TautWeekly for Plex v0.14.0
TautWeekly for Plex v0.14.0
v0.14.0 brings the authenticated shared Manager to NAS containers and native
Linux while keeping each host's lifecycle truthful. QNAP Container Station,
Unraid Apps, generic Docker hosts, and systemd Linux installations now use the
GUI for setup, verification, previews, TestEmail, and schedule controls without
inheriting Windows tray, sign-in, Scheduled Task, or installer behavior.
NAS / Docker Manager
The maintained NAS image now serves the same capability-aware Manager core on
amd64 and arm64. First run has no default password: retrieve a random one-time
token with the documented host or container Console command, pair locally, and
create the administrator password. The token is stored only in private
persistent data and is never written to startup logs or a credentialed URL.
Authentication uses salted PBKDF2 password storage, bounded in-memory sessions,
SameSite/HttpOnly cookies, per-session CSRF protection, same-origin mutation
checks, login throttling, and Host-header validation. TLS remains the reverse
proxy's responsibility; exact DNS allowlists and secure-cookie mode are
available without trusting forwarded client headers. Public health output is
limited to liveness.
The image remains read-only and replaceable. Configuration, Manager access,
schedules, output, history, cache, and backups remain under /data. QNAP uses
the supplied Container Station Compose adapter, Unraid uses the maintained
Community Applications template, and other Docker hosts use the generic
Compose package. A native QPKG and app-store submission remain separately
scoped because they require signed hardware/store validation.
Native Linux Manager
The Linux archive now includes self-contained Manager binaries for amd64 and
arm64. install-linux.sh selects the matching architecture, installs it under
/opt/tautweekly, and starts a hardened systemd service whose Manager defaults
to 127.0.0.1:8788. Use the documented SSH tunnel, run
sudo tautweekly manager-bootstrap, and finish setup in the GUI. ImageMagick is
now an explicit prerequisite rather than an implicit verification dependency.
Linux capabilities are distinct from both Windows and containers: no tray,
sign-in startup, browser auto-launch, Windows task controls, or container update
wording is exposed. Paths describe /opt/tautweekly and
/var/lib/tautweekly; scheduling describes the embedded systemd service; access
recovery uses sudo tautweekly manager-reset-access; and the private preview
landing page contains native Linux instructions.
Update, recovery, and shutdown
For Compose/QNAP, back up persistent data, check or pull the stable image, use
the guarded host update, then sign back in and rerun verification, PreviewAll,
and TestEmail. Unraid updates through its Docker/Apps controls. Rollback pins
the prior verified image tag or digest and reuses the same /data volume.
For native Linux, download the new archive with SHA256SUMS.txt, run a private
backup, verify the checksum, and use sudo ./install-linux.sh --upgrade. The
installer records a timestamped /opt program backup, preserves private data
and environment settings, and verifies that a previously active service
returns. Reinstall and authentication recovery preserve private data; uninstall
instructions retain it until deletion is separately and explicitly intended.
Signing out or closing a browser never changes the independent newsletter
schedule. During service/container shutdown, the Manager listener stops first
and the supervisor waits within the documented 30-minute host grace for an
already-running newsletter delivery instead of cancelling it.
Validation and limitations
Release gates cover Manager unit, contract, security, and accessibility tests;
Windows and Linux builds; amd64/arm64 Manager cross-builds; isolated packaged
Linux boot/authentication/token-redaction/shutdown smoke; container health,
ownership, root-refusal, restart, recovery, and update contracts; 33 synthetic
newsletter scenarios; reproducible archives; and the isolated Windows
install/update/icon/uninstall lifecycle. Tests never contact real Tautulli,
Plex, SMTP, or user configuration.
Physical QNAP/Unraid hardware behavior, NAS-vendor reverse proxies and storage
ACLs, Community Applications moderation, real mail providers/clients, and a
native signed QPKG remain irreducible environment or submission checks.