# OneStop Server for Ubuntu — 2.1.128-ubuntu.1 **Ubuntu Server release for Ubuntu 24.04 LTS, amd64/x86-64**, with systemd and x86-64-v2 CPU features. This package carries OneStop Server 2.1.128. Ubuntu 26.04, ARM, containers and non-Ubuntu distributions are not qualified by this release. Linux Desktop Sync 1.1.0 remains a separate preview client. This release includes the Windows server's seasonal spotlight, administrator-controlled household and remote-viewer separation, on-server transcription and English/Spanish/French subtitles, Mail scrolling and search fixes, and compact dark photo-editing controls. Mail retains full HTML and pictures when sizing is delayed; Music gives audio priority over background covers and reduces startup requests. New video uploads can transcribe automatically when the server is idle; scanning the existing library is opt-in. A single background worker pauses during use, uploads or playback and resumes after the idle interval. Original videos are retained and transcripts/checkpoints are encrypted. Speech and translation models are bundled and run locally. Android picture-in-picture and streaming fallback also require the matching Android app update. Back up existing installations before upgrading. Allow at least 4 GB RAM, disk space for the application/scanner plus your library, and internet access to Ubuntu package repositories, npm and ClamAV definition mirrors. Node 24.21.0 and Caddy 2.11.4 Linux runtimes are included and checked against official manifests. The installer installs Ubuntu ClamAV packages and resolves locked Linux npm dependencies; **this is not an offline installer**. It does not download or execute a remote shell script. ## Mail, Calendar and Tasks in 2.1.128 Android Mail 3.0.65 opens its encrypted saved inbox before server validation finishes after device unlock, removes the enforced native splash wait, and checks on opening and every 150 seconds while active. Closing an email does not start another check. A nonblocking checking-for-mail popup lasts at most three seconds; slower sync continues separately. The Android body cache holds up to 300 messages within 8 MiB. First use, uncached messages and remote images still require the network. Web cache remains in memory. Calendar 3.0.31 supports pull-down sync and its Sync button refreshes connected providers rather than only rereading saved events. Local items remain visible during a provider failure. Google Tasks is a separate optional read-only Google authorization; dated imported tasks appear in Calendar and OneStop Tasks 3.0.21. Grant access once in Connected calendars or Google Tasks settings and enable the Google Tasks API in the existing Google Cloud project if needed. Manage imported tasks in Google Tasks. Existing Calendar or mailbox access alone does not grant Tasks access. Tokens and the server-side task cache are encrypted and tenant scoped. Phone apps update separately through Google Play. Roku remains outside the Streaming Store and its review/publication hold is preserved. ## Install Extract the tar.gz, enter the extracted directory, and choose one mode: ```bash sudo bash install.sh # or, for a permanent public HTTPS hostname: sudo bash install.sh --mode public --origin https://files.example.com # or internal HTTPS using a private certificate authority: sudo bash install.sh --mode internal --origin https://files.example.internal ``` Local mode is accessible through the browser on the Ubuntu computer at http://localhost:3001 (or the next free port through 3010). It is not a remote HTTP service. For remote internet access use a permanent HTTPS hostname; trusted home-network HTTP setup is described below. Public DNS and inbound TCP 80/443 must reach this server. The installer does not change UFW, your router or an existing web server. Do not expose the backend or scanner ports. An existing service on 80/443 needs an administrator-planned proxy arrangement; do not terminate it to make setup pass. Internal clients need to trust the private root certificate in `/var/lib/onestop-proxy/certificates/pki/authorities/local/root.crt`; never distribute its private key. The script verifies packaged checksums, installs prerequisites, stages a separate application release and installs these units: - `onestop`: application, running as the unprivileged `onestop` account. - `onestop-scanner`: dedicated loopback ClamAV instance, running as Ubuntu's `clamav` account, using distribution-managed definitions. - `onestop-proxy`: optional HTTPS proxy, running as `onestop-proxy`. Ubuntu's `clamav-freshclam` service updates definitions; other installed ClamAV services are not stopped or repurposed. Scanner port 3310 is preferred; conflicts select another free port through 3399. Unavailable, stale or failed inspection blocks file operations. The service sandbox and Ubuntu AppArmor policy must allow the documented directories; investigate denial logs instead of disabling protection. ## First account and clients ```bash sudo cat /var/lib/onestop/setup-code.txt ``` Use this one-time installation code on the setup page to create the administrator. Only the administrator can create other accounts. Use existing browser credentials or registered passkeys afterwards. Register remote passkeys against the final HTTPS hostname. Windows Desktop Sync connects to the Ubuntu server through the same HTTPS pairing API. This Ubuntu-only package includes Windows Desktop Sync 2.1.8 and native Linux Desktop Sync 1.1.0 preview in Settings → Desktop & phones. The Linux client has a Tk desktop interface, bundled Linux Node runtime, desktop keyring credential storage, folder selection, pause/resume and optional login startup. It requires Ubuntu Desktop x64 with Python Tk and Secret Service; extract its download and follow its README. Closing its window stops sync; minimize it to continue. The Linux client has not yet been tested on Ubuntu. The existing Windows server installer is unchanged. Bundled Android APKs are direct-install test packages; Google Play availability depends on each app's review status. The full web workspace is provided: Files, Photos, document line spacing and page controls, workbook tabs, Mail, Calendar, Tasks, Contacts, sharing and quotas. The backup panel detects the server platform and shows the Ubuntu backup command. ## Paths, upgrades and logs - Application: `/opt/onestop/current`, with preserved releases under `/opt/onestop/releases`. - Configuration, database, setup code and encryption key: `/var/lib/onestop`. - Encrypted files: `/var/lib/onestop/storage`. A dedicated local disk can be mounted there before first setup. Keep the database on a local filesystem. Other storage paths require the permissions and service overrides described below. - Proxy configuration: `/var/lib/onestop-proxy/Caddyfile`; certificates: `/var/lib/onestop-proxy`. - Scanner configuration: `/etc/clamav/onestop.conf`. - Installation log: `/var/log/onestop-install/install.log`. ```bash sudo systemctl status onestop onestop-scanner onestop-proxy sudo journalctl -u onestop -u onestop-scanner -u onestop-proxy --since today sudo journalctl -u clamav-freshclam --since today ``` Upgrade by extracting a newer package and running its installer. Existing origin, port, configuration fields, data and encryption keys are retained. Only OneStop's named units are stopped. A failed upgrade retains the prior code releases and data, but services may remain stopped: inspect the log. There is no automatic database downgrade or rollback. A configuration snapshot is not a full data backup. ## Encrypted backup and restore In the web interface, the administrator can use Settings > Backup & access over HTTPS to create a password-encrypted snapshot without stopping OneStop. Download it to another device, keep the password separately, then remove the server copy to free space before the next backup. Linked external library originals need their own backups. Allow approximately twice the backup size plus database snapshot space. The command-line tools below remain available for recovery and maintenance. ```bash sudo bash /opt/onestop/current/tools/backup.sh create /mnt/backup/library.onebackup sudo bash /opt/onestop/current/tools/backup.sh restore /mnt/backup/library.onebackup /srv/onestop-restored ``` The tool prompts privately for a password of at least 16 characters. Backup stops the app/proxy for consistency and restarts the units it found running. Keep the backup and its password in separate protected locations. Restore authenticates the archive and writes only to a NEW directory, revoking restored sessions and device tokens. It does not overwrite the live library. Test restoration before relying on this deployment. Linux activation requires an administrator to place the restored library at the installed data path, correct its config storage path and ownership, and rerun the installer. Do not copy a Windows installation directory or config blindly into Linux; backup portability and migration need separate qualification. ```bash sudo bash /opt/onestop/current/tools/uninstall.sh --remove-services ``` Removal stops/removes only OneStop's units and retains all data, keys, certificates, code, OS accounts and Ubuntu packages. ## Validation limits The installer baseline was previously verified on an Ubuntu 24.04 x64 VM for fresh installation, repeated upgrades with identity/data retention, native image and database libraries, playback, scanner health, service restart, automatic startup after reboot, certificate-validated loopback HTTPS reverse proxy, and encrypted backup with isolated restoration. Those baseline checks are distinct from release-specific 2.1.128 validation, which is recorded separately. Ubuntu 26.04, public-domain ACME/DNS setup and recovery onto a clean VM were not qualified. Check application/scanner health and client access on your own deployment; retain off-machine backups. References: https://caddyserver.com/docs/running ; https://ubuntu.com/about/release-cycle ; https://nodejs.org/dist/v24.21.0/SHASUMS256.txt ## Help and support Open Help & FAQs from OneStop navigation, Settings or the sign-in page. Please submit a help request if you run into any issues at Greenlyz Helpdesk: https://helpdesk.greenlyz.com. Include the version and redacted error text; never include credentials, recovery keys or private documents. Account creation and password resets remain the responsibility of your own server administrator. Installer terms: interactive setup displays the terms and requires typing ACCEPT. For unattended setup, read app/client/dist/ONESTOP-TERMS.txt first and explicitly pass --accept-terms 2026-10-12.1. Acceptance receipts stay in /var/lib/onestop/terms-acceptance.jsonl; they are not transmitted to Greenlyz. ## Smart library performance self-test After installation, run `bash /opt/onestop/current/tools/self-test.sh --output ./OneStop-self-test`. Add `--samples /path/to/test/photos --count 10` for read-only sample testing. No personal library changes are made. Local models and English OCR are bundled; CPU-only processing uses one visual-analysis job and up to two model threads. Enable Smart server library in Photos settings. The Ubuntu server has passed the VM checks above; performance varies with hardware and library size. Linux Desktop Sync remains a preview and has not passed desktop GUI qualification. ## HTTPS certificates After installing in HTTPS mode, administrators can open Settings > HTTPS & certificates to enable Let's Encrypt automatic renewal or upload a PEM certificate chain and matching private key. Public DNS and reachable ports 80/443 are required for Let's Encrypt validation. Uploaded certificates need replacement before expiry. The admin socket is restricted to the OneStop service group and is not a network listener. ## Home-network HTTP This package supports `sudo bash install.sh --mode lan --origin http://192.168.1.20`. Use this server's reserved private IPv4 address. HTTP is unencrypted; use it only on your trusted LAN with password sign-in. Allow the address port (80 by default) only from your LAN in the firewall. Keep the backend/scanner ports private. This option was not included in the older 2.1.80 Ubuntu archive. ## Included updates This package uses the current 2.1.112 server and web source, including the expanded Video/Roku FAQ, TV show/season navigation and matching, LAN HTTP, prior Mail and Video fixes, and TLS management. It includes Windows Desktop Sync 2.1.8 and Linux Desktop Sync 1.1.0 with file/folder selections, verified move-to-server and transfer status icons. Existing installations retain their origin, storage and account data. Back up before upgrading. Physical Linux installation, reboot and recovery verification remain pending. The installer also downloads the pinned Linux video renderer from its upstream publisher and verifies its checksum and H.264/AAC support before switching the running service. Allow GitHub access during installation. If this check fails, installation stops rather than silently omitting video preparation. External storage and service permissions: The default systemd service permits writes only beneath /var/lib/onestop and /var/lib/onestop-proxy. Mounting a dedicated disk at /var/lib/onestop/storage before installation stays within this boundary. To use a different upload path, a Linux administrator must grant the onestop service account access and add that exact path to ReadWritePaths and RequiresMountsFor in a systemd override, then reload systemd and restart OneStop before selecting it in Settings. Do not disable the service sandbox or grant broad filesystem write access. ProtectHome also prevents reading libraries inside user home directories; place shared media on a dedicated accessible mount. The installer now checks all configured upload roots before upgrading; reconnect any missing drive first.