0.2.0

A volume for the player, and a server that rests when nobody is using it.

The player has a volume of its own. A speaker at the end of its row opens a
narrow upright level over itself, with a way to silence it, and closes on a press
outside or Escape; on a phone it sits at the foot of the opened player. The level
belongs to the browser and never reaches the server. It is squared on its way to
the sound, since hearing is not linear, so the middle of the line sounds like the
middle. On an iPhone or an iPad, where a page cannot set the level, the speaker
mutes and unmutes instead.

A server nobody is using asks nothing. Two loops woke every minute to read the
database for answers that could not have changed, and between them kept a
connection open for ever — which in sqlx is a thread with a two megabyte stack of
its own, retired and replaced every half hour. An idle server now holds none.

The tags of an MP3 name the people in its involved people list by what they did —
Producer, Arranger, Engineer, Mix, DJ-mix — rather than as a row of TIPL that says
nothing about which is which. The producer, which the tag reader used to drop from
an MP3 altogether, is among them.

On a phone the opened player shrinks the cover to fit, rather than letting it push
the controls off a screen that is not much taller than it is wide.

Nothing changes in the database, so a data directory made by 0.1.0 is one 0.2.0
opens as it is, and every password hashed then still lets its account in.

podman run -d --name tocata \
  -p 4224:4224 \
  -v tocata-data:/data \
  -v /srv/music:/media:ro \
  ghcr.io/ogarcia/tocata:0.2.0

Or the binary for this architecture from the files below, which is the whole
program. It makes its own database on the way up and writes the first
administrator's password to the log exactly once.

0.1.0

The first release. Early days, and now being run in earnest.

An OpenSubsonic music server in one binary, with its administration panel inside
it, statically linked and bringing its own libc. There is nothing to install
beside it, no runtime to provide and no web server to put in front of it.

The OpenSubsonic API under /rest, answering in XML or JSON: browsing by artist,
record, genre and folder, searching, the usual lists, playlists, bookmarks, play
queues, favourites and ratings, cover art, lyrics, and the audio itself served as
it is on disk.

Five extensions are declared — apiKeyAuthentication, songLyrics,
topSongsByArtistId, playbackReport and indexBasedQueue. Keys are made in the
panel, one per client, each withdrawn on its own, and a key also works where a
password goes because a client's login screen has one box for it.

Token authentication is refused with error 42 and cannot be anything else:
verifying t=md5(password + salt) means having the password to hand, and what is
kept is an Argon2id hash whose whole purpose is that it cannot be. Every client
tried so far has a setting for the other way, worded as plain, clear text or
legacy password authentication.

The collection as the last scan read it — tracks, records, artists, genres,
favourites and playlists — with a player for listening to enough of something to
know it is the right one, the words of a song timed against it, and every tag a
file carries read straight off the disk when it is asked for.

Then the server itself: collections and who may reach each, accounts and their
keys, the sessions a person has open and the way to close the rest, the scan and
what it found, and the housekeeping — clearing out what has been absent long
enough, and the checks that say whether the database still agrees with itself.
In English and Spanish.

Scrobbling to ListenBrainz, and portraits looked up at MusicBrainz and Wikimedia
Commons when somebody presses the button. Every trip to the network is optional
and none of them happens as a side effect of a scan: a server on an isolated
network never reaches for anything nobody asked for.

Nothing is ever written to the music. Not a tag, not a file beside it, not once.

podman run -d --name tocata \
  -p 4224:4224 \
  -v tocata-data:/data \
  -v /srv/music:/media:ro \
  ghcr.io/ogarcia/tocata:0.1.0

Or the binary for this architecture from the files below, which is the whole
program. It makes its own database on the way up and writes the first
administrator's password to the log exactly once.