0.1.0

The first release. Early days, and now being run in earnest.

An OpenSubsonic music server in one binary, with its administration panel inside
it, statically linked and bringing its own libc. There is nothing to install
beside it, no runtime to provide and no web server to put in front of it.

The OpenSubsonic API under /rest, answering in XML or JSON: browsing by artist,
record, genre and folder, searching, the usual lists, playlists, bookmarks, play
queues, favourites and ratings, cover art, lyrics, and the audio itself served as
it is on disk.

Five extensions are declared — apiKeyAuthentication, songLyrics,
topSongsByArtistId, playbackReport and indexBasedQueue. Keys are made in the
panel, one per client, each withdrawn on its own, and a key also works where a
password goes because a client's login screen has one box for it.

Token authentication is refused with error 42 and cannot be anything else:
verifying t=md5(password + salt) means having the password to hand, and what is
kept is an Argon2id hash whose whole purpose is that it cannot be. Every client
tried so far has a setting for the other way, worded as plain, clear text or
legacy password authentication.

The collection as the last scan read it — tracks, records, artists, genres,
favourites and playlists — with a player for listening to enough of something to
know it is the right one, the words of a song timed against it, and every tag a
file carries read straight off the disk when it is asked for.

Then the server itself: collections and who may reach each, accounts and their
keys, the sessions a person has open and the way to close the rest, the scan and
what it found, and the housekeeping — clearing out what has been absent long
enough, and the checks that say whether the database still agrees with itself.
In English and Spanish.

Scrobbling to ListenBrainz, and portraits looked up at MusicBrainz and Wikimedia
Commons when somebody presses the button. Every trip to the network is optional
and none of them happens as a side effect of a scan: a server on an isolated
network never reaches for anything nobody asked for.

Nothing is ever written to the music. Not a tag, not a file beside it, not once.

podman run -d --name tocata \
  -p 4224:4224 \
  -v tocata-data:/data \
  -v /srv/music:/media:ro \
  ghcr.io/ogarcia/tocata:0.1.0

Or the binary for this architecture from the files below, which is the whole
program. It makes its own database on the way up and writes the first
administrator's password to the log exactly once.