Podman · rc.d

Native lifecycle.
Maintained container.

Run the published TautWeekly OCI application through FreeBSD's documented Linux-container support, control it with service(8), keep private state under /var/db, and use the authenticated Manager through host loopback.

FreeBSD 15.1+amd64Podmanauthenticated ManagerBeta

Start installation Download release

freebsd — controlled launch

$ sudo ./install-freebsd.sh
✓ Linux emulation ready
✓ Podman service ready
✓ rc.d integration installed

$ sudo tautweekly manager-bootstrap
✓ one-time token returned only here

$ ssh -L 8787:127.0.0.1:8787 admin@freebsd-host
→ Manager Config · Verify · PreviewAll · TestEmail

rc.dFreeBSD service lifecycle

OCIshared Manager and renderer

127.0.0.1default Manager bind

0credentials in image or service logs

Before installation

A clear compatibility boundary

This first FreeBSD track targets the host combination documented and testable today. It does not claim native PowerShell support.

FreeBSD host

Use FreeBSD 15.1 or newer on amd64 with a supported package repository and root access.

Linux container path

The installer enables FreeBSD Linux emulation and the Podman service, then verifies the public OCI image can be pulled.

Network boundary

Allow outbound access to GHCR, Tautulli, SMTP STARTTLS, and any optional Plex metadata endpoint.

Why this track is beta

Static scripts, archive integrity, and the Linux OCI payload run in GitHub CI, but GitHub-hosted runners do not boot this FreeBSD service. Complete preview and TestEmail acceptance on the target host before scheduling.

Installation

Inspect every host change

The installer may add Podman with pkg, enables the Linux and Podman services, installs one rc.d service, and preserves existing settings and data.

1. Compare the published checksum

grep 'TautWeekly-freebsd-podman.tar.gz' SHA256SUMS.txt sha256 -r TautWeekly-freebsd-podman.tar.gz

2. Extract and install

tar -xzf TautWeekly-freebsd-podman.tar.gz cd TautWeekly-freebsd-podman sudo ./install-freebsd.sh sudo tautweekly manager-bootstrap ssh -L 8787:127.0.0.1:8787 admin@freebsd-host # open http://127.0.0.1:8787/

GUI

Manager Config is the setup source

Enter the one-time token, create a unique administrator password, and complete Config. Tautulli supplies core activity and selected/flattened rating fallbacks. A direct Plex URL and administrator token reachable from the Podman container are recommended for complete provider ratings and artwork. Validate, save, and verify checks Plex identity and authenticated library access without printing the token.

Before acceptance

Refresh Plex, then Tautulli

Use this after first setup, after a Plex agent/source change, or after a ratings/artwork recovery update when data may be stale.

Confirm the movie source

Confirm Edit → Advanced → Ratings Source for each included Plex Movie library.

Refresh Plex

Run Manage Library → Refresh All Metadata for every included movie/TV library and wait.

Refresh Tautulli

Open each same Library → Media Info tab, select Refresh media info, and wait. Repeat per library.

Full refreshes can be slow and can update metadata or artwork.

Do not refresh unrelated libraries. Tautulli's table refresh does not replace Plex's refresh. Routine TautWeekly updates do not require this when current output is correct.

Main features and acceptance

Shape it, inspect it, then deliver

The Manager exposes the everyday newsletter controls without requiring JSON edits. Use the full reference for advanced renderer fields.

Connections and delivery

Add Tautulli, recommended direct Plex, SMTP, sender identity, and a controlled TestEmail. Saved secrets remain write-only.

Library selection

Choose the movie and TV libraries that define releases, Trending, and personal statistics. Unselected sections do not contribute.

User exclusions

Save who is excluded from personalized use. The policy blocks those users from previews, TestEmail, welcome, and production delivery while keeping them visible for policy review.

Managed-user addresses

A separate card appears only for active Tautulli users without native email. Private fallback assignments may share an inbox, never override native email, and remain subject to existing exclusions; TestEmail stays isolated.

Newsletter and custom text

Set lookback, card limits, branding, and the optional custom text card. Its body is required when enabled; title, six-choice local title GIF, subheading, and border are optional.

Deleted-item cache

When the cache is enabled or its coverage changes, validation starts a separate no-email refresh for every production-eligible included user and selected movie/TV library. It captures only qualifying live newsletter-window items by exact stable GUID and usable poster; it does not crawl the whole library or depend on PreviewAll. Run sudo tautweekly cache-refresh explicitly and sudo tautweekly cache-status for a share-safe aggregate summary. Unseeded means no qualifying live refresh or render has written an entry. Disabling the cache stops reads and writes but does not erase retained entries under /var/db/tautweekly.

Configure

Write Tautulli, recommended direct Plex, mail secrets, and the optional custom text card only inside private container data. Its body is required when enabled.

Verify

Check Tautulli, direct Plex identity/authenticated library access, SMTP TCP reachability, files, timezone, and schedule.

Preview

Render all deterministic states without mail.

TestEmail

Validate SMTP authentication, sender permission, MIME, and the actual mail client.

Opt in

Enable the scheduler after roster review.

# Expert/recovery fallbacks only: sudo tautweekly list-libraries sudo tautweekly manage-libraries sudo tautweekly list-users sudo tautweekly exclude-users sudo tautweekly preview-all USER_ID sudo tautweekly send-test-all USER_ID sudo tautweekly schedule-status # only after review: sudo tautweekly schedule-enable

LIB

One upstream content scope

manage-libraries saves stable Tautulli section IDs and backs up private configuration. The renderer queries selected sections independently, rejects mismatched rows, and applies the resulting scope before quiet mode, Trending, Binge Champion, and personal statistics are calculated.

MAIL

Current newsletter presentation

The inherited payload lists every qualifying personal movie and TV show in separate full-width cards. Both use two title columns on desktop; on mobile, movies stack one per row while TV retains two columns. Empty media cards stay omitted; compact personal total watch time and Binge Champion cards remain distinct. HOT NEW RELEASE is movie-only; a movie-empty week uses an authentic Trending hero when server history supplies one and retains new TV cards.

Security boundary

Image public. Runtime private.

SMTP and API secrets never enter the image or service environment. Manager authentication is required and persistent state remains in a host-mounted mode-0700 data directory.

Path	Purpose	Treatment
`/var/db/tautweekly`	Configuration, Manager access, state, logs, output, assets, backups	Private; never attach publicly
`/usr/local/etc/tautweekly/tautweekly.env`	Image tag, timezone, identity, Manager bind and proxy policy	Root-owned mode 0600; no SMTP/API secrets
`/usr/local/etc/rc.d/tautweekly`	Service lifecycle	Root-owned executable

ssh -L 8787:127.0.0.1:8787 admin@example.com # open http://127.0.0.1:8787 locally

Optional public Tailscale Funnel

Run sudo tautweekly remote-access-authorize to enable the isolated official Linux userspace runtime inside Podman and complete its interactive sign-in. Then enable the Manager password lock and use Settings to enable and verify the exact Funnel. Manager remains non-root with no Podman socket, host executable, TUN device, network privilege, auth key, token, or arbitrary CLI input. Remote viewers need an ordinary browser, not Tailscale or a VPN.

AUTH

No default password and no token in logs

Retrieve the one-time token only with sudo tautweekly manager-bootstrap. For loss of access, manager-reset-access resets only authentication and preserves newsletter configuration, secrets, schedules, output, and backups.

Settings status, rc.d-owned lifecycle

Verify package, apply, verify runtime

Settings > Updates distinguishes the running application/image, FreeBSD package, and host adapter and reports the stable release, check history, sanitized failures, and release notes. Authenticated entry renders cached status first, then performs one bounded background refresh only when the last success is missing or at least 24 hours old and backoff permits. The main header Refresh reloads local status first and then starts that check only when the new typed status recommends it; it never waits for GitHub, while scoped refresh controls stay isolated. Successful results are reused for five minutes; Check now then explicitly refreshes the same endpoint. Current remains green, every non-current status gives the update card an attention glow, and the purple header SVG appears only after a successful check validates a newer running application. Normal health stays offline-capable. The web process cannot run sudo, Podman, or rc.d and instead provides sudo tautweekly update. The rc.d wrapper verifies the stable host package and internal manifest, preserves private data, and never enables unattended updates.

Private backup

sudo tautweekly backup

The wrapper stops the container briefly so state and configuration are captured consistently.

Check without restarting

sudo tautweekly check-update

The host package version and candidate image are compared without replacing the service.

Apply and validate

sudo tautweekly update # sign in and confirm Settings > Updates # run Verify, PreviewAll, and TestEmail

Observe

sudo service tautweekly status sudo podman logs --tail 200 tautweekly

Why the wrapper applies updates

Podman registry auto-update expects systemd-managed units. FreeBSD uses rc.d, so the package does not add the otherwise inert auto-update label or a hidden timer. The wrapper verifies the stable release package, refuses concurrent sends, checks container health and version, and restores the previous image when the candidate fails.

v14

One-time bridge from an older image-only wrapper

If sudo tautweekly help does not list manager-bootstrap, verify and extract the current stable FreeBSD Podman TAR archive in a temporary directory, then run sudo ./install-freebsd.sh --upgrade-and-update. The installer preserves /var/db/tautweekly and the existing environment file while bringing the rc.d adapter and image forward together.

DEL

Delete one obsolete config backup in Manager

Config > Configuration backups requires Confirm delete, permanently removes only the chosen backup, and leaves the live configuration unchanged.

BIN

Custom Podman location

The default is /usr/local/bin/podman. Set TAUTWEEKLY_PODMAN_BIN in the root-owned environment file only when an administrator-managed installation uses another path.

Keep local recovery on loopback.

Use 127.0.0.1 and SSH for setup/recovery; optional ordinary-browser remote access uses only the independently verified Funnel URL. The rc.d stop path gives an already-running newsletter delivery up to 30 minutes to drain after Manager access closes.

Basic troubleshooting

Check the boundary that failed

Start with Manager status and the rc.d/Podman lifecycle; keep credentials, generated output, and raw private logs out of public support reports.

Manager does not open

Run sudo service tautweekly status, confirm the Podman container is healthy, and use the documented SSH tunnel to host loopback.

Verify cannot reach a service

Test the saved Tautulli or Plex URL from the host and Podman network. Confirm the target listening address and firewall; container localhost means TautWeekly itself.

Preview is skipped or incomplete

Confirm one owner/admin sample, selected libraries, and metadata readiness. Save and verify again before regenerating all previews.

TestEmail or schedule fails

Keep production disabled. Recheck SMTP, sender permission, TestEmail, exclusions, timezone, and the saved revision, then inspect the sanitized Manager result and recent Podman logs.

Full troubleshooting Configuration reference