE188FC8
-pub   rsa4096 2018-06-06 [SC]
-      013D 86D8 BA32 EAB4 A669  1BF8 5D41 53D6 FE18 8FC8
-uid           [ unknown] FreedomBox CI (Continuous Integration server) <admin@freedombox.org>
-sub   rsa4096 2018-06-06 [E]
-
 $ gpg --fingerprint D4B069124FCF43AA1FCD7FBC2ACFC1E15AF82D8C
 pub   rsa4096 2022-03-09 [SC]
       D4B0 6912 4FCF 43AA 1FCD  7FBC 2ACF C1E1 5AF8 2D8C
@@ -176,7 +151,7 @@ On MacOS (OSX) you can use programs like ''balenaetcher'' and ''rosaimagewriter'
 
 === From within FreedomBox ===
 
-!FreedomBox is made up of several software programs and you can obtain the source code to any of them. These instructions are similar to obtaining and [[https://www.debian.org/doc/manuals/maint-guide/build.en.html|building]] [[https://www.debian.org/doc/manuals/apt-howto/ch-sourcehandling.en.html|source code]] [[https://wiki.debian.org/BuildingTutorial|for Debian]] since !FreedomBox is a pure blend of Debian. Using this process you can obtain the source code to the exact version of the package you are currently using in !FreedomBox.
+!FreedomBox is made up of several software programs and you can obtain the source code to any of them. These instructions are similar to obtaining and [[https://www.debian.org/doc/manuals/maint-guide/build.en.html|building]] [[https://wiki.debian.org/Packaging/SourcePackage#How_to_Download_a_source_package|source code]] [[https://wiki.debian.org/BuildingTutorial|for Debian]] since !FreedomBox is a pure blend of Debian. Using this process you can obtain the source code to the exact version of the package you are currently using in !FreedomBox.
 
  1. To see the list of software packages installed on your !FreedomBox, run the following in a terminal:
  {{{
@@ -250,6 +225,37 @@ dd if=temp/usr/lib/u-boot/A20-OLinuXino-Lime2/u-boot-sunxi-with-spl.bin of=<lime
 
 The resulting image will have the modified u-boot in it. 
 
+=== Old Signing Keys ===
+
+Some very old disk images of !FreedomBox have been signed by different GPG keys than the one listed above. Those signatures are still valid and can be verified using the older keys.
+
+{{{
+$ gpg --keyserver keyserver.ubuntu.com --recv-keys BCBEBD57A11F70B23782BC5736C361440C9BC971
+$ gpg --keyserver keyserver.ubuntu.com --recv-keys 7D6ADB750F91085589484BE677C0C75E7B650808
+# This is the FreedomBox CI server's key
+$ gpg --keyserver keyserver.ubuntu.com --recv-keys 013D86D8BA32EAB4A6691BF85D4153D6FE188FC8
+$ gpg --fingerprint BCBEBD57A11F70B23782BC5736C361440C9BC971
+pub   4096R/0C9BC971 2011-11-12
+      Key fingerprint = BCBE BD57 A11F 70B2 3782  BC57 36C3 6144 0C9B C971
+uid                  Sunil Mohan Adapa <sunil@medhas.org>
+sub   4096R/4C1D4B57 2011-11-12
+
+$ gpg --fingerprint 7D6ADB750F91085589484BE677C0C75E7B650808
+pub   4096R/7B650808 2015-06-07 [expires: 2020-06-05]
+      Key fingerprint = 7D6A DB75 0F91 0855 8948  4BE6 77C0 C75E 7B65 0808
+uid                  James Valleroy <jvalleroy@mailbox.org>
+uid                  James Valleroy <jvalleroy@freedombox.org>
+sub   4096R/25D22BF4 2015-06-07 [expires: 2020-06-05]
+sub   4096R/DDA11207 2015-07-03 [expires: 2020-07-01]
+sub   2048R/2A624357 2015-12-22
+
+$ gpg --fingerprint 013D86D8BA32EAB4A6691BF85D4153D6FE188FC8
+pub   rsa4096 2018-06-06 [SC]
+      013D 86D8 BA32 EAB4 A669  1BF8 5D41 53D6 FE18 8FC8
+uid           [ unknown] FreedomBox CI (Continuous Integration server) <admin@freedombox.org>
+sub   rsa4096 2018-06-06 [E]
+}}}
+
 ## END_INCLUDE
 
 <<Include(FreedomBox/Portal)>>

doc/manual/en/DynamicDNS.raw.wiki

@@ -16,6 +16,12 @@ Dynamic DNS service providers assist in working around a problem.  First they pr
 
 For this to work, every time you connect to the Internet, you will have to tell your Dynamic DNS provider what your current IP address is.  Hence you need special software on your server to perform this operation. The Dynamic DNS function in !FreedomBox will allow users without a static public IP address to push the current public IP address to a Dynamic DNS Server.  This allows you to expose services on !FreedomBox, such as ownCloud, to the Internet.
 
+=== A Free Domain for your FreedomBox ===
+
+You can get a free domain name for your !FreedomBox using the free Dynamic DNS service provided by the !FreedomBox community at https://ddns.freedombox.org . With this service, your domain name will look like ''myaccount.fbx.one'' or ''myaccount.freedombox.rocks'' where ''myaccount'' is the account you created on the service.
+
+The service also provides you with free unlimited number of subdomains. For this, login to the account, go to ''Change Settings'', check the option ''Wild Card'', and click ''Save Changes''. After this you can add any number of subdomains like ''foo.myaccount.fbx.one'' to your !FreedomBox in ''System -> Names -> Add Domain (regular)''. TLS certificates (for HTTPS) will be automatically obtained by !FreedomBox using Let's Encrypt for these subdomains. Subdomains are especially useful for applications that require being hosted on a separate domain, such as [[FreedomBox/Manual/HomeAssistant|Home Assistant]].
+
 === GnuDIP vs. Update URL ===
 
 There are two main mechanism to notify the Dynamic DNS server of your new IP address; using the ''GnuDIP'' protocol and using the ''Update URL'' mechanism.
@@ -27,7 +33,6 @@ On the other hand, the GnuDIP protocol will only transport a salted MD5 value of
 === Using the GnuDIP protocol ===
 
  1. Register an account with any Dynamic DNS service provider.  A free service provided by the !FreedomBox community is available at https://ddns.freedombox.org .
-
  1. In !FreedomBox UI, enable the Dynamic DNS Service.
 
  1. Select ''GnuDIP'' as ''Service type'', enter your Dynamic DNS service provider address (for example, ddns.freedombox.org) into ''GnuDIP Server Address'' field.

doc/manual/en/ExposeLocalService.raw.wiki

@@ -0,0 +1,158 @@
+#language en
+
+##TAG:TRANSLATION-HEADER-START
+~- [[FreedomBox/Guide/ExposeLocalService|English]] - [[es/FreedomBox/Guide/ExposeLocalService|Español]] - [[DebianWiki/EditorGuide#translation|(+)]] -~
+##TAG:TRANSLATION-HEADER-END
+
+<<TableOfContents>>
+
+## BEGIN_INCLUDE
+
+== Expose a Local Service to Internet using FreedomBox ==
+
+This guide describes to expose a local service you have on your LAN to the internet using a !FreedomBox that is already exposed on the internet.
+
+=== Goal ===
+
+ * ''You have a !FreedomBox running'' with a working domain already setup. You are able to access your !FreedomBox using a URL such as `https://www.mysite.example/` .
+ * ''You have a different server running a local service'' on LAN that you wish to expose to the Internet on the same domain as your !FreedomBox. The local service must be a web service using the HTTP protocol (it is also possible to setup non-HTTP service, but that is a different approach). Optionally, you can have special domain assigned specifically for this local service.
+ * You wish for ''!FreedomBox to handle the TLS certificates'' for this domain as !FreedomBox typically does. Your local service need not setup and manage TLS certificates.
+ * Optionally, you may want to ''limit access to local service using !FreedomBox credentials''. Only users with a !FreedomBox account (and belonging to a chosen group) will be able to access this service. The local service will not be available to general public on the Internet. This way you can host local services that don’t implement their own authentication or local services with their own authentication mechanisms disabled.
+
+=== Exposing Local LAN servers ===
+
+ * To expose the service, create an Apache configuration file in `/etc/apache2/conf-available/` and write a `ProxyPass` directive. Assuming your local service is running on a computer with IP address `192.168.0.20` on port `3000`, you can do this by running a command (as a root user on the terminal):
+
+ {{{#!highlight bash
+cat > /etc/apache2/conf-available/my-local-service.conf <<EOL
+ProxyPass /myservice http://192.168.0.20:3000/
+EOL
+}}}
+
+ * Then, enable this Apache configuration. Run the following command:
+ {{{#!highlight bash
+a2enconf my-local-service
+}}}
+ * Then reload Apache web server.
+ {{{#!highlight bash
+systemctl reload apache2
+}}}
+
+You can now access your local service at the following URL `https://www.mysite.example/myservice/` . Note that the URL is a secure URL with `https://`. The certificates will be managed by FreedomBox/Let’s Encrypt. All your other apps and services work as usual. You can add any number services you want this way.
+
+=== Running the Service on FreedomBox Itself ===
+
+The above approach will also work if the local service is running on !FreedomBox itself. In this case, the `ProxyPass` directive in the configuration should be modified to look like `ProxyPass /myservice http://127.0.0.1:3000/`.
+
+=== Disabling the service ===
+
+To disable exposing the local service:
+
+ 1. Disable the Apache configuration file.
+ {{{#!highlight bash
+a2disconf my-local-service
+}}}
+ 1. Then, reload Apache web server.
+ {{{#!highlight bash
+systemctl reload apache2
+}}}
+
+=== Adding Authentication ===
+
+You can configure the service to be available to only users with !FreedomBox account. This is a good choice if:
+
+ * The local service that is exposed to the Internet should not be available to everyone. And,
+ * The local service does not provide its own authentication mechanism. Or,
+ * The local service provides it’s own authentication but you don’t want to maintain a different set of user accounts for that service and want to reuse your !FreedomBox user accounts.
+
+ 1. Update the Apache configuration file `/etc/apache2/conf-available/my-local-service.conf` to look like the following.
+ {{{#!highlight apache
+<Location /myservice/>
+    Include includes/freedombox-single-sign-on.conf
+
+    ProxyPass http://192.168.0.20:3000/
+</Location>
+}}}
+ 1. Then, reload Apache web server.
+ {{{#!highlight bash
+systemctl reload apache2
+}}}
+
+If you wish for only some groups of users to be able to access the service, another change to the configuration is needed. Make the configuration look like the following if you wish to allow users of “web-search” group and also users of “admin” group to access the local service. All other users even if they have a valid !FreedomBox account will be denied access.
+
+{{{#!highlight apache
+<Location /myservice/>
+    Include includes/freedombox-single-sign-on.conf
+
+    <IfModule mod_auth_pubtkt.c>
+        TKTAuthToken "web-search" "admin"
+    </IfModule>
+
+    ProxyPass http://192.168.0.20:3000/
+</Location>
+}}}
+
+=== Hosting the Service on a Separate Domain ===
+
+Some services and web applications hosted under a URL fragment such as `/myservice/` do not work well. They require an entire domain or subdomain to be dedicated to them. In these cases too, !FreedomBox can expose local services.
+
+ 1. First acquire a domain or a subdomain.
+  * If your domain is a custom domain that you own, go to the DNS settings on your domain name provider and add a subdomain. You can create a CNAME record that simply points to the main domain.
+  * If you are using !FreedomBox Dynamic DNS service, then login into https://ddns.freedombox.org and enable the “Wildcard” option. With this change, for a domain (such as `example.fbx.one`), all subdomains (such as `myservice.example.fbx.one`) of your domain will point to your main domain. 
+ 1. Add the new domain into !FreedomBox. Goto System → Name Services → Domain (regular) → Add. For example, add `myservice.mysite.example`.
+ 1. Then create an Apache configuration file at `/etc/apache2/includes/<domainname>-include.conf`. For our example this is: `/etc/apache2/includes/myservice.mysite.example-include.conf`. The contents of the file should be:
+ {{{#!highlight apache
+ProxyPass / http://192.168.0.20:3000/
+}}}
+ 1. Modify the above file for authentication if necessary by adding the `Include` and `<IfModule>` configuration directives as shown in the authentication section above.
+
+=== Troubleshooting ===
+
+When your setup does not work as expected, to debug, run a temporary web service on your !FreedomBox.
+
+ 1. Create a temporary directory with an index.html page on the !FreedomBox.
+ {{{#!highlight bash
+mkdir temp
+cd temp
+cat > index.html <<EOL
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>My test page</title>
+  </head>
+  <body>
+    <h1>Hello, World!</h1>
+  </body>
+</html>
+EOL
+}}}
+ 1. Run a temporary web server (press Control-C to terminate):
+ {{{#!highlight bash
+python3 -m http.server 3000
+}}}
+ 1. Update the Apache configuration to point to this temporary service on !FreedomBox.
+ {{{#!highlight apache
+ProxyPass /myservice http://127.0.0.1:3000/
+}}}
+
+=== Extras ===
+
+There are many additional features that Apache can provide to improve the local service. For these, [[https://httpd.apache.org/docs/current/|explore Apache documentation]]. Some features include:
+
+ * Serving static files such as JS, CSS, and media files from local directory without invoking the local service to improve performance.
+ * Caching the responses from the local service to improve performance.
+ * Setting additional headers for security, cache control, etc.
+ * Modify the HTTP header responses from the service when it does not work well to hosting under a URL fragment such as `/myservice/`.
+ * Perform redirects from `http://` URL to `https://` and setting HSTS header.
+ * Load balancing among multiple local services for high availability, scaling, etc.
+ * And more.
+
+
+## END_INCLUDE
+
+Back to [[FreedomBox/Features|Features introduction]] or [[FreedomBox/Manual|manual]] pages.
+
+<<Include(FreedomBox/Portal)>>
+
+----
+CategoryFreedomBox

doc/manual/en/FeatherWiki.raw.wiki

@@ -72,6 +72,7 @@ You might want to configure your wiki with different [[https://feather.wiki/?pag
 === External links ===
 
  * Website: https://feather.wiki
+ * Source code for Feather Wiki: https://codeberg.org/Alamantus/FeatherWiki
 
 ## END_INCLUDE
 

doc/manual/en/Hardware.raw.wiki

@@ -12,7 +12,17 @@ In addition to supporting various single board computers and other devices, any
 
 == Recommended Hardware ==
 
-On April 22nd, 2019, the !FreedomBox Foundation announced the [[https://freedomboxfoundation.org/buy/|sales]] of the Pioneer Edition !FreedomBox Home Server Kits. This is the recommended pre-installed hardware for all users who don't wish to build their own !FreedomBox by choosing the right components, downloading the image and preparing an SD card with !FreedomBox.
+=== Libre Crafts FreedomBox ===
+
+Libre Crafts in an endeavor from the !FreedomBox developers themselves to bring you a powerful !FreedomBox device capable of hosting even the most demanding home server needs. The device is crafted, tested, and delivered to you by !FreedomBox developers. Your purchase helps !FreedomBox development.
+
+This hardware features a powerful CPU, plenty of main memory, a fast OS disk, ability to add two high capacity hard disk drives, dual multi-gigabit Ethernet ports, all with a low power consumption. Use it to host all your photos, to backup all home devices, as a NAS, as home automation hub, as a desktop computer, and more all at once. 
+
+||<style="text-align: center;"> [[FreedomBox/Hardware/LibreCrafts|{{attachment:libre-crafts.png|Libre Crafts FreedomBox|height=300}}]]<<BR>> [[FreedomBox/Hardware/LibreCrafts|Libre Crafts FreedomBox]] ||
+
+=== Olimex's FreedomBox Pioneer Edition ===
+
+On April 22nd, 2019, the !FreedomBox Foundation announced the [[https://freedomboxfoundation.org/buy/|sales]] of the Pioneer Edition !FreedomBox Home Server Kits. This pre-installed hardware is for all users who don't wish to build their own !FreedomBox by choosing the right components, downloading the image and preparing an SD card with !FreedomBox.
 
 The kit includes all the hardware needed for launching a !FreedomBox home server on an Olimex A20-OLinuXino-LIME2 board. This product provides the perfect combination of open source hardware and free and open source software. By purchasing this product, you also support the !FreedomBox Foundation's efforts to create and promote its free and open source server software.
 

doc/manual/en/HomeAssistant.raw.wiki

@@ -0,0 +1,78 @@
+#language en
+
+##TAG:TRANSLATION-HEADER-START
+~- [[FreedomBox/Manual/HomeAssistant|English]] - [[es/FreedomBox/Manual/HomeAssistant|Español]] - [[DebianWiki/EditorGuide#translation|(+)]]-~
+##TAG:TRANSLATION-HEADER-END
+
+<<TableOfContents()>>
+
+## BEGIN_INCLUDE
+
+== Home Assistant ==
+||<tablestyle="float: right;"> {{attachment:homeassistant.png|Home Assistant icon}} ||
+
+'''Available since''': version 25.10
+
+Home Assistant is a home automation hub with emphasis on local control and privacy. It integrates with thousands of devices including smart bulbs, alarms, presence sensors, door bells, thermostats, irrigation timers, energy monitors, etc.
+
+Please note that Home Assistant is installed and run inside a container provided by the Home Assistant project. Security, quality, privacy and legal reviews are done by the upstream project and not by Debian/FreedomBox. Updates are performed following an independent cycle.
+
+Home Assistant app is considered experimental in !FreedomBox as it is fairly new to our ecosystem. You may face issues working with it or the app may undergo major breaking changes.
+
+=== Hardware ===
+
+Home Assistant can detect, configure, and use various devices on the local network. For example, if a device is connected using Wi-Fi or LAN to the same network as !FreedomBox, Home Assistant can detect, configure, and use the device. Other home automation protocols such as Thread, !ZigBee, and Z-Wave are also supported but require additional hardware to be connected to your !FreedomBox. For example, if you have a door sensor that speaks !ZigBee, you need to attach a !ZigBee USB dongle to your !FreedomBox. Home Assistant can then detect and use the door sensor on the !ZigBee network. '''Note:''' if you attach any such hardware to FreedomBox after you install the Home Assistant app, then you need to disable and re-enable the Home Assistant app before the hardware can be discovered and used by Home Assistant.
+
+Home Assistant is a comprehensive solution for your home automation needs supporting thousands of devices. You can check whether a device is supported by Home Assistant by visiting the [[https://www.home-assistant.io/integrations/|integrations]] page. Other devices which are not listed may also be supported when they are similar to supported devices. It is recommended that you purchase hardware that advertises support for Home Assistant.
+
+Many home automation devices connect to or send data to their manufacturers' servers. This can be a serious violation of your home's privacy. These devices may also stop working when their manufacturer goes bankrupt, decides to close the product line, or forces you to purchase newer models. It is strongly recommended that you purchase hardware that works locally with a home automation hub (in this case Home Assistant) without connecting to manufacturer's servers. These are listed under the categories "Local Push" or "Local Polling" in the Home Assistant's integrations page.
+
+=== Need for Subdomain ===
+
+Unlike most other apps in !FreedomBox which work on a path like `https://mydomain.example/app`, Home Assistant requires a separate dedicated subdomain such as `https://homeassistant.mydomain.example`. Before configuring the Home Assistant app, you must create a subdomain using System -> [[FreedomBox/Manual/NameServices|Name Services]]. See the documentation for Name Services to understand how you can acquire a subdomain.
+
+=== Setup ===
+
+After the app is installed, Home Assistant web interface must be setup. An administrator account is created at this time. Home Assistant maintains its own user accounts separate from user accounts created on !FreedomBox.
+
+{{attachment:homeassistant-setup-step-1.png|Setup - Step 1}}
+
+{{attachment:homeassistant-setup-step-2.png|Setup - Step 2}}
+
+{{attachment:homeassistant-setup-step-3.png|Setup - Step 3}}
+
+{{attachment:homeassistant-setup-step-4.png|Setup - Step 4}}
+
+{{attachment:homeassistant-setup-step-5.png|Setup - Step 5}}
+
+When new USB dongles are added to make Home Assistant talk to devices on networks like Thread, !ZigBee, and Z-Wave, then setup operation must be re-run on the app. This operation is available in the Extras menu drop down with gears icon in the Home Assistant app page. Setup must also be re-run when the hardware is removed. Otherwise, Home Assistant service will fail to start.
+
+=== Usage ===
+
+Home Assistant provides a fully functional web application and a mobile application. Simply login and start using:
+
+{{attachment:homeassistant-login.png|Login}}
+
+{{attachment:homeassistant-ui.png|Web UI}}
+
+
+{{attachment:homeassistant-app.png|Mobile App}}
+
+=== Advanced Manual Configuration ===
+
+If you wish to perform your own customization to Home Assistant setup, feel free to edit Home Assistant configuration files manually. Configuration, scenes, automations, scripts, secrets, database, and log files are all stored in the directory `/var/lib/home-assistant-freedombox/config` directory. You will need to disable and re-enable the app after configuration changes for them to take effect. Note that when !FreedomBox itself modifies these files, it will not preserve comments and other formatting.
+
+=== External links ===
+
+ * Website: https://www.home-assistant.io/
+ * Source code for Home Assistant: https://github.com/home-assistant/core
+ * Source code for Home Assistant container image: https://github.com/home-assistant/docker
+
+## END_INCLUDE
+
+Back to [[FreedomBox/Features|Features introduction]] or [[FreedomBox/Manual|manual]] pages.
+
+<<Include(FreedomBox/Portal)>>
+
+----
+CategoryFreedomBox

doc/manual/en/Kiwix.raw.wiki

@@ -0,0 +1,55 @@
+#language en
+##TAG:TRANSLATION-HEADER-START
+Translations ~- [[DebianWiki/EditorGuide#translation|(+)]] - [[FreedomBox/Manual/Kiwix|English]] - [[es/FreedomBox/Manual/Kiwix|Español]] -~
+##TAG:TRANSLATION-HEADER-END
+
+<<TableOfContents()>>
+
+## BEGIN_INCLUDE
+== Kiwix (Offline Wikipedia) ==
+'''Available since:''' version 23.19
+||<tablestyle="float: right;"> {{attachment:kiwix-tile.png|Kiwix icon}} ||
+
+[[https://en.wikipedia.org/wiki/Kiwix|Kiwix]] can serve archives of websites offline. It was originally created to serve an offline version of Wikipedia, the free encyclopedia.
+
+=== Use Cases ===
+
+[[https://en.wikibooks.org/wiki/FreedomBox_for_Communities|FreedomBox for Communities]] was already using Kiwix years before it was officially included as an app. Kiwix was used to serve content over community Wi-Fi networks in [[https://en.wikipedia.org/wiki/Gangadevipalli#Free_Community_WiFi|villages]] of India with unreliable or insufficient Internet access. In addition to an offline Wikipedia, Kiwix served
+ * the archive "Wikipedia for Schools" which was used by school teachers and students for homework assignments and as a teaching aid.
+ * the archive "!WikiSource (in Telugu)" which served as a digital library.
+
+Kiwix is also useful when you have reliable Internet access.
+ 1. Archival and preservation: Archives of websites can be created and preserved as ZIM files. These archives can be served using Kiwix.
+ 2. Fast access to slow websites: An offline archive can be faster to access than a website.
+ 3. Access to websites that can be temporarily unavailable. For example, the Low Tech Magazine is hosted on a solar-powered single-board computer and could go offline sometimes. There is a Kiwix archive available for it which can be hosted locally.
+
+=== Kiwix on FreedomBox ===
+
+!FreedomBox serves the Debian package called kiwix-tools which allows managing and serving content archives in ZIM file format. ZIM files can be added or removed by a !FreedomBox administrator or any user in the "kiwix" user group.
+
+Kiwix on !FreedomBox is available via web interface only. There are mobile and desktop clients for Kiwix, but they can only read local archives. They cannot pull content from Kiwix hosted on !FreedomBox.
+
+The web interface of Kiwix is available for public access by default. 
+
+=== Finding content archives ===
+
+To find content for Kiwix, go to [[https://library.kiwix.org|library.kiwix.org]]. You can download archives (called "books") using direct download or using BitTorrent. The website itself is a Kiwix installation, so you can have a preview of the content before downloading, to check that the archive is not broken.
+
+An alternative source of the same files is [[https://wiki.kiwix.org/wiki/Main_Page|wiki.kiwix.org]], a wiki with download links and more information about the Kiwix project.
+
+=== Creating content archives ===
+
+The [[https://openzim.org/|OpenZim]] project maintains tools to create ZIM files. The tool [[https://github.com/openzim/zimit|zimit]] is a complete solution that can scrape a website and create a ZIM file. You can also request a ZIM archive using the website [[https://youzim.it|youzim.it]].
+
+=== External links ===
+ * Upstream project: https://kiwix.org/
+ * Upstream documentation: https://kiwix.org/frequently-asked-questions/
+
+## END_INCLUDE
+
+Back to [[FreedomBox/Features|Features introduction]] or [[FreedomBox/Manual|manual]] pages.
+
+<<Include(FreedomBox/Portal)>>
+
+----
+CategoryFreedomBox

doc/manual/en/NameServices.raw.wiki

@@ -12,6 +12,23 @@
 
 Name Services provides an overview of ways the box can be reached from the public Internet: domain name, Tor Onion Service, and Pagekite. For each type of name, it is shown whether the HTTP, HTTPS, and SSH services are enabled or disabled for incoming connections through the given name. It also shows and allows configuring how !FreedomBox performs domain name resolutions.
 
+=== Adding Domain Name to FreedomBox ===
+
+Domain names are unique names assigned to computers and servers to identify and reach them easily without having remember their more technical (IP) addresses.
+
+Adding at least one domain name to your !FreedomBox through one of the supported methods is necessary if you wish to access various apps from outside of your home network. Even at home, adding a domain name allows you to have a TLS certificate that is essential for accessing apps securely through HTTPS. The following types of domains are supported:
+ * A regular domain that is purchased from a domain registrar. These domains looks like `mydomain.example`. These types of domains require that your !FreedomBox machine or your home network router have a public IP address provided by your ISP. All apps can be accessed using these domains.
+ * A dynamic domain that can obtained from a dynamic DNS provider. !FreedomBox foundation provides a free dynamic DNS domain for all !FreedomBox users at https://ddns.freedombox.org . These domains look like `mydomain.fbx.one` or `mydomain.freedombox.rocks`. These types of domains require that your !FreedomBox machine or your home network router have a public IP address provided by your ISP. The public IP may be changed by the ISP regularly and DNS records will be updated accordingly. All apps can be accessed using these domains. These types of domains are configured using the [[FreedomBox/Manual/DynamicDNS|Dynamic DNS]] app in !FreedomBox.
+ * A Tor Onion domain that can be obtained by setting up Tor app. These domains look like `mysitenameyx4fi3l6x2gyzmtmgxjyqyorj9qsb5r543izcwymle.onion`. These types of domains don't require a public IP address from your ISP. However, only web or SSH based services/apps work on this type of domain. Further, only users of Tor will be able to reach these domains. A regular browser will not be able to reach these services. These types of domains are configured using the [[FreedomBox/Manual/Tor|Tor]] app in !FreedomBox.
+ * A !PageKite domain that can obtained from a !PageKite service provider. This service can be purchased at https://pagekite.net . These domains look like `https://mydomain.pagekite.net`. These types of domains don't require a public IP address from your ISP. However, only web or SSH based services/apps work on this type of domain. These types of domains are configured using the [[FreedomBox/Manual/PageKite|PageKite]] app in !FreedomBox.
+
+=== Subdomains ===
+
+Subdomains are similar to domains, but reside under the a domain name. For example, for a domain `mydomain.example` a subdomain could be `myapp.mydomain.example`. Some applications such as [[FreedomBox/Manual/HomeAssistant|Home Assistant]] in !FreedomBox require you to setup and access them over a subdomain instead of a URL path. You can obtain and setup subdomains in the following ways:
+
+ * If you own a regular domain (as described above), you can login to the web console provided by your domain registrar and add a subdomain. Make the subdomain a CNAME of the original domain or assign A and AAAA records similar to the original domain. See your domain registrar's documentation for more information. After adding DNS entries for the subdomain, let !FreedomBox know that it can use the subdomain by adding it as another regular domain. TLS certificates (for HTTPS) will be automatically obtained by !FreedomBox using Let's Encrypt for these subdomains.
+ * If you have a dynamic domain name from !FreedomBox foundation, you can also get an unlimited number of free subdomains. For this, login to your account at https://ddns.freedombox.org, go to `Change Settings`, check the option `Wild Card`, and click `Save Changes`. After this you can add any number of subdomains like `foo.myaccount.fbx.one` to your !FreedomBox in `System` -> `Names` -> `Add Domain (regular)`. TLS certificates (for HTTPS) will be automatically obtained by !FreedomBox using Let's Encrypt for these subdomains. Also see [[FreedomBox/Manual/DynamicDNS|Dynamic DNS]] documentation page.
+
 === systemd-resolved ===
 
 From release 24.19, !FreedomBox uses systemd-resolved as caching DNS resolver and replaces resolvconf for managing DNS server configuration. This improves privacy and security. Newer installations will come with systemd-resolved and older machines will automatically switch after an upgrade to this new release.

doc/manual/en/Nextcloud.raw.wiki

@@ -39,7 +39,8 @@ If you are a Nextcloud user share how this is done.
  * Upstream Project: https://nextcloud.com/
  * Upstream documentation: https://nextcloud.com/support/
  * Upstream support forum: https://help.nextcloud.com/
- * The source code for the container image used by !FreedomBox: https://github.com/nextcloud/docker
+ * Source code for Nextcloud: https://download.nextcloud.com/server/releases/
+ * Source code for the container image: https://github.com/nextcloud/docker (includes links to source code for other components)
  * Debian Nextcloud wiki: https://wiki.debian.org/Nextcloud
 
 {{{#!wiki comment

doc/manual/en/OrangePiZero.raw.wiki

@@ -12,7 +12,7 @@
 
 === Availability ===
 
- * [[https://www.aliexpress.com/store/group/Allwinner-H2/1553371_516093180.html|AliExpress]]
+ * [[https://www.aliexpress.com/item/3256803323773726.html|AliExpress]]
 
 === Hardware ===
 

doc/manual/en/Passkeys.raw.wiki

@@ -0,0 +1,117 @@
+#language en
+
+##TAG:TRANSLATION-HEADER-START
+~- [[FreedomBox/Guide/Passkeys|English]] - [[es/FreedomBox/Guide/Passkeys|Español]] - [[DebianWiki/EditorGuide#translation|(+)]] -~
+##TAG:TRANSLATION-HEADER-END
+
+<<TableOfContents>>
+
+## BEGIN_INCLUDE
+
+== Use Passkeys to Improve Login Security ==
+
+{{{#!wiki tip
+Passkeys are strongly recommended over passwords.
+}}}
+
+'''Available since''': !FreedomBox 26.6
+
+!FreedomBox allows users to login to their account with passkeys. Passkeys are way to verify user's identity using digital signatures. They are a more secure alternative to passwords. Secret information is kept with the user on their phone, laptop, or a hardware token and unlocked using a PIN, fingerprint, or face ID. No secrets are stored on the server. The server knows only the public information that can be used to verify user's signatures.
+
+=== How do passkeys work? ===
+
+After the user logs into their account, one or more passkeys can be added to the account from the 'Manage Passkeys' page. At the time of adding passkeys, the passkey hardware (or authenticator), will generate a public and private key pair that is tied to the domain and user account. The private key is kept in the hardware and public key is provided to the server. The server stores the public key along with user account. Later when a user is trying to log in to their account, the server sends a long randomly generated string to the authenticator called the challenge. The hardware digitally signs the challenge using the private key and sends it to the server. The server is able to verify that the signature is made by the holder of private key by just using the public key that it has (this is a feature of public/private key pairs). Once verified, the server logs into the user account associated with that public key.
+
+During this process, the browser acts as a trusted intermediary between the passkey hardware and the server. It ensures that the user is verified by providing PIN, fingerprint, face ID, etc. It also ensures that a passkey is only used with the domain it is meant for.
+
+=== Better security ===
+
+Passkeys provide better security than passwords:
+
+ * '''Multi-factor authentication''': During registration of a passkey and during login, !FreedomBox requests that the browser verify the user. This means the user will need to unlock the authenticator device by providing a PIN, fingerprint, face ID, etc. This acts as one of the authentication factors: "something you know" or "something your are". Another authentication factor is "something that you have": the hardware that stores your passkey (such as Solokey, Nitrokey, or Yubikey) or a phone. Together, this is similar to using a password along with a second factor authentication. So, passkeys can replace two-factor authentication while being much more convenient and easier to use.
+
+ * '''No reuse''': Passkeys are never reused. For each domain a separate passkey is generated and used. Browsers ensure that passkey for a domain is never used with another domain. Unlike reused passwords, when a website or a service is compromised, adversaries can't use that to gain access to your account in different website or service. This also prevents phishing attacks were adversarial websites pretend to be legitimate ones.
+
+ * '''No secrets on the server''': The website allowing use of passkeys for login does not store any secret information. It only stores the public key part of the passkey. If this information is obtained by an adversary, they will not be able to login to the website. Only the private key stored on the authenticator device can be used to login to the website (since only a private key can create signatures needed for login process).
+
+ * '''No guessing''': The secret part of a passkey is much more impractical to guess compared to a password. There is no risk that someone will be able to guess your password and access your account. There is no risk that you might accidentally set a predictable password.
+
+ * '''Convenience''': Users don't need to remember username, email, or a secret to login to a website. They don't need to receive OTP via text or email, use TOTP app, or confirm login using a mobile app. After clicking on the 'Login with passkey' button, they unlock their authenticator using a PIN, fingerprint, or face ID. Then they physically tap on the authenticator (if necessary). The user is then logged in. There are fewer things to remember. Even the PIN for a hardware authenticator is typically easier to remember than a password. This convenience encourages users to use this mechanism, ultimately leading to better security.
+
+=== Hardware Needed for Passkeys ===
+
+{{{#!wiki tip
+'''[[https://solokeys.com/|Solokeys]]''' are recommend for passkey storage by the !FreedomBox project.
+
+ * The [[https://github.com/solokeys/solo2|firmware]] (the OS for the hardware) is free software.
+ * The [[https://github.com/solokeys/solo2-hw|hardware]] designs are free too.
+ * The Solokeys team and the !FreedomBox team collaborate.
+}}}
+
+There are many ways to get started with passkeys:
+
+ * '''Separate passkey hardware''': The recommended way to store passkeys is on a specific hardware key. In this setup, the private key part of the passkey never leaves the hardware device. They are also typically built such that it is hard for an adversary with physical access the device to extract passkey from it. Another advantage of these devices is that the hardware can be used with all your existing devices such as phones, laptops, and desktops. These devices interact with phones and desktops using USB, Bluetooth, or NFC tap. In case of NFC, the device works with proximity from the phone without additional power. When using a separate hardware, however, you must have a backup way of logging into your account in the event that you loose the hardware device. This could be an additional passkey hardware or a password. See the section on backup below.
+
+ * '''Builtin passkey hardware''': When a separate hardware device is not available, specialized hardware, such as a TPM, built into the computer is preferable. This setup will still ensure that passkeys do not leave the hardware. One disadvantage of this approach is that the passkey only works with that device and you will need register each device you use separately.
+
+ * '''Password managers''': As a last resort, one could use password managers that support passkeys and work with your browser or OS. Android, iOS, and Windows offer such password managers. Passkeys stored in password managers are typically synchronized to the cloud and a breach of that service/account could result in compromise of all your accounts. However, they work across multiple devices and you typically don't have to worry about loosing a single hardware device. 
+
+=== Naming Your Passkey ===
+
+In !FreedomBox, when a passkey is added to your account, it by default named as 'Key 1'. The next one will be named 'Key 2' and so on. However, it is good practice to name them such that you know which device they are stored on. For example, you can name them 'Key on Primary Solokey', 'Key on Android Phone', etc. If a device is lost, you can login to your account and remove that key from the list of passkeys associated with your account.
+
+=== Multiple Domains ===
+
+Each passkey is strictly tied to a domain and never used for another domain. This necessary to ensure that a malicious domain does not impersonate a legitimate domain. Hence, if your !FreedomBox is configured with multiple domains, then the browser and hardware authenticator device will treat them as separate accounts for the purpose of authentication with passkeys. This means you need to register separate passkeys for each of your domains.
+
+For example, assume your !FreedomBox has two domains configured mydomain1.fbx.one and mydomain2.example. Visit mydomain1.fbx.one, log in to your account, and add a passkey. This passkey will be tied to this domain. When you are trying to log in, the passkey will work if you are accessing mydomain1.fbx.one but it won't work when accessing mydomain2.example. To make the second domain work, you need to add a second passkey while accessing your !FreedomBox with the domain name mydomain2.example. Two passkeys are then stored in your hardware token. First one will be tied to mydomain1.fbx.one and will only be used when accessing that domain. Second one will be tied to mydomain2.example and will only be used when accessing that domain.
+
+=== Multiple User Accounts ===
+
+When you use a passkey hardware for multiple user accounts on the same !FreedomBox, separate passkeys will be created for each of the accounts. Each passkey will be assigned the username of the account it is tied to. This information is stored in the passkey as well as the server. During login, the browser will prompt to select the user account you want to log into. If only a single passkey exists for a given domain name, then the selection dialog is not shown and user will login to the account corresponding to the passkey.
+
+=== Backup for Passkey ===
+
+In case the device storing your passkey is lost, you need alternate ways to login to you account:
+
+ 1. You can register and maintain two passkeys on two separate devices. For example, your primary passkey could be on a Solokey hardware token and the second passkey could be on an Android phone or another Solokey hardware token. If one is lost, you can login with the other. This is the recommended approach.
+
+ 1. !FreedomBox continues to support passwords even after passkeys are registered.  So, if a passkey device is lost, you can login with a password.
+
+ 1. If you forget your password and if your user account is not the only administrator account on the !FreedomBox, you can ask an administrator to reset your password. After that you can register a new passkey stored on a new device.
+
+=== Supported Platforms ===
+
+Passkeys are based on WebAuthn, a standard published by World Wide Web Consortium. So, !FreedomBox's implementation is expected to work wherever passkeys work. It has been tested as follows:
+
+|| '''OS/Device''' || '''Browser''' || '''Authenticator''' || '''Result''' ||
+|| GNU/Linux || Firefox || Solokeys || Pass ||
+|| GNU/Linux || Firefox || Yubikey || Pass ||
+|| GNU/Linux || Chromium || Solokeys || Pass ||
+|| GNU/Linux || GNOME Web || - || Fail (Browser does not support Webauthn) ||
+|| Windows || Firefox || Windows Hello || Pass ||
+|| Windows || Firefox || Solokeys || Pass ||
+|| Windows || Firefox || Android Phone || Pass ||
+|| Windows || Chrome || Windows Hello || Pass ||
+|| Windows || Chrome || Solokeys || Pass ||
+|| Windows || Chrome || Android Phone || Pass ||
+|| Windows || Edge || Windows Hello || Pass ||
+|| Windows || Edge || Solokeys || Pass ||
+|| Windows || Edge || Android Phone || Pass ||
+|| Android || Firefox || Google Password Manager || Pass ||
+|| Android || Firefox || Solokeys USB || Fail (Touch is not detected after PIN entry) ||
+|| Android || Firefox || Solokeys NFC || Fail (Need to understand NFC setup) ||
+|| Android || Firefox || Another device || Untested ||
+|| Android || Chrome || Google Password Manager || Pass ||
+|| Android || Chrome || Solokeys USB || Fail (Touch is not detected after PIN entry) ||
+|| Android || Chrome || Solokeys NFC || Fail (Need to understand NFC setup) ||
+|| Android || Chrome || Another device || Untested ||
+
+## END_INCLUDE
+
+Back to [[FreedomBox/Features|Features introduction]] or [[FreedomBox/Manual|manual]] pages.
+
+<<Include(FreedomBox/Portal)>>
+
+----
+CategoryFreedomBox

doc/manual/en/PioneerEdition.raw.wiki

@@ -25,7 +25,8 @@ The [[https://www.olimex.com/Products/OLinuXino/Home-Server/Pioneer-FreedomBox-H
  * an optional storage add-on for hard disk (HDD) or solid-state drive (SSD)
 
 === Recommended Hardware ===
-This is the hardware recommended for all users who just want a turn-key !FreedomBox, and '''don't''' want to '''build''' their own one.
+
+This is a hardware recommended for all users who just want a turn-key !FreedomBox, and '''don't''' want to '''build''' their own one.
 
 (Building your own !FreedomBox means some technical stuff like choosing and buying the right components, downloading the image and preparing the SD card).
 

doc/manual/en/QuickStart.raw.wiki

@@ -15,18 +15,35 @@ The easy way is to [[https://freedomboxfoundation.org/buy/|buy]] a !FreedomBox k
 Alternatively you may choose to build it yourself, by gathering all the components:
  * A supported [[FreedomBox/Hardware|device]] (including any device that can run Debian). We will call that the !FreedomBox in the rest of this manual.
  * A power cable for your device.
- * An ethernet cable.
+ * An Ethernet cable.
  * A microSD card (or equivalent storage media for your device), prepared according to the instructions on the [[FreedomBox/Download|Download]] page.
 
 == How to get started ==
 
-  1. Plug one end of your ethernet cord into your !FreedomBox's ethernet port, and plug the other end into your router.
+  1. Plug one end of your Ethernet cord into your !FreedomBox's Ethernet port, and plug the other end into your router.
   1. Power on the !FreedomBox.
      * '''Note:''' On most single board computers, don't expect any output on a monitor connected via HDMI as the support may not exist in the kernel. See below to access and control your !FreedomBox via network.
   1. On first boot, !FreedomBox will perform its initial setup (older versions of !FreedomBox reboot after this step). This process may take several minutes on some machines. After giving it about 10 minutes, proceed to the next step.
   1. After the !FreedomBox has finished its initial setup, you can access its web interface through your web browser.
-     * If your computer is connected directly to the !FreedomBox through a second (LAN) ethernet port, you can browse to: http://freedombox/ or http://10.42.0.1/.
      * If your computer supports mDNS (GNU/Linux, Mac OSX or Windows with mDNS software installed), you can browse to: http://freedombox.local/ (or http://the-hostname-you-entered-during-install.local/)
+     * If your computer is connected to a monitor and !FreedomBox is able to display text to it, then the login prompt shows the web address. It looks like this:
+     {{{
+     Debian GNU/Linux 13 freedombox tty1
+
+     FreedomBox
+
+     To start using FreedomBox and to create an account, access using a web browser
+     one of the following URLs.
+
+     http://freedombox.local/
+     http://192.168.0.2/
+     http://[fe80::7207:12ff:fe34:5678]/
+
+     ...
+
+     freedombox login:
+     }}}
+     * If your computer is connected directly to the !FreedomBox through a second (LAN) Ethernet port, you can browse to: http://freedombox/ or http://10.42.0.1/.
      * If you know your way around the router's web interface, you can look up the IP address of the !FreedomBox there, and browse to that address.
      * If none of these methods are available, then you will need to figure out the IP address of your !FreedomBox. You can use the "nmap" program from your computer to find its IP address:
      {{{
@@ -56,8 +73,7 @@ Alternatively you may choose to build it yourself, by gathering all the componen
 
   1. On accessing !FreedomBox's web interface your browser will warn you that it communicates securely but that it regards the security certificate for doing so as invalid. This is a fact you need to accept because the certificate is auto generated on the box and therefore "self-signed" (the browser might also use words such as "untrusted", "not private", "privacy error" or "unknown issuer/authority"). Telling your browser that you are aware of this might involve pressing buttons such as "I understand the Risks", "proceed to ... (unsafe)" or "Add exception".  After installation this certificate can be changed to a normal one using the Let's Encrypt option.
 
-     . {{attachment:ui_insecure_connection.png|Self-signed certificate warning|width=600}}
-     . {{attachment:ui_add_security_exception.png|Add Security Exception|width=400}}
+     . {{attachment:ui_insecure_connection.png|Self-signed certificate warning|width=500}}
 
     If the domain name you are using already has a valid certificate from a recognised Certificate Authority, such as from Let's Encrypt, you may not be able to access the web interface. This means that the option to continue will not be offered. This might occur, for example, if you are reinstalling your !FreedomBox or are otherwise reusing a domain name that has an associated certificate.
 
@@ -74,8 +90,11 @@ Alternatively you may choose to build it yourself, by gathering all the componen
   1. The next page asks you to provide a user name and password. Fill in the form, and then click "Create Account."
      * Note: The user that you create here has ``Admin`` privileges and can also [[FreedomBox/Manual/SecureShell|log in using ssh]]. For additional security, you may want to use a separate account for administrative tasks and for your normal, daily use. You can add more users later.
      . {{attachment:ui_firstboot_account.png|Account|width=500}}
-  1. After completing the form, you will be logged in to !FreedomBox's web interface and able to access apps and configuration through the interface.
+  1. After completing the form, you will be logged in to !FreedomBox's web interface and asked if you wish to receive more frequent updates (recommended).
+     . {{attachment:ui_firstboot_feature_updates.png|Feature Updates|width=500}}
+  1. Setup is complete. Now you can examine and possibly update several key configuration items or see which apps are available.  Until you dismiss them, notifications accessible from the menu bar will remind you to review the key configuration items.  
      . {{attachment:ui_firstboot_complete.png|Complete|width=500}}
+     . {{attachment:ui_firstboot_complete_notification.png|Complete|width=500}}
 
 Now you can try [[FreedomBox/Features|any of the Apps]] that are available on !FreedomBox.
 
@@ -93,7 +112,7 @@ The front page includes shortcuts to apps that have been installed and are enabl
 
 === Apps menu ===
 
-The Apps menu can be accessed by clicking the grid icon, next to the !FreedomBox logo. This page lists all of the apps that are available for installing on !FreedomBox. Click the name of an app to visit its page, where you can install and configure it.
+The Apps menu can be accessed by clicking the grid icon, next to the !FreedomBox logo. This page lists all of the apps that are available for installing on !FreedomBox. Click the name of an app to visit its page, where you can install and configure it.  Currently installed and enabled apps are shown above the remaining available apps.
 
 {{attachment:ui_apps.png|Apps|width=600}}
 

doc/manual/en/ReleaseNotes.raw.wiki

@@ -8,6 +8,577 @@ For more technical details, see the [[https://salsa.debian.org/freedombox-team/f
 
 The following are the release notes for each !FreedomBox version.
 
+== FreedomBox 26.11.1 (2026-08-19) ==
+
+ * apache: Stop installing uwsgi by default
+ * debian: Re-arrange test steps to help with debugging
+ * locale: Update translations for Chinese (Simplified Han script), German, Turkish
+
+== FreedomBox 26.11 (2026-08-17) ==
+
+=== Highlights ===
+
+ * views: Add a separate page for adding new apps
+
+=== Other Changes ===
+
+ * debian: Remove unnecessary postinst file
+ * debian: Trim list of Uploaders
+ * dynamicdns: Allow updating both IPv4 and IPv6 records together
+ * dynamicdns: Drop old migration code shipped in bookworm
+ * firstboot: Link from next steps page to add apps page
+ * homeassistant: App is stable, remove experimental warning
+ * locale: Update translations for Chinese (Simplified Han script), Czech, Estonian, French, Italian, Turkish
+ * mypy: Add support for version 2.1
+ * pyproject: Declare support for Django 6.0
+ * settings: Drop support for Django < 4.0
+ * tests: Use class methods for class scoped fixtures
+ * views: Link to apps-add page from a tag click in app page
+
+== FreedomBox 26.10 (2026-07-28) ==
+
+ * apps: Change header title from Disabled to Available for install
+ * css: Fix sizing for icons in custom shortcuts
+ * debian/tests: make ready check more robust
+ * debian/tests: Drop redundant status check
+ * first_boot: Move first wizard secret generation to this app
+ * locale: Update translations for Chinese (Simplified Han script), French, German, Latvian, Swedish
+ * log: Set simpler syslog identifier instead of full binary path
+ * luanti: Add more detail to description
+ * ssh: Don't fail on page load when SSH host key can't be read
+ * tor, torproxy: Avoid error if defaults file missing during uninstall
+
+== FreedomBox 26.9.1 (2026-06-15) ==
+
+ * locale: Update translations for Albanian, Chinese (Simplified Han script), Czech, French, Italian, Turkish
+ * matrixsynapse: Allow installing new dependencies
+ * wireguard: Get config for both download and qr actions
+ * wireguard: Move segno import inside method
+
+== FreedomBox 26.9 (2026-06-01) ==
+
+=== Highlights ===
+
+ * wireguard: Auto-generate client keypairs
+ * wireguard: Provide download and QR code for client config
+
+=== Other Changes ===
+
+ * bepasty: Don't remove old system user and group
+ * debian: Install and use sysusers.d/tmpfiles.d config files
+ * debian: Stop deleting system user on remove/purge
+ * infinoted: Use systemd-sysusers for creating a system user account
+ * locale: Update translations for Dutch, German
+ * syncthing: Use systemd-sysusers for creating a system user account
+ * wireguard: Enable !FreedomBox to connect to a server using IPv6
+
+== FreedomBox 26.8 (2026-05-11) ==
+
+ * locale: Update translations for German, Italian
+ * api: Drop access-info API
+
+== FreedomBox 26.7.1 (2026-04-28) ==
+
+ * radicale, bepasty: Fix issue with failed diagnostic test
+ * radicale: Enable lc_username for case-insensitive auth
+ * radicale: Fix issue with parsing new configuration file
+ * radicale: tests: functional: Better checking for well-known URLs
+
+== FreedomBox 26.7 (2026-04-20) ==
+
+ * debian: tests: Add test to access interface status
+ * locale: Update translations for Albanian, Chinese (Simplified Han script), Czech, French, German, Italian, Swedish, Turkish
+
+== FreedomBox 26.6 (2026-04-06) ==
+
+=== Highlights ===
+
+ * users: Add support for logging in with passkeys
+
+=== Other Changes ===
+
+ * d/control: Add fido2 library as dependency
+ * locale: Update translations for French, German, Hindi, Italian
+ * service: Capture stdout/stderr when running as systemd unit
+ * users: Add link to guide on passkeys
+ * users: Add support for registering, editing, and deleting passkeys
+ * views: Add a decorator to handle exceptions in JSON views
+
+== FreedomBox 26.5.1 (2026-03-26) ==
+
+ * debian/control: Fix building with nocheck profile
+ * debian/copyright: Drop a removed file, correct path for another
+ * locale: Update translations for Albanian, Turkish
+ * web_server: Fix locating SVG icons on production setup
+
+== FreedomBox 26.5 (2026-03-23) ==
+
+=== Highlights ===
+
+ * action_utils: Don't restart web interface when installing an app
+ * apache: Use a Uwsgi native socket systemd unit for each app
+ * ui: Use inline SVG icons for all apps
+ * wireguard: Fix freedombox VPN IP for services
+
+=== Other Changes ===
+
+ * action_utils: Stop associated service when stopping a socket unit
+ * apache: Increase OpenID Connect RP session timeout activity
+ * apache: Minor improvement to getting the request host
+ * app: Fix build issue with Django 5.x
+ * clients: Fix formatting of package row in table
+ * clients: Fix show empty clients in Desktop section
+ * clients: Use SVG icons when showing external links
+ * container: Add option to skip install
+ * container: Fix image extension to .raw for systemd v260
+ * doc: Reduce verbosity when building documentation
+ * html: Drop trailing slash from void elements
+ * html: Drop type attribute value of text/javascript
+ * janus: Drop unused reference to font-awesome
+ * letsencrypt: Don't perform operations on apps that are not installed
+ * locale: Update translations for German, Russian, Swedish
+ * pagekite: Fix issue with adding custom services
+ * tests: functional: Drop undefined 'sso' pytest mark
+ * ui: Add rest of the icons used from fork-awesome set
+ * ui: Better placement for dropdown indicator in dropdown button
+ * ui: Drop fonts-fork-awesome as dependency
+ * ui: Rename 'plinth_extras' template tags module to 'extras'
+ * ui: Simplify SVG app icons for using them inline in HTML
+ * ui: Use inline SVG icons for buttons, messages, spinners, etc.
+ * wireguard: Add button for direct APK download
+ * wireguard: Add entries for Homebrew and RPM packages
+ * wireguard: Remove client entry for F-Droid which is not available
+ * wireguard: Update windows client link
+
+== FreedomBox 26.4.2 (2026-03-08) ==
+
+=== Highlights ===
+
+ * apache2: Disable pubtkt authentication module
+
+=== Other Changes ===
+
+ * container: Hold freedombox packages during test setup
+ * d/control: Trim deps for nocheck build profile
+ * locale: Update translations for Albanian, Chinese (Simplified Han script), Czech, Russian, Turkish
+ * Vagrantfile: Enable public network for bridged networking
+
+== FreedomBox 26.4 (2026-03-02) ==
+
+=== Highlights ===
+
+ * backups: Enable key-based SSH authentication for remote backups
+ * oidc: New app to implement OpenID Connect Provider
+ * apache: Implement protecting apps using OpenID Connect
+ * wireguard: Improve server section user experience flow
+
+=== Other Changes ===
+
+ * *: Remove some absolute file paths in SVGs
+ * *: Update URL base from /plinth to /freedombox
+ * README/HACKING: Update weblate project path to /freedombox
+ * Vagrantfile: Drop unnecessary sudo configuration for actions
+ * action_utils: Drop support for link-local IPv6 addresses
+ * action_utils: Fix issue with type checking a generator
+ * action_utils: Implement utility to change umask temporarily
+ * actions, privileged_daemon: Drop some unused global statements
+ * apache: Fix diagnosing URLs protected by OpenID Connect
+ * apache: Preserve host header when proxying to service
+ * backups: Arrange form for adding remote location
+ * backups: Avoid some repeated text in form help text
+ * backups: Copy SSH client public key to remote
+ * backups: Create .ssh folder before creating SSH key
+ * backups: Create a better comment in the generated SSH key file
+ * backups: Display SSH public key when adding remote
+ * backups: Fix issue with Javascript in add remote location form
+ * backups: Fix showing proper error for incorrect passphrase
+ * backups: Fix type checking errors
+ * backups: Generate SSH client key if needed
+ * backups: Migrate to SSH key auth when mounting
+ * backups: Minor refactoring
+ * backups: Show/hide form elements instead of disabling for simplicity
+ * backups: Simplify handling of migration to SSH keys
+ * backups: Test adding/removing remote location
+ * backups: Tweak appearance of add remote location form
+ * backups: Use SSH key instead of password
+ * backups: Use selected SSH credential for remote
+ * backups: tests: Simplify functional test using more classes
+ * bin: Add tool to change !FreedomBox password in Django database
+ * calibre: Use OpenID Connect instead of pubtkt based SSO
+ * cfg: Drop unused actions_dir option
+ * cfg: Drop unused config_dir option
+ * container: Align terminology in printed banner
+ * db: Create a utility to get credentials from dbconfig
+ * debian: Ensure that gbp creates a clean tarball prior to build
+ * deluge: Use OpenID Connect instead of pubtkt based SSO
+ * doc/dev: Set new theme for developer documentation
+ * doc/dev: Use OpenID Connect instead of pubtkt based SSO
+ * doc/dev: always have an up-to-date copyright year
+ * ejabberd: Fix setting up certificates for multiple domains
+ * email: Use OpenID Connect instead of pubtkt based SSO
+ * featherwiki: Use OpenID Connect instead of pubtkt based SSO
+ * gitweb: Fix issue with running post init due to missing method
+ * gitweb: Use OpenID Connect instead of pubtkt based SSO
+ * js: When page load fails during install, show it to user
+ * letsencrypt: When copying certificate reset the umask reliably
+ * locale/bg: Fix several translations with HTML links (Bulgarian)
+ * locale/de: Fix several translations with HTML links (German)
+ * locale: Update translations for Albanian, Catalan, Chinese (Simplified Han script), Czech, French, German, Greek, Italian, Swedish, Tamil, Turkish
+ * matrixsynapse: Update apache config to proxy Synapse client API
+ * miniflux: Get credentials from dbconfig-common directly
+ * miniflux: Revert workaround for a packaging bug with DB connection
+ * mumble: murmurd renamed to mumble-server
+ * oidc: Style the page for authorizing an OIDC app
+ * pyproject: Use new format to specify licenses
+ * quassel: Explicitly set permissions on the domain configuration file
+ * rssbridge: Use OpenID Connect instead of pubtkt based SSO
+ * searx: Use OpenID Connect instead of pubtkt based SSO
+ * sharing: Use OpenID Connect instead of pubtkt based SSO
+ * sso: Merge into users module, drop pubtkt related code
+ * syncthing: Use OpenID Connect instead of pubtkt based SSO
+ * syncthing: tests: Fix tests by allowing rapid restarts
+ * templates: Allow building pages without navigation bar and footer
+ * tests: functional: Fix expecting !FreedomBox to be home page
+ * tests: functional: Fix reloading error page during install/uninstall
+ * tests: functional: Increase systemd rate limits for starting units
+ * tiddlywiki: Use OpenID Connect instead of pubtkt based SSO
+ * transmission: Use OpenID Connect instead of pubtkt based SSO
+ * ui: Add animation for notification dismissal
+ * ui: Dismiss notifications without page reload
+ * ui: Refactor notification delete buttons to avoid repeating code
+ * web_framework: Allow !FreedomBox apps to override templates
+ * web_server: Log requests to WSGI app
+ * wireguard: Accept/use netmask with IP address for server connection
+ * wireguard: Fix format when showing multiple endpoints of the server
+ * wireguard: Fix showing default route setting in server edit form
+ * wireguard: Fix split tunneling
+ * wireguard: Show status of default route in server information page
+ * wireguard: filter .local addresses from showClient view
+ * wireguard: show server vpn ip in show client page
+ * wordpress: Use OpenID Connect instead of pubtkt based SSO when private
+
+== FreedomBox 26.3 (2026-02-02) ==
+
+=== Highlights ===
+
+ * ui: Use HTMX to eliminate full page reloads
+ * wireguard: Add 'Start Server' button to help with client setup
+
+=== Other Changes ===
+
+ * debian: Follows policy 4.7.3
+ * debian: Ignore lintian warning: service file missing Install section
+ * debian: Remove default Rules-Requires-Root
+ * debian: Remove preinst script
+ * debian: Update copyright years
+ * docs: Update container script usage
+ * lintian: Remove mismatched overrides
+ * locale: Update translations for Chinese (Simplified Han script), German, Italian, Turkish
+ * Makefile: Fix removing extra license file
+ * ui: Add HTMX as a dependency
+ * ui: Use HTMX to update notifications on partial page updates
+ * wireguard: Remove NM connections when app is uninstalled
+ * wireguard: Show next available client IP in Add Client form
+ * wireguard: Update functional tests to handle Start Server button
+ * wireguard: Show server endpoint on main app page
+
+== FreedomBox 26.2 (2026-01-20) ==
+
+ * gitweb: Fix deleting last repo disables app
+ * locale: Update translations for Estonian, Italian
+ * notifications: Close dropdown when clicking outside
+
+== FreedomBox 26.1 (2026-01-05) ==
+
+ * container: Add aliases for start/stop commands
+ * locale: Update translations for Albanian, Bulgarian, Chinese (Simplified Han script), Czech, Estonian, French, German, Italian, Russian, Turkish, Ukrainian
+
+== FreedomBox 25.17.1 (2025-12-15) ==
+
+=== Highlights ===
+
+ * backups: Set proper permissions for backups-data directory
+ * minetest: Rename Minetest to Luanti
+
+=== Other Changes ===
+
+ * locale: Update translations for Albanian, Bulgarian, Czech, Estonian, Hindi, Italian, Russian, Turkish, Ukrainian
+ * minetest: Remove legacy code, use new name, conf, etc.
+ * transmission: Deal with changes in latest forky package
+ * transmission: Remove obsolete apache redirects
+ * vagrant: Enable EFI firmware
+
+== FreedomBox 25.17 (2025-12-08) ==
+
+=== Highlights ===
+
+ * ui: Implement a toggle menu for setting dark mode
+
+=== Other Changes ===
+
+ * homeassistant: Fix spelling in tests
+ * locale: Fix python-brace-format error in Estonian
+ * locale: Update translations for Catalan, Estonian, French, Russian
+ * privileged: Don't log exception that are expected
+ * ui: Dark theme color for tags text in an app card
+ * ui: Drop colors defined in Bootstrap 5.3
+ * ui: Fix dark theme color for disabled form elements
+ * ui: Fix dark theme color for form help text
+ * ui: Fix dark theme color for select-all button
+ * ui: Fix dark theme colors for app enable/disable toggle button
+ * ui: Fix dark theme colors for default button style
+ * ui: Fix dark theme colors for running status indicator
+ * ui: Minor CSS refactor to use variables
+ * ui: Use default button style for tag buttons
+ * upgrades: Use bootstrap spinner button instead of custom styling
+
+== FreedomBox 25.16 (2025-11-24) ==
+
+=== Highlights ===
+
+ * dynamicdns: Use only IPv4 for GnuDIP protocol
+ * janus: Allow app to be installed from Debian unstable
+ * jsxc: Fix missing dependencies
+
+=== Other Changes ===
+
+ * locale: Update translations for Albanian, Chinese (Simplified Han script), Czech, German, Italian, Russian, Turkish, Ukrainian
+ * janus: Relax content security policy for the video room
+ * janus: Update the video room code from latest upstream
+ * jsxc: Update content security policy to prevent style errors
+ * middleware: Implement middleware for common headers such as CSP
+ * package: Prevent freedombox's deps from removal during app uninstall
+
+== FreedomBox 25.15 (2025-11-10) ==
+
+=== Highlights ===
+
+ * help: Fix serving images from help pages
+ * matrixsynapse: Explain federation and link to testing tool
+
+=== Other Changes ===
+
+ * locale: Update translations for French, German, Italian
+ * main: Allow setting development mode from environment
+ * matrixsynapse: Clarify how to change domain name in status section
+ * matrixsynapse: Explicitly set the trusted key server to matrix.org
+ * README: Use the Weblate's language chart widget
+ * Run service using systemd even for development
+ * ttrss: Remove app not available in Trixie
+ * views: Implement an API to retrieve the readiness status in JSON
+
+== FreedomBox 25.14 (2025-10-27) ==
+
+ * Enable private tmp and join namespaces for the two daemons
+ * locale: Update translations for French, Japanese
+
+== FreedomBox 25.13.1 (2025-10-20) ==
+
+ * locale: Update translations for Albanian, German
+
+== FreedomBox 25.13 (2025-10-06) ==
+
+=== Highlights ===
+
+ * backups: Fix robust handling of known errors
+ * debian: Stop privileged service during upgrade or removal
+ * miniflux: Fix DB connection issues during install/uninstall
+
+=== Other Changes ===
+
+ * *: Collect output for all privileged sub-processes
+ * *: Use action_utils.run instead of subprocess.call
+ * *: Use action_utils.run instead of subprocess.check_call
+ * *: Use action_utils.run instead of subprocess.check_output
+ * *: Use action_utils.run instead of subprocess.run
+ * action_utils: Handle capture_output argument in run wrapper
+ * actions: Fix lifetime of thread local storage
+ * actions: Log full exception from privileged daemon on error
+ * actions: Log method arguments in privileged daemon
+ * actions: Raise an exception if privileged server response is empty
+ * actions: Work with older privileged daemon
+ * actions_utils: Fix issue with collecting stdout/stderr
+ * backups: Don't show enable/disable button as app can't be disabled
+ * backups: Ignore a typing error with mypy
+ * ci: Switch backports test to trixie-backports
+ * config: Set home page to !FreedomBox for invalid values
+ * d/rules: Drop a workaround for dh_installsytemd needed for /usr/lib
+ * daemon: When ensuring running state handle not-installed state
+ * diagnostics: In development mode, run diagnostics more rarely
+ * doc: Add manual page for freedombox-cmd
+ * gitweb: Use Git credential helper when cloning URLs with credentials
+ * glib: Add schedule parameter for setting interval in develop mode
+ * locale: Fix a string formatting issue in Italian translation
+ * locale: Update translations for Albanian, Bulgarian, Chinese (Simplified Han script), Czech, German, Italian, Russian, Turkish, Ukrainian
+ * Makefile: Move privileged daemon to /usr/lib/freedombox
+ * privileged_daemon: Fix showing errors for freedombox-cmd command
+ * privileged_daemon: Implement handling termination signal
+ * setup: Log full exception traceback when setup fails
+ * storage: Fix disk usage checking with disconnected SSH mounts
+ * zoph: Additional dbconfig configuration keys
+
+== FreedomBox 25.12 (2025-09-22) ==
+
+=== Highlights ===
+
+ * views: Add a menu entry and view for showing logs of an app
+ * zoph: Fix cases when CLI user is set to "autodetect"
+
+=== Other Changes ===
+
+ * api: Fix showing icons for custom shortcuts
+ * app: Add ability to retrieve logs from all systemd units of an app
+ * bepasty: tests: Fix functional test failure to missing / in URL
+ * bepasty: tests: Override backup/restore test properly
+ * ci: Don't include defunct extract-source job
+ * ci: Update container for functional tests from bookworm to trixie
+ * ci: functional: Provision the privileged daemon properly
+ * diagnostics, help: Link to diagnostics page logs in 500 error page
+ * index: Generalize showing custom shortcut icons
+ * locale: Update translations for Chinese (Simplified Han script), Czech, Dutch, German, Italian, Russian, Turkish, Ukrainian
+ * torproxy: When disabling apt over tor fails, report error properly
+ * upgrades: Multiple fixes for parsing Apt's Deb822 style sources
+ * upgrades: Overwrite apt sources lens with bug fixes
+ * views: Fix 'internal server error' when showing 404 page
+
+== FreedomBox 25.11 (2025-09-08) ==
+
+=== Highlights ===
+
+ * email: Fix Thunderbird auto configuration failure
+ * matrixsynapse, upgrades: Install select packages from unstable
+
+=== Other Changes ===
+
+ * action_utils: Implement a utility to run a command as different user
+ * actions, backup: Implement raw output for privileged daemon
+ * actions, backups: Fix tests depending on sudo based actions
+ * actions: Drop feature to run privileged action as another user
+ * actions: Drop sudo based privileged actions
+ * actions: Framework for capturing stdout/stderr in privileged daemon
+ * actions: Simplify raw output code in privileged methods
+ * backups: Trim translatable string
+ * container: Add support for Trixie as stable distribution
+ * container: Pass --nvram option to virsh undefine
+ * d/control: Remove libpam-abl as a recommendation
+ * diagnostics: Fix notification severity when skipping tests
+ * dynamicdns: Handle showing errors from GnuDIP
+ * gitweb: Don't use privileged action feature to run as different user
+ * gitweb: Use pathlib API more
+ * HACKING.md: Mention using virtual machines instead of containers
+ * homeassistant: Fix typo in description
+ * l10n: Fix a broken string in Russian translation
+ * l10n: Fix broken Italian translation
+ * l10n: Fix formatted strings for errors/exceptions
+ * locale: Update translations for Bulgarian, Chinese (Simplified Han script), Czech, Dutch, French, German, Italian, Russian, Turkish, Ukrainian
+ * Makefile, settings: Use full paths in pot files
+ * package: Don't consider uninstalled packages as available
+ * package: Refresh apt cache if sources list is newer
+ * power: logind config to ignore laptop lid close
+ * privileged: Don't isolate /var/tmp/ for privileged daemon
+ * privileged_daemon: Introduce a command line client for the API
+ * privileged_daemon: Log only to journal and not console
+ * samba: Update client list
+ * storage: Don't use privileged action feature to run as different user
+ * syncthing: Update Android clients to Syncthing-Fork
+ * tests: functional: Fix incorrect skipping of install tests
+ * ui: Fix missing semicolon in JS file
+ * upgrades: Don't allow needs-restart to restart privileged daemon
+ * upgrades: Overhaul detection of distribution
+ * web_server: Restart in development mode only for source code changes
+
+== FreedomBox 25.10 (2025-08-18) ==
+
+=== Highlights ===
+
+ * email: Add full text search capability
+ * homeassistant: Add the most popular app for home automation
+
+=== Other Changes ===
+
+ * *: Update copyright year
+ * action_utils: Add support for device mappings in podman containers
+ * action_utils: Allow checking result for service operations
+ * actions: Add method to handle privileged JSON request to a server
+ * actions: Allow logging privileged calls to a server differently
+ * actions: Call to a privileged server if it is available
+ * actions: Raise a proper exception if privileged module is not found
+ * actions:privileged: Fix flake8 errors
+ * apache, letsencrypt: Create a site specific config for all domains
+ * apache: Add component to host an app on a site's root
+ * apache: Allow customization to the root of a site
+ * apache: Generalize TLS config to use certificates only if available
+ * apache: Make all directory listings more mobile friendly
+ * app: Don't load apps again
+ * apps: Fix regression in enabling install button
+ * config: Allow better Apache default home page
+ * container: Add component for managing containers using podman
+ * d/control: Drop dependency on python3-setuptools-git
+ * debian, pyproject.toml: Remove ancient python3-tomli workaround
+ * debian: Print warning if version mismatch
+ * diagnostics: Add collapsible sections for results
+ * doc: Update man page with option --version
+ * dovecot: Allow login using email address with dovecot version 2.4
+ * dovecot: Fix location of Inbox in dovecot 2.4
+ * dynamicdns: Add info about subdomains with Foundation's service
+ * dynamicdns: Fix a type check error
+ * dynamicdns: Switch update client to HTTP protocol
+ * email: Increment app version number to trigger dovecot restart
+ * featherwiki: Disable caching to avoid 412 errors
+ * featherwiki: Don't allow index.html as a file name
+ * forms: Allow showing a None option during domain selection
+ * letsencrypt: Drop old app migration code
+ * locale: Update translations for Catalan, Dutch, Estonian, Tamil
+ * Makefile: Developer setup for privileged daemon
+ * matrixsynapse: Drop help text for domain selection dropdown
+ * module_loader: Don't load modules again
+ * names: Add information about adding static domains/subdomains
+ * notifications: Add datetime to each notification
+ * notifications: Fix setting last_update_time
+ * notifications: Minor styling fix for operation notifications
+ * package: Refresh apt cache if old and some packages are not found
+ * package: Uninstall packages even if they are not in apt cache
+ * plinth: Add --version flag to print version and exit
+ * privileged: Add /bin file for privileged daemon
+ * privileged: Add systemd units for socket activating the daemon
+ * privileged: Introduce a UNIX socket daemon for privileged calls
+ * pyproject: Add missing pytest marker for "tags"
+ * setup: Perform a check for app availability after the page loads
+ * sogo: Allow adding IMAP accounts and changing full name
+ * templates: Show Launch web client button for all !FreedomBox URLs
+ * tests: Ensure that privileged daemon is not used during tests
+ * tiddlywiki: Avoid "412: Precondition failed" error
+ * tiddlywiki: Don't allow index.html as a file name
+ * ui: Fix user menu popup overflowing beyond the page
+ * ui: Use system's UI fonts on all platforms instead of Lato
+ * uninstall: Use reverse order when uninstalling components
+ * views: Remove unused code related to refresh packages button
+
+== FreedomBox 25.9.4 (2025-08-02) ==
+
+ * distupgrade: Handle comments in sources.list file
+ * distupgrade: Update Trixie's release date as announced
+
+== FreedomBox 25.9.3 (2025-07-21) ==
+
+ * config: Allow overriding target path in dropin config component
+ * email: Add support for Dovecot 2.4
+ * email: Start servers during re-setup if they are not running
+ * locale: Update translations for Albanian, Bulgarian, Catalan, Estonian, Tamil
+ * sogo: Fix typo in configuration for sieve server
+
+== FreedomBox 25.9.2 (2025-06-23) ==
+
+  * debian: Set the branch for trixie
+  * debian: Update debconf Portuguese translation
+  * locale: Add new translation for Estonian
+  * locale: Update translations for Dutch, German, Hungarian
+  * performance: Handle install for trixie
+
+== FreedomBox 25.9.1 (2025-06-02) ==
+
+ * locale: Update translations for Catalan, Telugu, Ukrainian
+
 == FreedomBox 25.9 (2025-05-05) ==
 
   * locale: Add translation for Catalan

doc/manual/en/Sharing.raw.wiki

@@ -20,15 +20,13 @@ The content can be shared publicly or restricted to the users of listed allowed
 
 === Setting Up Shares ===
 
-For the users to access the content through their browser it must exist and have a share. A share is an entry in the Sharing app relating:
- * the Name (an thereby the URL) with which the users will ask for the content,
- * the Disk Path of the content to be served and
- * the sharing mode. On restricted mode, it also has the list of allowed groups.
-Many shares can coexist in the same server.
-
-Only admins can create, edit or remove shares. They'll find the Sharing app in the Apps section of !FreedomBox web interface. Sharing app is an easy to use web application with an evident interface.
-
-Each share has its own sharing mode (public or restricted) setting. Only groups recognized by !FreedomBox service can be combined in the list of allowed groups. Groups created in the CLI won't be offered by the Sharing app. 
+ * In !FreedomBox web interface, enable the Sharing App. Only admins can create, edit or remove shares. They'll find the Sharing app in the Apps section of the !FreedomBox web interface. Many shares can coexist in the same server.
+ * Add a new share
+   * Give it a name (an thereby the URL) with which the users will ask for the content. In the example above it would be called ''content_name''.
+   * The Disk Path of the content to be served. This path is relative to ''root'' on your !FreedomBox. For instance ''/var/lib/freedombox/sharing/content_name'' might be a choice.
+   * Sharing mode. On restricted mode, it also has the list of allowed groups. Only groups recognized by !FreedomBox service can be combined in the list of allowed groups. Groups created in the CLI won't be offered by the Sharing app. 
+ * Create the directory specified under ''Disk Path'' on your !FreedomBox through ''Cockpit'', ''Nautilus'' or remote login.
+ * Make sure the user, who will provide the content, has write access to that directory for instance by making him the owner of that directory. 
 
 === Providing/Updating Content ===
 

doc/manual/en/TiddlyWiki.raw.wiki

@@ -71,6 +71,7 @@ You can also have a custom image as the favicon for each !TiddlyWiki. Using a di
 
  * Website: https://tiddlywiki.com
  * Grok !TiddlyWiki (online e-book): https://groktiddlywiki.com/read/
+ * Source code for TiddlyWiki: https://github.com/TiddlyWiki/TiddlyWiki5
 
 ## END_INCLUDE
 

doc/manual/en/TinyTinyRSS.raw.wiki

@@ -11,7 +11,7 @@
 == Tiny Tiny RSS (News Feed Reader) ==
 ||<tablestyle="float: right;"> {{attachment:TinyTinyRSS-icon_en_V01.png|Tiny Tiny RSS icon}} ||
 
-'''Available since''': version 0.9
+'''Available since''': This app is no longer available since Debian Trixie. Please migrate to [[FreedomBox/Manual/Miniflux|Miniflux]] or [[FreedomBox/Manual/Nextcloud|Nextcloud News]].
 
 Tiny Tiny RSS is a news feed (RSS/Atom) reader and aggregator, designed to allow reading news from any location, while feeling as close to a real desktop application as possible.
 

doc/manual/en/Upgrades.raw.wiki

@@ -10,7 +10,7 @@
 
 !FreedomBox can automatically install security updates.  On the ''Update'' page of the ''System'' section in !FreedomBox web interface you can turn on automatic updates. This feature is enabled by default and there is no manual action necessary.  It is strongly recommended that you have this option enabled to keep your !FreedomBox secure.
 
-Updates are performed every day at night according to you local time zone. You can set the time zone with [[FreedomBox/Manual/DateTime|Date & Time]].  If you wish to shutdown !FreedomBox every day after use, keep it running at night once a week or so to let the automatic updates happen.  Alternatively, you can perform manual updates as described below.
+Updates are performed every day at night according to the time zone you have set on your machine. You can set the time zone with [[FreedomBox/Manual/DateTime|Date & Time]].  If you wish to shutdown !FreedomBox every day after use, keep it running at night once a week or so as to allow automatic updates to happen.  Alternatively, you can perform manual updates as described below.
 
 Note that once the updates start, it may take a long time to complete. During automatic update process that runs every night or during manual update process, you will not be able to install apps from !FreedomBox web interface.
 
@@ -20,29 +20,23 @@ Note that once the updates start, it may take a long time to complete. During au
 
 Although updates are done every day for security reasons, latest features of !FreedomBox will not propagate to all the users. The following information should help you understand how new features become available to users.
 
-'''Stable Users''': This category of users include users who bought the [[FreedomBox/Hardware/PioneerEdition|FreedomBox Pioneer Edition]], installed !FreedomBox on a [[FreedomBox/Hardware/Debian|Debian]] stable distribution or users who downloaded the ''stable'' images from [[https://freedombox.org|freedombox.org]]. As a general rule, only security updates to various packages are provided to these users. One exception to this rule is where !FreedomBox service itself is updated when a release gains high confidence from developers. This means that latest !FreedomBox features may become available to these users although not as quickly or frequently as ''testing'' users. If an app is available only in ''testing'' distribution but not in ''stable'' distribution, then that app will show up in the web interface but will not be installable by ''stable'' users. Some apps are also provided an exception to the rule of "security updates only" when the app is severely broken otherwise. Every two years, a major release of Debian stable happens with the latest versions of all the software packages and !FreedomBox developers will attempt to upgrade these users to the new release without requiring manual intervention. 
+'''Stable Users''': This category of users include users who bought the [[FreedomBox/Hardware/PioneerEdition|FreedomBox Pioneer Edition]], installed !FreedomBox on a [[FreedomBox/Hardware/Debian|Debian]] stable distribution or users who downloaded the ''stable'' images from [[https://freedombox.org|freedombox.org]]. If an app is available only in ''testing'' distribution but not in ''stable'' distribution, then that app will show up in the web interface but will not be installable by ''stable'' users. Every two years, a major release of Debian stable happens with the latest versions of all the software packages and !FreedomBox developers will attempt to upgrade these users to the new release without requiring manual intervention.  See the sections on upgrade to next stable release below.
+
+As a general rule, only security updates to various packages are provided to these users. One exception to this rule is when ''frequent feature updates'' (recommended) option is enabled. When this option is enabled, !FreedomBox service itself is updated when a release gains high confidence from developers. This means that latest !FreedomBox features may become available to these users (after a few days of delay compared to ''testing'' users). Some apps (currently only Matrix Synapse) are also provided as an exception to the rule of "security updates only" when the app is severely broken or unavailable otherwise. Technically, when this option is enabled, after thorough testing, a select list of packages may be installed from ''backports'' or ''unstable'' repositories of Debian. 
 
 '''Testing Users''': This category of users include users who installed !FreedomBox on a [[FreedomBox/Hardware/Debian|Debian]] ''testing'' distribution or users who downloaded the ''testing'' images from [[https://freedombox.org|freedombox.org]]. Users who use Debian ''testing'' are likely to face occasional disruption in the services and may even need manual intervention to fix the issue. As a general rule, these users receive all the latest features and security updates to all the installed packages. Every two weeks, a new version of !FreedomBox is released with all the latest features and fixes. These releases will reach ''testing'' users approximately 2-3 days after the release.
 
-'''Unstable Users''': This category of users include users who installed !FreedomBox on a [[FreedomBox/Hardware/Debian|Debian]] ''unstable'' distribution or users who downloaded the ''unstable'' images from [[https://freedombox.org|freedombox.org]]. Users who use Debian ''unstable'' are likely to face occasional disruption in the services and may even need manual intervention to fix the issue. As a general rule, these users receive all the latest features to all the installed packages. Every two weeks, a new version of !FreedomBox is released with all the latest features and fixes. Theses releases will reach ''unstable'' users on the day of the release. Only developers, testers and other contributors to the !FreedomBox project should use the ''unstable'' distribution and end users and advised against using it.
+'''Unstable Users''': This category of users include users who installed !FreedomBox on a [[FreedomBox/Hardware/Debian|Debian]] ''unstable'' distribution or users who downloaded the ''unstable'' images from [[https://freedombox.org|freedombox.org]]. Users who use Debian ''unstable'' are likely to face occasional disruption in the services and may even need manual intervention to fix the issue. As a general rule, these users receive all the latest features to all the installed packages. Every two weeks, a new version of !FreedomBox is released with all the latest features and fixes. Theses releases will reach ''unstable'' users on the day of the release. Only developers, testers and other contributors to the !FreedomBox project should use the ''unstable'' distribution. End users are advised against using it.
 
 === Manual Updates from Web Interface ===
 
-To get updates immediately and not wait until the end of the day, you may want to trigger updates manually. You can do this by pressing the ''Update now'' button in ''Manual update'' tab for ''Update'' page in ''System'' section. Note that this step is not necessary if you have enabled ''Auto-updates'' as every night this operation is performed automatically.
-
-When installing apps you may receive an error message such as 
-
-{{{
-Error installing packages: E: dpkg was interrupted, you must manually run 'dpkg --configure -a' to correct the problem
-}}}
-
-This is typically caused by shutting down !FreedomBox while it is installing apps, while performing daily updates or during some other operations. This situation can be rectified immediately by running manual update.
+To get updates immediately and not wait until the end of the day, you may want to trigger updates manually. You can do this by pressing the ''Update now'' button under ''Manual update'' heading for ''Software Update'' page in ''System'' section. Note that this step is not necessary if you have enabled ''Auto-updates'' as every night this operation is performed automatically.
 
 === Manual Updates from Terminal ===
 
-Some software packages may require manual interaction for updating due to questions related to configuration. In such cases, !FreedomBox updates itself and brings in new knowledge necessary to update the package by answering configuration questions. After updating itself, !FreedomBox acts on behalf of the user and updates the packages by answering the questions. Until !FreedomBox has a chance to update the package, such packages should not be be updated manually. The manual update triggered from the web interface is already mindful of such packages and does not update them.
+Some software packages may require manual interaction for updating due to questions related to configuration. In such cases, !FreedomBox updates itself and brings in new knowledge necessary to update the package. Then, !FreedomBox acts on behalf of the user and updates the packages by answering the questions. Until !FreedomBox has a chance to update the package, such packages should not be be updated manually from the terminal. The manual update triggered from the web interface is already mindful of such packages and does not update them.
 
-In some rare situations, !FreedomBox itself might fail to update or the update mechanism might fall into a situation that might need manual intervention from a terminal. To perform manual upgrades on the terminal, login into !FreedomBox on a terminal (if you have monitor and keyboard connected), via a web terminal (using [[FreedomBox/Manual/Cockpit]]) or using a remote secure shell (see [[FreedomBox/Manual/SecureShell|Secure Shell]] section).  Then run the following commands:
+In some rare situations, !FreedomBox itself might fail to update or the update mechanism might fall into a situation that might need manual intervention from a terminal. To perform manual upgrades on the terminal, login into !FreedomBox on a terminal (if you have monitor and keyboard connected), via a web terminal (using [[FreedomBox/Manual/Cockpit|Cockpit]]) or using a remote secure shell (see [[FreedomBox/Manual/SecureShell|Secure Shell]] section).  Then run the following commands:
 
 {{{
 $ sudo su -
@@ -65,23 +59,42 @@ $ apt full-upgrade
 
 === Auto-Update to Next Stable Release ===
 
-!FreedomBox can automatically update itself when there is a new stable release of Debian. This update feature is recommended, and enabled by default for stable systems. Note that it also requires "Enable auto-update" to be enabled, and that there is 5 GB free space on the root partition.
+!FreedomBox can automatically update itself when there is a new stable release of Debian. This update feature is recommended, and enabled by default for ''stable'' systems. Note that it also requires "Enable auto-update" to be enabled, and there should be 5 GB of free space on the OS (root) partition.
 
-In some special cases, such as advanced customization made to the system, the automatic update could fail. If you wish, you can disable it on the System -> Update page, by clearing the “Enable auto-update to next stable release” checkbox.
+In some special cases, such as advanced customization made to the system, the automatic update could fail. If you wish, you can disable it on the ''System'' -> ''Software Update'' page, by clearing the “Enable auto-update to next stable release” checkbox.
 
-If you decide to stay on an older release, you should check DebianReleases#Production_Releases to see how long it will be supported by Debian security team. Note that older releases will not have new versions of !FreedomBox, even through backports.
+If you decide to stay on an older release, you should check [[https://www.debian.org/releases/|Debian  Releases]] and [[LTS|Long Term Support]] pages to see how long it will be supported by Debian security team. You stop using an older release if it stops receiving security updates. Note that older releases will not have new versions of !FreedomBox (unless there is a security update), even through backports.
 
 === Manual Update to Next Stable Release ===
 
-Auto-update is recommended for most users. However if you want to do the update manually, here are some tips:
+Thirty days after the release of a Debian stable release, all users will be upgraded to the next stable release. This behavior can be disabled as described above and users may choose to upgrade at a time for any the following reasons:
+ * If you don't want to wait 30 days and want to get the new stable release immediately.
+ * If you want to keep your working setup stable and not risk changing it (major OS upgrades are somewhat risky). You can potentially keep your distribution for years without change.
+ * If you want to minimize disruption during upgrade process by choosing a time convenient to you.
+ * If your favorite app is no longer supported in the new stable release and you will need time to migrate away to an alternative.
+ * If you want to take full backups before distribution upgrade happens and be on stand by to restore it if something goes wrong.
+ * If you want to test the upgrade process ahead of other users and report any problems to the development team.
 
- * Take backups of your apps' data before performing the update.
+Here are some tips before you begin manual update to next stable release:
+
+ * Take backups of your apps' data before performing the update. Making a copy of your entire disk using cloning software is even better.
  * Create a system snapshot before you begin.
- * General [[DebianUpgrade|instructions]] for upgrading Debian distribution are available.
- * Some packages are known to have prompts during upgrade, due to modified conffiles. It is recommended not to upgrade these packages manually, but rather to allow !FreedomBox to handle their upgrade automatically. For upgrade to Debian 13 "trixie", this applies to the following packages:
-   * firewalld
-   * minidlna
-   * radicale
+ * General [[DebianUpgrade|instructions]] for upgrading Debian distribution are available but this approach can't handle the configuration changes needed for the new versions of software.
+ * Some software requires additional update operations that !FreedomBox performs as soon as it starts up after the distribution update. Please allow some time for these operations to complete after a distribution update. These apps include:
+   * Postfix/Dovecot (requires a new configuration file format)
+   * !MediaWiki (requires database to be upgraded)
+ * Some packages are known to have prompts during upgrade, due to modified configuration files. It is recommended not to upgrade these packages manually, but rather to allow !FreedomBox to handle their upgrade automatically. For upgrade to Debian 13 "trixie", this applies to the following packages:
+   * Firewalld
+   * Minidlna
+   * Radicale
+ * Some packages may not be available after upgrade to next release. Please migrate to a similar application before or after the upgrade process. For upgrade to Debian 13 "trixie", the following apps are no longer available:
+   * Janus. Use audio/video calling over Matrix or XMPP or audio calling over Mumble. This app will likely become available in future again.
+   * TT-RSS. Migrate to Miniflux or Nextcloud News.
+   * Searx.
+
+To initiate the distribution update process, go to ''Software Update'' in ''System'' section. Then ''Enable auto-update'' and ''Enable auto-update to next stable release'' option. Then click on the ''Distribution Update'' button. Then click the ''Start Distribution Update'' button. The process may take several hours if your OS is on a slow disk such as an SD card. !FreedomBox web UI may not be available during upgrade. Refresh the page if the page errors out. Finally, allow more time for post-upgrade processes and restart the machine.
+
+{{attachment:distribution-update.png}}
 
 ## END_INCLUDE
 

doc/manual/en/Users.raw.wiki

@@ -1,6 +1,11 @@
 #language en
 
+##For Translators - to have a constantly up to date translation header in you page, you can just add a line like the following (with the comment's character at the start of the line removed)
+## <<Include(sudo, ,from="^##TAG:TRANSLATION-HEADER-START",to="^##TAG:TRANSLATION-HEADER-END")>>
+##TAG:TRANSLATION-HEADER-START
 ~- [[DebianWiki/EditorGuide#translation|Translation(s)]]: English - [[es/FreedomBox/Manual/Users|Español]] -~
+##TAG:TRANSLATION-HEADER-END
+----
 
 <<TableOfContents()>>
 
@@ -8,25 +13,25 @@
 
 == Users and Groups ==
 
-You can grant access to your !FreedomBox for other users. Provide the Username with a password and assign a group to it. Currently the groups
+This app can be used to create, edit, and remove user accounts on !FreedomBox. Many apps with web interface in !FreedomBox support single sign-on using OpenID Connect. This means that if you are logged into !FreedomBox web interface, there is no need to login to the app separately. Other apps support using the !FreedomBox user accounts via LDAP. Finally, there are some apps that manage their own user accounts separate from the accounts you have in !FreedomBox.
+
+Access to an app is allowed if the user accessing the app is part of the app's group. You can grant access to apps in !FreedomBox for specific users by adding them to the following groups:
  * admin
  * bit-torrent
  * calibre
- * ed2k
  * feed-reader
  * freedombox-share
+ * freedombox-ssh
  * git-access
- * minidlna
- * syncthing
+ * kiwix
+ * syncthing-access
+ * vpn
  * web-search
  * wiki
-are supported. 
 
-The user will be able to log in to services that support single sign-on through LDAP, if they are in the appropriate group.
+Users in the admin group will be able to log in to all services. They can also log in to the system through SSH and have administrative privileges (sudo). A user's groups can also be changed later.
 
-Users in the admin group will be able to log in to all services. They can also log in to the system through SSH and have administrative privileges (sudo).
-
-A user's groups can also be changed later.
+!FreedomBox supports logging in with passkeys. Passkeys are a secure alternative to passwords and are the recommended way of authenticating to !FreedomBox. Read more in the [[FreedomBox/Guide/Passkeys|FreedomBox's guide to passkeys]].
 
 It is also possible to set an SSH public key which will allow this user to securely log in to the system without using a password. You may enter multiple keys, one on each line. Blank lines and lines starting with # will be ignored.
 

doc/manual/en/VirtualBox.raw.wiki

@@ -22,12 +22,11 @@ Follow the instructions on the [[FreedomBox/Download|download]] page to download
 
  1. Decompress the downloaded VDI image (tool for [[http://www.7-zip.org/|Windows]], [[http://unarchiver.c3.cx/unarchiver|Mac]]).
 
- 1. Create a new VM in the !VirtualBox UI with OS type ''Linux'' and Version ''Debian'' (32/64-bit according to the downloaded image).
-{{attachment:virtualbox_os_type.png|VirtualBox Name and OS dialog}}
+ 1. Create a new VM in the !VirtualBox UI with OS type ''Linux'' and Version ''Debian'' (32/64-bit according to the downloaded image). {{attachment:virtualbox-create-1.png|VirtualBox Name and OS dialog}}
 
- 1. In the ''Hard disk'' dialog choose ''Use an existing virtual hard disk file'' and select the .vdi file you extracted in step 1.
+ 1. In the ''Hardware'' dialog choose ''Enable EFI (special OSes only)''. You may increase the Base Memory and Processors if desired. {{attachment:virtualbox-create-2.png|VirtualBox Hardware dialog}}
 
-{{attachment:virtualbox_harddisk_file.png|VirtualBox Hard disk dialog}}
+ 1. In the ''Hard disk'' dialog choose ''Use an existing virtual hard disk file'' and select the .vdi file you extracted in step 1. {{attachment:virtualbox-create-3.png|VirtualBox Hard disk selector}} {{attachment:virtualbox-create-4.png|VirtualBox Hard disk dialog}}
 
  1. When created, go to the virtual machine's Settings -> [Network] -> [Adapter 1]->[Attached to:] and choose the network type your want the machine to use according to the explanation in Network Configuration below. The recommended type is the ''Bridged adapter'' option, but be aware that this exposes the !FreedomBox's services to your entire local network.
 

doc/manual/en/WordPress.raw.wiki

@@ -54,7 +54,9 @@ By default, web addresses for newly created blog posts and pages look like '''/w
 
 === Automatic Upgrades ===
 
-Similar to all other apps, feature and security upgrades for !WordPress are automatically handled by !FreedomBox (when not disabled). After a minor version upgrade, changes to the database structure are automatically done by !WordPress. However, after a major version upgrade, such as during major distribution upgrade every two years, database changes are not done automatically. For this, you need to login to !WordPress and trigger the changes manually.
+Similar to all other apps, feature and security upgrades for !WordPress are automatically handled by !FreedomBox (as long as the auto-update feature is enabled). Note that the updater that is built-in to !WordPress cannot update the !WordPress core or plugins that are installed from Debian packages. It can only be used to update additional plugins that have been added to the installation.
+
+After a minor version upgrade, changes to the database structure are automatically done by !WordPress. However, after a major version upgrade, such as during major distribution upgrade every two years, database changes are not done automatically. For this, you need to login to !WordPress and trigger the changes manually.
 
 === Plugins and Themes ===
 

doc/manual/en/freedombox-manual.raw.wiki

@@ -24,10 +24,12 @@
 <<Include(FreedomBox/Manual/Email,          , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
 <<Include(FreedomBox/Manual/FeatherWiki,    , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
 <<Include(FreedomBox/Manual/GitWeb,         , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
+<<Include(FreedomBox/Manual/HomeAssistant,  , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
 <<Include(FreedomBox/Manual/Ikiwiki,        , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
 <<Include(FreedomBox/Manual/Infinoted,      , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
 <<Include(FreedomBox/Manual/Janus,          , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
 <<Include(FreedomBox/Manual/JSXC,           , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
+<<Include(FreedomBox/Manual/Kiwix,          , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
 <<Include(FreedomBox/Manual/MatrixSynapse,  , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
 <<Include(FreedomBox/Manual/MediaWiki,      , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
 <<Include(FreedomBox/Manual/Minetest,       , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
@@ -80,6 +82,10 @@
 <<Include(FreedomBox/Manual/Upgrades,         , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
 <<Include(FreedomBox/Manual/Users,            , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
 
+= Guides =
+<<Include(FreedomBox/Guide/Passkeys,               , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
+<<Include(FreedomBox/Guide/ExposeLocalService,     , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
+
 = Hardware =
 <<Include(FreedomBox/Hardware,                     , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>
 <<Include(FreedomBox/Hardware/PioneerEdition,      , from="## BEGIN_INCLUDE", to="## END_INCLUDE")>>