FreeBSD · Podman · rc.d

Native lifecycle.
Maintained container.

Run the published TautWeekly OCI application through FreeBSD's documented Linux-container support, control it with service(8), keep private state under /var/db, and expose previews only through localhost.

FreeBSD 15.1+amd64PodmanLinux emulationBeta

Start installation Download release

freebsd — controlled launch

$ sudo ./install-freebsd.sh
✓ Linux emulation ready
✓ Podman service ready
✓ rc.d integration installed

$ sudo tautweekly verify
✓ Tautulli · SMTP · storage

$ sudo tautweekly send-test-all
→ TestEmail only ▋

rc.dFreeBSD service lifecycle

OCIsame maintained renderer

127.0.0.1default preview bind

0credentials in image or environment

Before installation

A clear compatibility boundary

This first FreeBSD track targets the host combination documented and testable today. It does not claim native PowerShell support.

FreeBSD host

Use FreeBSD 15.1 or newer on amd64 with a supported package repository and root access.

Linux container path

The installer enables FreeBSD Linux emulation and the Podman service, then verifies the public OCI image can be pulled.

Network boundary

Allow outbound access to GHCR, Tautulli, SMTP STARTTLS, and any optional Plex metadata endpoint.

Why this track is beta

Static scripts, archive integrity, and the Linux OCI payload run in GitHub CI, but GitHub-hosted runners do not boot this FreeBSD service. Complete preview and TestEmail acceptance on the target host before scheduling.

Installation

Inspect every host change

The installer may add Podman with pkg, enables the Linux and Podman services, installs one rc.d service, and preserves existing settings and data.

1. Compare the published checksum

grep 'TautWeekly-freebsd-podman.tar.gz' SHA256SUMS.txt sha256 -r TautWeekly-freebsd-podman.tar.gz

2. Extract and install

tar -xzf TautWeekly-freebsd-podman.tar.gz cd TautWeekly-freebsd-podman sudo ./install-freebsd.sh sudo tautweekly setup sudo tautweekly verify

Acceptance gate

Observe before delivery

Excluded users remain usable as sample data for previews and TestEmail, but scheduled and confirmed production delivery omits them.

Configure

Write secrets only inside private container data.

Verify

Check API, SMTP, files, timezone, and schedule.

Preview

Render all deterministic states without mail.

TestEmail

Validate MIME in the actual mail client.

Opt in

Enable the scheduler after roster review.

sudo tautweekly list-users sudo tautweekly exclude-users sudo tautweekly preview-all sudo tautweekly send-test-all sudo tautweekly schedule-status # only after review: sudo tautweekly schedule-enable

Security boundary

Image public. Runtime private.

SMTP and API secrets never enter the image or service environment. They remain in a host-mounted mode-0700 data directory.

Path	Purpose	Treatment
`/var/db/tautweekly`	Configuration, state, logs, output, assets, backups	Private; never attach publicly
`/usr/local/etc/tautweekly/tautweekly.env`	Image tag, timezone, identity, preview bind	Root-owned mode 0600; no SMTP/API secrets
`/usr/local/etc/rc.d/tautweekly`	Service lifecycle	Root-owned executable

ssh -L 8787:127.0.0.1:8787 admin@example.com # open http://127.0.0.1:8787 locally

Lifecycle

Back up, pin, test

Keep data independent of the image. Pin a version tag for deterministic production and complete the acceptance gate after every update.

Private backup

sudo tautweekly backup

The wrapper stops the container briefly so state and configuration are captured consistently.

Pull and restart

sudo tautweekly update sudo tautweekly verify sudo tautweekly send-test-all

Observe

sudo service tautweekly status sudo podman logs --tail 200 tautweekly

Do not use a public preview bind casually.

The preview service has no built-in authentication. Keep 127.0.0.1 and use SSH, or place an authenticated TLS reverse proxy in front of it.

Native lifecycle.Maintained container.