Patches shipped this week: v1.6.612 → v1.6.624 (Jellyfin setup, faster dashboard, auto-updates for everyone, security)
Posted by Chris
Tom shipped 13 releases this week — here is the roll-up in one place. Every box picks these up on its own, or run sudo sparkbox update now. v1.6.624 — Jellyfin sets itself up again; the dashboard loads in seconds - Fresh Media installs no longer land in Jellyfin's first-run wizard. Jellyfin 10.11 changed that wizard and SparkBox's auto-setup silently gave up on it, leaving you to 'create a login and add media' yourself. Setup now completes through Jellyfin's own API, and the release test checks it every time. Your Jellyfin login is the SparkBox one under Settings → Passwords. - The dashboard settles in seconds instead of 20+. It was asking Docker for every container's CPU/RAM one at a time on every load (7–11 seconds each), and your app icons were stuck in line behind those requests. Now it's one quick request, sent after the page has drawn. - Icons, fonts and the dashboard's own code are cached by your browser between visits instead of being re-checked on every page load. v1.6.623 — Cloudflare Tunnel tells you what's missing; Tom AI stops guessing about SparkBox itself - Publishing an app through Cloudflare Tunnel now checks itself. After you enter the hostname, the dashboard tests the three things that have to be true — your domain is on Cloudflare, the address exists, and it answers — and tells you the one thing to do next in plain words (for example: your domain is still using your registrar's nameservers). Before, every one of those failures looked like the same blank page. - The Cloudflare instructions in the dashboard, the module card and the guide now match Cloudflare's current screens (Networking → Tunnels, Hostname routes). The old names sent people to menus that no longer exist. - Tom AI no longer invents SparkBox pages or buttons. It now knows the real facts about license slots (Settings → License → Remove license; slots recycle automatically), why Hearth is private by design, and which Media apps are optional toggles — and says 'I don't have that documented' instead of guessing. v1.6.622 — dashboard is HTTP, not HTTPS - Dashboard is HTTP, not HTTPS. v1.6.621 — Security: real lockdown, honest exposure check, and boxes that stopped updating - Fixed the bug that could permanently cut the dashboard off from Docker: if your system ever changed the Docker socket's group id (a Docker or NAS OS update), the dashboard lost the ability to see your apps, restart them, or update itself — and no restart could bring it back. Found on a real box that had been stuck on a May version for three months. - The dashboard now says so loudly in its log when it cannot reach Docker, instead of looking healthy while every update silently fails. - Boxes already in this state need one command on the machine itself — sudo sparkbox update — or a Recreate of the dashboard container from Portainer; after that they stay fixed. - Locking down a public server now also closes Portainer — the Docker control panel, which can do anything on the machine. It was left open before, while the command said it had closed everything. - sparkbox doctor now checks every app's ports, not just two. On a public server it used to say 'locked down — all checks passed' while apps were still facing the internet. - Hardware transcoding on NVIDIA cards now actually loads the GPU: the NVIDIA runtime overlay was wired into code that never ran, so NVENC silently fell back to CPU. - sparkbox doctor no longer reports a false GPU failure when you run it as a normal user who isn't in the video/render group — what matters is whether the media containers can reach the GPU, and that check is unchanged. - On a box where the video and render groups are the same id, the media stack no longer fails to start with 'groupadd items at 0 and 1 are equal'. - Enabling Cloudflare Tunnel with a blank or malformed token now warns you at the command line instead of starting a tunnel that can never connect. v1.6.620 — Automatic updates for every box - Hands-off automatic updates are back on for every SparkBox — free, Backer and Legend alike. Apps update overnight in the window you pick (Settings → Updates), a SparkBox upgrade follows, and an update that misbehaves rolls itself back. No more Legend gate on this. - One thing the automatic rollback cannot undo: when an app moves up a whole version number (2.x to 3.x, say), it migrates its stored data on first start, and that migration only runs one way. Rather than put the older build back in front of data it can no longer read, SparkBox leaves that app on the new version and tells you it did. If you need the older version, restore it from a backup. - Boxes that fell far behind now catch themselves up automatically instead of waiting for a click. v1.6.619 — Immich 3.1.0 + Windows boxes that die when you close the window - Immich updated to v3.1.0 (server + AI engine). Your library and login carry over; the upgrade runs its own database migrations on first start (a couple of minutes on a big library). - sparkbox doctor on Windows/WSL now notices when the start-with-Windows task is missing or not running — the reason a box 'only works while the PowerShell tab is open' — and prints the one-line fix. - The Run-SparkBox-on-Windows guide gained the missing 'make it start with Windows' step. v1.6.618 — Three fixes - Normalize JELLYFINHWACCEL read so hw-accel-no-dri stops false-flagging. - Stop WSL mirrored-loopback advice from sending users to NAT. - Flag Windows 'Public' network profile on WSL boxes. v1.6.617 — launcher tile opens /web instead of the bare XML root - Launcher tile opens /web instead of the bare XML root. v1.6.616 — Six fixes - Dashboard COMPOSEPROFILES mirror missing chaptarr (drift from sparkbox). - Stop ProtonVPN WireGuard DNS timeout loop by dropping 10/8 from outbound subnets. - Re-assert UFW forward policy on every up so containers keep egress. - Only flag the WSL mirrored-loopback wedge on a real hang. - Collapse duplicate .env keys on settings save. - Wire Chaptarr toggle into the dashboard so the container actually starts. v1.6.615 — Remote-access hardening for public servers - New command: sudo sparkbox lockdown — stops serving the SparkBox dashboard and the WireGuard admin page to the internet on public servers. Your apps, custom domains and connected VPN clients keep working, and the command explains how you'll reach the dashboard (VPN or SSH tunnel) before it changes anything. 'sparkbox lockdown --undo' reverses it. - sparkbox doctor now checks whether your admin pages are reachable from the whole internet and, if they are, tells you exactly how to close them. - sparkbox reset-password now proves your new password actually works with a real login test before reporting success — previously it could report OK while the old password was still active, or fail silently depending on how the new password was piped in. - Fixed: updating SparkBox no longer re-classifies your server (NAS vs public server). A wrong label could weaken the security posture picked for public servers. - Public-server installs now print a reminder that the dashboard and WireGuard admin page are internet-reachable, with the one command that closes them. v1.6.614 — open Chaptarr port 8789 in gluetun firewall + dashboard port maps - Open Chaptarr port 8789 in gluetun firewall + dashboard port maps. v1.6.613 — teach Tom AI the real VPN opt-out (MEDIASTACKNOVPN) - Teach Tom AI the real VPN opt-out (MEDIASTACKNOVPN). v1.6.612 — restart success reply no longer claims the problem is fixed - Restart success reply no longer claims the problem is fixed. Thanks to everyone who reported these — most of them started as a post here. If one of them is your report and it is not fixed for you, reply and I will pick it up.