v0.2.0-beta.18

New in this test version: dynamic DNS (DuckDNS, dynv6, Cloudflare, No-IP, any dyndns2 address – IPv4 and IPv6), an own certificate authority for the box and other devices in the home network, and Let’s Encrypt over DNS without opening a port (System → Netzwerk). USB printers in the network: current printers print and scan without a driver (AirPrint, Mopria, Windows 10/11), older ones over port 9100 – new system app “ipp-usb + p910nd”. UPS over USB: charge, runtime, messages on a power failure and a clean shutdown on battery – new system app “Network UPS Tools”. Printers, UPS and Let’s Encrypt have not been tested on real hardware yet – feedback welcome.

What's Changed

• Network: dynamic DNS, own CA, Let's Encrypt by @UniqueDroid in #108
• USB printers in the network (ipp-usb, p910nd) by @UniqueDroid in #109
• UPS over USB (Network UPS Tools) by @UniqueDroid in #110
• docs: release 0.2.0-beta.18 by @UniqueDroid in #111

Full Changelog: v0.2.0-beta.17...v0.2.0-beta.18

---

• USB printers in the network (Dienste → Drucker, new system app "printer" in the store: ipp-usb 0.9.34 + p910nd 0.97, 3 MB).
  • Current printers and multifunction devices that speak IPP over USB (most since about 2015, e.g. HP Smart Tank, OfficeJet, Canon PIXMA, Epson EcoTank) print without a driver: Windows 10/11, macOS, iPhone/iPad and Android find them by themselves (IPP Everywhere, AirPrint, Mopria) – and their scanner works over the network as well (eSCL). ipp-usb (OpenPrinting) does the work; ShareOS's avahi-daemon has no D-Bus, so a patch makes ipp-usb announce the devices through static avahi service files. The port of each device stays the same (kept on the flash).
  • Older printers (usblp, /dev/usb/lpN): p910nd on port 9100 + N, announced as _pdl-datastream; the computer uses the maker's driver ("Standard TCP/IP port" in Windows, AppSocket/JetDirect). Testseite sends a plain-text/PCL page.
  • Printers are followed when plugged in or pulled (mdev rule for lp*, ipp-usb watches USB itself). Mode Immer Port 9100 for printers whose driverless printing misbehaves. shareos-printer, rpcd shareos.printer, tests/test-printer.sh (14 checks with a fake /sys).
• UPS over USB (Dienste → USV, new system app "nut" in the store: Network UPS Tools 2.8.5 with the drivers usbhid-ups, nutdrv_qx and blazer_usb – APC, Eaton, CyberPower, most Megatec/Q1 boxes; 0.7 MB, kept on the flash so it works when a disk fails).
  • Charge, runtime, load and model of the UPS; a power failure, the power coming back, a low or worn battery and a lost connection become messages (e-mail/push as set up) and are listed under Ereignisse.
  • The box shuts down cleanly while on battery – when the UPS reports a low battery, below a charge of your choice or after some minutes on battery – and only then; if the power comes back first, nothing happens. Afterwards the UPS switches its output off and on again when the power is back, so the box starts by itself (can be switched off).
  • Other computers can read the UPS over the network (NUT, port 3493, user monitor with a password) and shut down before the box.
  • NUT without OpenSSL (external.mk: 4.4 MB of libraries less). shareos-ups, rpcd shareos.ups, the last step of the shutdown in S05board, tests/test-ups.sh (20 checks with fake NUT programs).
• DynDNS, own certificate authority and Let's Encrypt (System → Netzwerk).
  • DynDNS: DuckDNS, dynv6, Cloudflare, No-IP or any dyndns2 address (Strato, IONOS, …), IPv4 and/or IPv6 (for lines without their own IPv4 address: DS-Lite, fibre, mobile). The box reports its public address every 5 minutes when it changed, otherwise once a day; a failure becomes a message. Token and password go to curl through stdin, not the command line, and are never sent back to the browser. shareos-ddns, tests/test-ddns.sh (24 checks with a fake curl).
  • Own CA: a certificate authority on the box (EC P-256, 10 years) issues certificates for the box and other devices in the home network (825 days, server authentication, wildcards like *.home.lan, IP addresses); its root certificate is installed once on PCs and phones, after that there are no certificate warnings. The box's own certificate follows name and IP address and is renewed 30 days before it runs out. The CA is part of the settings backup. shareos-ca (mbedtls of the firmware), tests/test-ca.sh (18 checks, in CI with the firmware's programs in qemu).
  • Let's Encrypt for the DynDNS name with DuckDNS or Cloudflare: the check runs over DNS (TXT record at the provider), no port has to be open; renewed daily when less than 30 days are left. shareos-acme with uacme (105 KB, mbedtls), test mode with the staging CA.
  • shareos-cert no longer replaces a certificate of the own CA with a self-signed one when the IP address changes (it only renews its own self-signed one).

v0.2.0-beta.17

SMB 3 with signing about three times as fast (the crypto engine computes the signatures, #94), an SMB compatibility mode up to SMB 2.1, taking over disks with data from Alt-F or the D-Link firmware without erasing them, DNS-320 rev A no longer restarts in a loop after flashing (#96), and switching off by schedule finally works (#82). Plus a tidier interface: schedule overview with dates, an APPS tab in My ShareOS and a one-line header.

What's Changed

• DNS-320 rev A: initramfs at 0x1000000 as on the DNS-325 (#96) by @UniqueDroid in #98
• SMB compatibility mode (SMB 2.1) for faster signed transfers, AES in ARM assembly (#94) by @UniqueDroid in #99
• Storage: take over disks with data (Alt-F, D-Link) instead of erasing them by @UniqueDroid in #100
• SMB 3 signing through the Kirkwood crypto engine (CESA): 4-10 → 19-23 MB/s (#94) by @UniqueDroid in #101
• Hardening: dns320l-daemon buffers, dns323-fw complete writes, flash-bin lock by @UniqueDroid in #102
• crond reads /etc/crontabs – no ShareOS scheduled job ran (#82) by @UniqueDroid in #104
• UI: Apps tab in Mein ShareOS, device name and access lower in System → Allgemein by @UniqueDroid in #106
• Power schedule: show when the box comes on again, warn when off, 1-minute margin by @UniqueDroid in #105
• docs: release 0.2.0-beta.17 by @UniqueDroid in #107

Full Changelog: v0.2.0-beta.16...v0.2.0-beta.17

---

• SMB 3 with signing about three times as fast: the crypto engine computes the signatures (#94). Windows 11 signs every SMB connection, and on the 800 MHz Kirkwood the signature limited writing: measured on a DNS-320L, about 35 MB/s without signing (the disks), only 4–10 MB/s with SMB 3.1.1 – ksmbd computes AES-CMAC on the CPU, where AES manages about 12 MB/s. The Kirkwood has a crypto engine (Marvell CESA) that does AES-CBC at about 38 MB/s with DMA, but ksmbd could not use it. A kernel patch (0001-ksmbd-cmac-via-cbc) computes the AES-CMAC of messages from 8 KiB through cbc(aes) – the engine – (CMAC is a CBC-MAC; the last block and the subkeys on the CPU), checks the first result against the old way and falls back to it on any error. Measured: 19–23 MB/s signed, the CPU load of ksmbd went from about 64 % to under 10 %. shareos-shares loads marvell-cesa before ksmbd; module parameter ksmbd.cbc_cmac=0 switches it off. Tested before on a UML kernel with Samba's smbclient (signing required, checksums equal). Tried as well and dropped: AES-GMAC signing (GHASH in C on ARMv5 is not faster, 3–8 MB/s).
• SMB compatibility mode (Freigaben → Dienste → SMB → Kompatibilitätsmodus (höchstens SMB 2.1), off by default) for devices that have trouble with SMB 3: limits ksmbd to SMB 2.1 (HMAC-SHA256 signature on the CPU, 9–14 MB/s signed; no encryption, no multichannel). Changing it restarts ksmbd (the protocol range is only read at start); a ksmbd.mountd left over without the kernel module is restarted instead of being taken for a running SMB server. The kernel also has AES in ARM assembly now (CONFIG_CRYPTO_AES_ARM). tests/test-users.sh checks the setting.
• Take over disks with data instead of erasing them. Speicher → Laufwerke shows „ übernehmen“ at every partition (or RAID array) with a file system ShareOS does not know yet – the data disks of Alt-F or the D-Link firmware. It becomes a volume as it is: nothing is erased, ext4 gets the quick check and the quota feature as every volume, the first Linux volume becomes the apps area, RAID 1/0/linear arrays get their layout and go into mdadm.conf. Before, only the setup wizard was offered, which erases the disks (asked by a tester right after switching from Alt-F). shareos-storage adopt <name> <partition>, rpcd shareos.storage adopt; tests/test-storage.sh (+4 checks). SWITCHING/UMSTIEG explain it, with the SSH commands for older versions.
• DNS-320 rev A: no more reboot loop after flashing (#96). The stock U-Boot copies the initramfs to its load address before the kernel starts; on the DNS-325 0x800000 lies in memory the kernel uses, so the kernel dropped the initramfs, found no /init and restarted every minute (fixed for the DNS-325 in 0.2.0-beta.9). The DNS-320 rev A – the same SoC (88F6281) and U-Boot family – showed the same kind of loop (LEDs on, restart about every minute, no network), so its initramfs is now loaded at 0x1000000 as on the DNS-325. A box already in the loop needs a serial console once to start the new image from RAM (see the issue). tests/check-initrd-address.sh checks the new address.
• Scheduled jobs did not run at all (#82). BusyBox crond reads <dir>/crontabs, and buildroot's busybox config sets the dir to /etc/cron – while shareos-cron writes root's crontab to /etc/crontabs/root. So crond saw an empty /etc/cron/crontabs, and none of the ShareOS jobs ran: the scheduled switch-off (reported: the box switched on by schedule but not off), the hourly wake-up alarm, the message checks every 10 minutes, automatic updates, scheduled SMART tests, cloud jobs, Paperless inboxes, app tasks, the Zabbix collector. Running a job by hand always worked, which hid it. CONFIG_FEATURE_CROND_DIR="/etc" now, and post-build.sh stops the build if crond would read another directory. On a box before beta.17: rm -rf /etc/cron/crontabs; ln -s /etc/crontabs /etc/cron/crontabs; /etc/init.d/S50crond restart.
• Power schedule: you see when the box comes on again. The schedule is a short overview first (the days with their times, next switch-on/-off, aktiv/aus) with Einrichten/Bearbeiten; the table only opens on that button. The page shows the next switch-on and switch-off with the full date; saving says "the box switches on on Sat., 07.11.2026, 10:15" (or that none is planned); the power-off dialog says when the schedule switches it on again. Times entered while the switch Zeitplan einschalten is off get a clear warning (easy to miss before). The switch-on must now be only one minute ahead (was three) when you save or switch off – the alarm counts whole minutes and the MCU cuts the power 3 s after the shutdown; before, a test like "on at 10:15, switch off at 10:13" silently set the alarm for the next week. tests/test-power.sh updated.
• Interface: Mein ShareOS has its own tab APPS with all apps of the user (star = favourite); the start page keeps only the favourites at the top (FAV APPS). System → Allgemein: device name and access (root password) moved down, between App & Widgets and Über (section GERÄT & ZUGANG).
• Header stays on one line. The status chips (messages, update, VPN, apps …) use the free room left of ONLINE; the ones that do not fit go behind a small +N button (amber when a warning is among them), which opens them as a list under the row – the header keeps its height and the clock stays on the right. The MELDUNG chip no longer counts the “update available” message while the UPDATE chip is shown (it counted the same thing twice; the message stays under System → Meldungen and still goes out by mail/push).
• Hardening after an external code review (static analysis by another AI, checked against the code; the suggested patch was not taken over as it was, because it only moved one overflow into the next buffer). dns320l-daemon: the arguments of a -x command were assembled into 64 bytes with sprintf and copied into 512-byte messages with strcpy – now at most 256 bytes, snprintf, refused when too long (a heap overflow before, shown with AddressSanitizer); the command name is checked against its 64 bytes; the answer of the daemon is read with room for the terminating zero (one byte past the buffer before); write_str_to_file writes the string as it is instead of through a 64-byte copy, and completely. dns323-fw: complete writes (write_all), the disabled size check is documented (damaged files fail the checksums). shareos-flash-bin: one firmware write at a time (lock with the pid; a stale one is taken over). All of this was only reachable locally as root (the daemon listens on a root-only Unix socket) – nothing changes in how fan, LEDs and MCU are driven. tests/test-flash-bin.sh +2 checks.

v0.2.0-beta.16

Test version: OneDrive works right after signing in (#92); a failed "Add" can be repeated; downloads of an admin cloud job into a personal folder belong to its user (#91). Details below.

What's Changed

• Cloud: OneDrive drive_id/drive_type, keep the sign-in until the remote exists (#91, #92) by @UniqueDroid in #93
• Docs for 0.2.0-beta.16 by @UniqueDroid in #95

Full Changelog: v0.2.0-beta.15...v0.2.0-beta.16

---

• OneDrive works right after signing in (#92). rclone asks for the drive of a OneDrive account only in its interactive setup; the web interface creates the remote non-interactively, so rclone.conf got the token but no drive_id/drive_type, and every job failed until rclone config reconnect over SSH. Now ShareOS reads the drive of the signed-in account from Microsoft Graph (/me/drive) and writes both values. Accounts added before still need that reconnect, or remove and add them again.
• "Sign in first" after a failed "Add" (#91). The sign-in was used up before rclone had created the remote, so when that failed (for a user before beta.14: rclone on the apps drive was not reachable for users, see beta.14), every further "Add" said "sign in first". The sign-in is now kept until the remote exists.
• Downloads of an admin cloud job into a personal folder belong to its user (#91). A share can point into a personal folder (home/<user>); such folders keep their own rights (no share ACLs), so files that an admin job downloaded there belonged to root, were closed to the user (drwx------ root) and did not count towards the user's storage limit. After a download or mirror into /mnt/<volume>/home/<user>/… the files root created are now handed to that user. Files downloaded before are fixed by the next run of the job.
• Tests: tests/test-cloud-paperless.sh checks a OneDrive remote with a faked Microsoft Graph, that the users of a share can open what a system job downloaded into it, and that a download into a personal folder belongs to its user.

v0.2.0-beta.15

Test version: logs of the last 3 starts are kept (#83), switch off and on by schedule (#82), Zabbix agent as a system app (#84). Details below.

What's Changed

• Keep the logs of the last 3 starts (for #83) by @UniqueDroid in #85
• Power schedule: switch off and on per weekday (#82) by @UniqueDroid in #86
• Zabbix agent as a system app (classic C agent, active mode) (#84) by @UniqueDroid in #89
• Docs for 0.2.0-beta.15 by @UniqueDroid in #90

Full Changelog: v0.2.0-beta.14...v0.2.0-beta.15

---

• Zabbix agent as a system app (#84). APPS → Store → system apps → Zabbix Agent: the classic agent (zabbix_agentd 7.0 LTS, written in C – not the Go agent 2) for monitoring the box from a Zabbix server, installed only when wanted. It runs in active mode as the user zabbix: it connects to the server and sends at its own pace, no open port and no listener processes (StartAgents=0); passive checks can be switched on. Encryption with a pre-shared key (OpenSSL); system.run is denied. Besides the standard items (CPU, memory, network, file systems) it has NAS items: SMART and temperature of every disk in the bays (from the cache of Storage → Health, read every 30 minutes by root without waking sleeping disks), the state of every RAID (degraded, rebuild progress), temperature and fan of the box – with low-level discovery and a template for Zabbix 7.0 (docs/zabbix/shareos_template.yaml, triggers for failing/hot disks, degraded RAID …). Set up with shareos-zabbix set (JSON, see docs/MONITORING.md / docs/UEBERWACHUNG.md); settings and key are in the settings backup. Buildroot's zabbix package needs glibc, so the firmware tree has its own package/shareos-zabbix-agent (agent only, musl). New: a system app may say "flash": true to stay on the flash up to 8 MB (the agent with OpenSSL is about 5 MB) – it must keep reporting when the apps drive fails. Tests: tests/test-zabbix-items.sh (host, also in CI), tests/test-zabbix.sh (ARM emulator, agent against a fake Zabbix server, also with TLS-PSK).
• Logs of the last starts are kept (#83). The logs of the box live in RAM and were gone after a restart – after a box was unreachable and had to be restarted, nothing showed what went wrong. Now a snapshot is saved 5 minutes after every start (also when the start hangs in a service): system and kernel log, addresses, routes, listening ports, processes, mounts, RAID. The newest 3 stay on the flash (gzip, a few KB, one write per start). System → Protokolle → Start-Protokoll …; on the command line shareos-bootlog list|show. New host test tests/test-bootlog.sh (also in CI).
• Switch off and on by schedule (#82). System → Energie & Reset → Zeitplan: a switch-off and a switch-on time per weekday, as in the D-Link firmware. Switching off is a clean shutdown by cron (skipped while a storage job such as a RAID rebuild runs); switching on uses the wake-up alarm of the device controller (Weltrend MCU of the DNS-320L, DNS-320 rev B and DNS-327L, through dns320l-daemon) – the "internal RTC not ticking" message of the Kirkwood RTC is expected, that clock is not used on these boxes. The alarm holds one time, so ShareOS sets the next switch-on at boot, every hour, after saving and before every shutdown. Boxes without the MCU (DNS-325, DNS-320 rev A) can only switch off by schedule. New tool shareos-power, host test tests/test-power.sh (also in CI).

v0.2.0-beta.14

ShareOS 0.2.0-beta.14 – test version for test devices only.

Fix: the system app autobrr did not start ("Permission denied"). The folder .shareos on the apps drive was root-only when the drive had been set up from the web interface, so autobrr's own user could not reach its program. The folder is now passable for the app users (0711) and is repaired automatically at boot and on every app install.

Update from a running ShareOS: System → Update → Check now.

Full Changelog: v0.2.0-beta.13...v0.2.0-beta.14

---

• autobrr did not start: "Permission denied". The system apps that live on the apps drive (autobrr, and the programs of Transmission, FFmpeg …) are below /mnt/<drive>/.shareos. When the drive was set up from the web interface, that folder was created root-only (0700 – rpcd runs with umask 077), so the user autobrr could not reach its own program. .shareos is now 0711 (passable, not listable): set when the drive becomes the apps drive, at every app install, at boot (shareos-apps fix-perms) and when autobrr starts. tests/test-autobrr.sh now starts from a root-only .shareos.

v0.2.0-beta.13

ShareOS 0.2.0-beta.13 – test version for test devices only.

Fixes:

• Freigaben (Shares) did not open after visiting Paperless; a page that fails now shows its error instead of keeping the previous page.
• System → Terminal → "In eigenem Fenster" opens a real window with its own session (the tab stayed black before).
• Apps opened by another app (e.g. BeatBox → WinWeb Player) get access to the user's folders too – if they ask for no more permissions than the opening app.

The store apps were updated separately: they follow the ShareOS colours and show English when the interface is not in German.

Update from a running ShareOS: System → Update → Check now.

Full Changelog: v0.2.0-beta.12...v0.2.0-beta.13

---

• Terminal in its own window works. In eigenem Fenster opened a browser tab with the same address as the terminal in the page – but the terminal takes one client only, so the tab stayed black ("websocket connection closed with code: 1006"). Now it opens a real window with a session of its own (the page then says so and offers Hier anzeigen); In eigenem Fenster is also offered before a terminal is open.
• Apps opened by an app get the user's folders. BeatBox sends its loop to WinWeb Player with ShareOS.openApp, but the player then had no access to the box (no grant – only the ShareOS interface handed them out). Now an app with files gets a grant for the other app from the box (shareos.appfs grant_app), as long as that app asks for no more permissions than the opening one (apps share one origin, so a grant for an app with e.g. vpn would give the opener that permission too). Tested in tests/test-sysperms.sh.
• Freigaben did not open after Paperless. Opening Paperless loaded the shares and accounts but not the volumes; Freigaben then saw its data as loaded, failed on the missing volumes and the Paperless page stayed ("Cannot read properties of undefined (reading 'length')" in the console). The shares page now also waits for the volumes. And in general: when building a page throws an error, the interface no longer leaves the previous page standing but shows "Diese Seite konnte nicht angezeigt werden: " with Neu laden (and the error in the browser console).

v0.2.0-beta.12

ShareOS 0.2.0-beta.12 – test version for test devices only.

New system base: buildroot 2026.08.1, kernel 6.18.58, GCC 15.3 (Tailscale 1.104.1, autobrr 1.89).
Storage: disk health page (SMART rating, SSD life left, self-tests), disks can sleep without being woken, RAID mirrors wait for a late second disk (DNS-325), fewer flash writes.
Files: trash in the file browser with restore and automatic emptying.
USB button: a short press copies the USB drives into a dated folder.
SMB: access through a group works (ksmbd-tools 3.5.3).
Apps: new permission "notify" – apps send messages through the box's notifications.

Update from a running ShareOS: System → Update → Check now.

Full Changelog: v0.2.0-beta.11...v0.2.0-beta.12

---

• System: buildroot 2026.08.1 (2026.02 gets no more fixes), kernel 6.18.58, GCC 15.3. Newer packages, among them OpenSSL 3.6.5, curl 8.22, dropbear 2026.94, BusyBox 1.38, mdadm 4.6, ntfs-3g 2026.7.7, e2fsprogs 1.47.4, nfs-utils 2.9.1, rsync 3.5.0, SQLite 3.53, expat 2.9, Transmission 4.1.3, time zones 2026e and new CA certificates. System apps: Tailscale 1.104.1 (1.104.2 needs a newer Go), autobrr 1.89, OpenVPN 2.7.8, Transmission 4.1.3, htop 3.5.1, strace 7.1, iperf3 3.21, nano 9.0. The real hdparm is in the firmware now (before: the BusyBox applet). ShareOS patches: mdadm (musl) refreshed, one uhttpd patch dropped (fixed upstream), libgpiod without GLib bindings. ksmbd-tools stays on the own 3.5.3 package (buildroot still has 3.5.2).
• SMB: access through a group works (ksmbd-tools 3.5.3). A user who only got a share through a group (@family in the share's access list) was refused over SMB – the Finder said "the original item can't be found" – while the same user named directly worked. ksmbd-tools 3.5.2, the version of the pinned buildroot, does not pass the supplementary groups of a user to the kernel, so the POSIX ACL entry group:<name> never applied (ksmbd issue #461); 3.5.3 is the first release that does. Buildroot has no newer ksmbd-tools, so the firmware uses the package ksmbd-tools-shareos (ksmbd-tools 3.5.3) of the ShareOS tree instead of buildroot's BR2_PACKAGE_KSMBD_TOOLS; it goes away when buildroot has caught up. Checked on a DNS-325 rev A1 with kernel 6.18: a user with the share only through a group opens it from macOS.
• RAID: a mirror no longer starts with one disk when the second disk comes up late (#65). The DNS-325 brings its disks up one after the other (the second bay about 10 s after the first), and shareos-storage boot assembled the arrays before the second disk was there: the mirror ran on one disk ([2/1] [U_]) until a manual --re-add; a stripe or span stayed inactive. Now the members of the arrays in /etc/mdadm.conf are offered to mdadm --incremental as they appear, for at most 40 s – mdadm starts an array when its last member is there. After that, whatever is there is started (a really missing disk still gives a degraded mirror, logged as "RAID incomplete after 40s"). USB disks and foreign RAID members are not touched; without mdadm.conf there is no wait. New host test tests/test-raid-wait.sh with a fake mdadm (also in CI).
• Storage → Health (SMART of disks and SSDs): a page per disk with a rating (GUT / ACHTUNG / KRITISCH) and the reasons in plain words, temperature (with the lifetime maximum), running time, power cycles, motor start-ups, reallocated / pending / unreadable sectors, transfer errors (CRC – usually the connector, not the disk), error log, for SSDs the life left (device statistics or the vendor attribute) and the data written; all attributes as a table. Self-tests (short / long) from the page, with progress and the last result; by schedule (short test every Sunday or long test on the 1st of the month, 3:30) through shareos-storage smart-test, which reads the values again when the tests are done. The messages use the same rating (warning or error, with the reasons). rpcd: shareos.storage smart_test, smart_schedule; smartctl -a -l devstat instead of -H -A -i. New host test tests/test-smart.sh with smartctl JSON of a healthy HDD, a worn SSD and a failing HDD.
• Disks may sleep, the flash is spared: the storage page shows whether a disk is running or asleep (AKTIV / SCHLÄFT, hdparm -C, which does not wake it). The Paperless inboxes (every 2 minutes) are skipped while all disks below them sleep – nobody can have put a file there. A message for a problem that stays (checked every 10 minutes) only rewrites the message list in the flash once an hour instead of every time.
• Interface: a hidden tab or the app in the background no longer asks the box every few seconds (overview, header chips, messages, storage); it catches up when it is shown again – less load on the box and on the phone's battery.
• Trash in the file browser: deleting moves into a trash per folder root (personal folder, each share, each drive: <root>/.shareos-trash, same disk, so only a rename; it counts towards the storage limit). Papierkorb in the file browser lists what was deleted there with its origin, time and account: restore (back into its folder, a taken name gets " (2)", to the top when the folder is gone), delete for good, empty. Admins switch it on/off and set after how many days entries go for good (7–90, or never) under Freigaben → Dateien; old entries are removed when that trash is used next, so no timer wakes the disks. SMB and apps delete directly (for those there are the snapshots). rpcd: shareos.files delete (+ permanent), trash_list, trash_restore, trash_empty, trash_config.
• USB copy with the USB button: switched on under Speicher → Einstellungen → USB-Taste, a short press copies every mounted USB drive into a new dated folder on a chosen drive (<drive>/<folder>/YYYY-MM-DD_HHMM-<name>, default folder USB-Kopien; nothing on the NAS is overwritten or deleted, not enough space → nothing is copied); holding it 3 s or longer ejects as before. The USB light blinks while copying, the result comes as a message and shows on the page; Jetzt kopieren does the same from the interface. shareos-usb copy, rpcd shareos.storage usb_copy, usb_copy_config; without the switch the button only ejects, as before.
• Apps can send messages (permission notify). Apps like HomePing or TuyaPulse can now report through the box's notification service – the messages appear under System → Messages and go out by e-mail or push like the box's own. A scheduled task calls shareos-app-notify <info|warn|error> <key> <title> [text] (or clear <key>); the messages are sent when the task has finished (at most 10 per run). In the browser the SDK has ShareOS.notify.send(level, key, title, text) and .clear(key) (permissions files + notify, admin accounts only). The same key is one message (counted, sent again after 24 h at most); the app's name is put in front of the title; an app may send at most 20 messages an hour, so a broken app cannot flood the inbox or wear out the flash. Removing an app marks its open messages as resolved. Tested in tests/test-sysperms.sh.

v0.2.0-beta.11

ShareOS 0.2.0-beta.11

New: real data for apps (admin accounts only)

Four new app permissions, so SysMon, HomePing, DockerDeck and TuyaPulse show real values instead of sample data:

• sysinfo – the box's values: CPU, memory, temperature, fan, load, network counters, drives with usage and standby, uptime, process list. Processes can be ended – except the ones ShareOS needs to keep running.
• netcheck – ping, TCP port and HTTP/HTTPS checks (status, response time, certificate) run directly from the box, up to 32 side by side.
• docker – Docker hosts in your network via the Docker Engine API (http://host:2375 / https://host:2376): list containers, start, stop, restart, read logs. No exec, no new containers.
• tuya – Tuya smart-home devices in your local network, without the cloud: discover devices, read status, switch them (protocol 3.3 and 3.4). The small new program shareos-tuya in the firmware does the talking.

My ShareOS

• The Darstellung tab is now Einstellungen (settings) and also holds change password.
• Storage on the start page is a full-width table: one row per drive with what lies there, your usage, your limit and the free space.
• "Share with" on Android: install ShareOS from Chrome (needs a trusted certificate, e.g. https://shareos.local-name), then share photos, files or links to ShareOS – they land in the folder Geteilt in your personal folder. iOS does not offer this to web apps.
• App file dialog: the personal folder and your shares are now offered there too, also for accounts without file access (by your rights; read-only shares are not offered for saving).

Apps

New in the app catalog: SysMon 2.0, HomePing 2.0, DockerDeck 2.0, TuyaPulse 2.0 (these need this version), plus ShareVault 1.1 (categories), TinyPDF 2.0 (real PDF viewer with signatures) and KeyKeeper 2.0 (encrypted with a master password).

Known issues

• Shares with group permissions (#57) – a fix via ksmbd-tools 3.5.3 is on the way.

Update as usual via System → Firmware → Check for updates.

---

• App permissions sysinfo, netcheck, docker and tuya (each needs files, admin accounts only), so apps like SysMon, HomePing, DockerDeck and TuyaPulse show real data instead of sample values:

  • sysinfo – ShareOS.sysinfo: the box's values (CPU from two samples, memory, temperature, fan, load, network counters, drives with their use and standby, uptime, version) and the process list (user, memory, CPU ticks, command line); kill(pid, signal) ends a process – never init, kernel threads or what keeps ShareOS running (rpcd, ubusd, uhttpd, the board daemon, syslog). Through /_shareos/cgi/sysinfo (rpcd shareos.appsys).
  • netcheck – ShareOS.netcheck.check([...]): up to 32 checks side by side from the box – ping (loss, min/avg/max), TCP port open, HTTP/HTTPS answer with status, time and certificate check. Runs in the CGI /_shareos/cgi/netcheck with short time limits (rpcd shareos.appnet only checks the grant, so rpcd never waits for the network).
  • docker – ShareOS.docker: Docker hosts of the homelab through their Docker Engine API (http://host:2375 or https://host:2376, up to 16, kept in /etc/config/dockerhosts and in the settings backup). Fixed calls only: version, info, images, containers, inspect, stats, logs (as plain text) and start/stop/restart/pause/unpause – no exec, no new containers, no other paths. Docker does not run on the box itself.
  • tuya – ShareOS.tuya: Tuya smart-home devices in the local network, without the cloud – discover() (their encrypted announcements on UDP 6666/6667), status(device) and set(device, dps) over TCP 6668 with the device's local key, protocol 3.3 and 3.4 (session key); 3.1 and 3.5 are not supported yet. The new program /usr/sbin/shareos-tuya (C, mbedtls, 13 KB) does the talking; the app keeps its devices and keys.

• Mein ShareOS reworked:

  • The tab Darstellung is now Einstellungen (#/settings; the old address still works) and holds Passwort ändern next to the look settings.
  • Speicher on the start page is a table over the full width: one row per drive of the personal folder and the shares – what lies there, own use and limit, a bar (own limit, or the drive when there is none) and the free space of the drive (shareos.me gives volumes and the drive of each share).

• "Teilen mit" on the phone: the app installed from the browser (Android/Chrome; iOS does not offer this to web apps) appears in the share menu. What is shared goes into the folder Geteilt in the personal folder of the account that is logged in – photos and files as they are, a link or text as a small .txt file; a name that is taken gets " (2)". Only for accounts with a personal folder. Manifest share_target, the service worker keeps the shared files until the interface uploads them (also after a login), rpcd shareos.me share_ticket. Needs a trusted certificate (as for installing the app at all).

• File dialog of the apps (ShareOS.fs.pick) with the shares: accounts without Dateien now see their personal folder and their shares there as well (by their rights; read-only shares are not offered for saving). The app's own folder stays first and keeps its data; in the dialog it is called App-Daten. ShareOS.fs.roots() marks the entries with personal and share. Dateien still decides about the file browser in the interface.

• New test tests/test-sysperms.sh (with a fake Docker API and a fake Tuya device built from tinytuya's own frame and cipher code).

v0.2.0-beta.10

What's Changed

• UI: FAV APPS – Favoriten-Leiste pro Konto by @UniqueDroid in #55
• Docs: 0.2.0-beta.10 – FAV APPS, Darstellung, Anmeldemeldung by @UniqueDroid in #58
• Buttons: find the gpio-keys device on the DNS-325 and read its events (#56, merged with main) by @UniqueDroid in #59
• Buttons: find the gpio-keys device on the DNS-325 and read its events by @benoitm76 in #56
• Dateien: persönlicher Ordner für Admins – Apps schreiben nicht mehr oben aufs Laufwerk by @UniqueDroid in #60

Full Changelog: v0.2.0-beta.9...v0.2.0-beta.10

---

• FAV APPS – favourite apps per account: a small star on every app card (Apps → Installed, also in the table view; Mein ShareOS → My apps) marks an app as favourite. The favourites appear as an icon bar FAV APPS directly above Status in the overview, above the installed apps and at the top of Mein ShareOS; a click opens the app. Every account has its own favourites (root too). Under Appearance each account switches the bar on or off and chooses icons with names or icons only. Stored per account (fav, fav_bar, fav_text – root in shareos.ui, the others in their accounts section), set through shareos.me fav_set.

• System → Appearance in two columns on screens from 900 px; on narrower screens the panels stay one below the other, now over the full width.

• The tabs Apps, Cloud and Paperless no longer carry the "NEU" badge.

• Login message: the line on the console and in /etc/motd (SSH, web terminal) names version, model and web address – e.g. ShareOS 0.2.0-beta.10 on DNS-320L-rev-Ax: web interface http://192.168.1.20/, link 1000 Mbit/s. – instead of "phase-1 test system ready … (password: shareos)".

• Buttons: shareos-buttons reads the events again (DNS-325, DNS-320L). On a DNS-325 rev A1 none of the buttons did anything: the program ended at once and wrote nothing to the log. Two causes: the kernel names the input device after the device-tree node – gpio_keys on this box, gpio-keys on the DNS-320L – and the program only looked for gpio-keys; and ucode reads files through stdio, which asks the kernel for a first chunk of 15 bytes, while an event device refuses reads under one event (16 bytes, EINVAL). The program now accepts both names and reads the events through dd bs=16; S05board stop ends that dd through its PID file (/var/run/shareos-buttons-dd.pid). Checked on the DNS-325: power, reset and USB buttons, and one dd left after a restart of the service. The reset and USB buttons use gpio-keys on every model and the kernel and ucode are the same everywhere, so they were affected on the DNS-320L too (seen with beta.9: shareos-buttons ended at once, a press of the USB button left no trace) and probably on the DNS-320 (not tried); the power button of the DNS-320L and DNS-320 rev B is polled by shareos-board and not concerned, the one of the DNS-320 rev A is a gpio-key like the DNS-325's (not tried). New tests for the device name and the PID file in tests/test-buttons.sh.

• Apps keep the files of admins in their own folder: for admin accounts the folders an app sees (ShareOS.fs) now start with a personal folder – the account's own home (/mnt/<drive>/home/<name>), for root /mnt/<apps drive>/home/root (made on first use, 0700). Apps that store their data in the personal folder (ShareNotes, Webpad …) no longer write it to the top of a drive. The drives themselves stay reachable for admins as before. Files an app already wrote to the top of a drive stay there; move them by hand if wanted, e.g. for ShareNotes on the drive daten (in System → Terminal or over SSH):

  mkdir -p /mnt/daten/home/root && chmod 700 /mnt/daten/home/root
  mv /mnt/daten/notes /mnt/daten/home/root/

  If your apps drive is not daten, use its name instead; other apps' folders (e.g. webpad) move the same way.

v0.2.0-beta.9

What's Changed

• Tailscale starts by itself; hook follows the new id tailscaled by @UniqueDroid in #48
• System apps declare their service in app.json (S90services, no more hooks) by @UniqueDroid in #49
• Private app folder for accounts without Dateien (ShareOS.fs root "app") by @UniqueDroid in #50
• App frame and terminal: allow the clipboard (fullscreen, autoplay) by @UniqueDroid in #51
• autobrr: system app, service and permission autobrr by @UniqueDroid in #52
• Fix DNS-325 boot loop and first installation by @benoitm76 in #53
• One release: 0.2.0-beta.9 (no beta.10/beta.11 sections) by @UniqueDroid in #54

New Contributors

• @benoitm76 made their first contribution in #53

Full Changelog: v0.2.0-beta.8...v0.2.0-beta.9

---

• Tailscale starts by itself: the daemon now runs as soon as the system app tailscaled is installed and after every restart – it waits for the sign-in, and a box that was signed in connects again by itself. Before, only an app's Verbinden started it.
• Services of system apps are declared in their app.json: "service": { "control": "tailscale", "on_install": "start", "delay": 5 } – ShareOS starts it at boot (/etc/init.d/S90services, after its delay, in the background), right after installing if asked, and stops it when the app is removed or the box shuts down. The work is done by the firmware's controller /usr/sbin/shareos-<control>, which states what it can do (shareos-service: boot start stop-all); a package cannot bring its own, so only reviewed code starts daemons as root. One init script and no removal hooks replace S93tailscale, S94vpn, S95transmission, S96dlna and /usr/lib/shareos/apphooks – renaming a system app can no longer break its start. Packages built before carry no "service" yet; ShareOS knows their entries.
• Services → Status / Autostart list the services of installed system apps (Tailscale, VPN, Transmission, media server) with their state; start, stop and switching the autostart off work for them as for the other services (the names stay tailscale, vpn, transmission, dlna).
• System apps are submitted to the ShareOS repository (sysapps/), web apps to ShareOS-Apps: sysapps/README.md explains both kinds with an example each – a program (tree) and a service with its controller (mosquitto) in docs/examples/sysapps/.
• Copying in apps shown in the page works: the frame of an app inside the ShareOS page (permission embed) and the web terminal now allow the clipboard (allow="clipboard-read; clipboard-write", plus fullscreen and autoplay for players). Before, a copy button in such an app failed with "The Clipboard API has been blocked because of a permissions policy".
• Apps keep their data on the box also for accounts without "Dateien": an app with the permission files opened by such an account gets one private folder of its own – /mnt/<apps drive>/.shareos/userdata/<account>/<app> (the account's, 0700) – as its only folder in ShareOS.fs (root app, private: true). The account's personal folder, the shares and the file browser stay closed, and other permissions (torrent, media …) still need "Dateien". Before, ShareOS.fs was missing and apps like ShareNotes fell back to the browser. Removing the app removes these folders; deleting an account with its data removes them too.
• autobrr (download automation): the system app autobrr (autobrr 1.84, 32 MB with its web interface, on the apps drive) watches IRC announce channels and RSS feeds and picks releases by your filters. One autobrr for the whole box: shareos-autobrr runs it as its own user autobrr on 127.0.0.1:7474 with a Go memory limit (GOMEMLIMIT=48MiB), its database on the apps drive; the first start signs it up (user admin) and makes an API key for ShareOS (root only). Found torrents go to the Transmission of one account: autobrr's action Watch dir writes them into the hand-over folder /mnt/<apps>/.shareos/autobrr-drop (the account's, group autobrr, 2770), which that account's Transmission watches. Optionally autobrr's own web interface on http://<box>:7474 (its own login, password set from ShareOS). Starts after installing and at boot ("service": { "control": "autobrr" }), listed under Services.
• Permission autobrr for apps (needs files), admin accounts only: ShareOS.autobrr – status, start, set (on/off, web interface, account for the hand-over), password, accounts, log and api(method, path, body): autobrr's REST API through /_shareos/cgi/autobrr with the key of ShareOS (rpcd shareos.appautobrr; not /api/keys or /api/auth). The app itself comes from ShareOS-Apps.
• DNS-325: first start on real hardware (rev A1). The beta.7 .bin for the DNS-325 made the box restart in a loop: the kernel booted, printed INITRD: 0x00800000+0x001ff000 overlaps in-use memory region - disabling initrd, found no /init and panicked (panic=10 restarts after 10 s), so neither the first installation nor the rescue system ever ran. The initramfs of the DNS-325 is now loaded at 0x01000000 instead of 0x00800000 (post-image.sh makes one header per model; it checks the address in each finished image, and tests/check-initrd-address.sh checks the bundles in CI). With the new address the DNS-325 boots from flash. The DNS-320L and the DNS-320 keep 0x00800000 until someone has tried the new address on them (a wrong address is a reboot loop that needs a serial console); the kernel is the same on all models, so what is in use at 0x800000 on the DNS-325 depends on the board or its U-Boot – not found yet.
• First installation / shareos-install-ubi on the DNS-325: the tool refused the image partition ("unexpected size 0x06600000, expected 0x06400000"). The DNS-325 has 102 MB there (no my-dlink partition), the DNS-320L 100 MB; both are accepted now, any other size is still refused. The DNS-320 rev A shares the DNS-325's flash layout in Alt-F's device trees (not seen on hardware yet). New test tests/test-install-ubi.sh.
• Checked on a DNS-325 rev A1: model and RAM (256 MB), 1 Gbit/s Ethernet, temperature sensor, clock, USB, the 6 flash partitions, the LEDs, the three fan presets (quiet, balanced, cool) and the box starting again by itself after a power cut (with the drives stopped by shareos-storage shutdown first). The power, reset and USB buttons do not work on this box yet (shareos-buttons finds no input device; a separate change fixes it), and a complete first installation from a freshly flashed .bin still needs a test (DEVICES.md). A DNS-325 that already runs beta.7 and restarts in a loop needs a serial console to recover (the old initramfs is in its flash). The DNS-320L, DNS-320 rev A/B boxes are not tested with the new address yet.