I’ve been working on a new plugin for post notifications. A few of you have responded to the initial email, so yay! Hopefully, this will facilitate notifications of new posts! You can even sign up to get notifications without making an account!
Get new post notifications by email
Enter your email address and confirm the message we send you.
In other plugin news, I have also set up a new plugin that has been live testing for a while and has proven effective at keeping spam bots away from the site, so there is that!
Over 2,100 bot attempts and counting blocked!
I have also been working on a maintenance tracking app that integrates with Nextcloud. That is a replacement for an Android app that I once had, but which is no longer supported. The goal of this app is to, among other things, track vehicle repairs and mileage, but also remind on other tasks around the house.
Jarek and I had a somewhat slow weekend selling popcorn for Scouts – the Blue Angles were in town and the Air Show put the kibosh on our foot traffic. At any rate, we are down to 14 bags of popcorn and then we are done with this fundraiser for the year. So far, Jarek has sold over $4,000 worth of popcorn!
I also have another project in the works, a distributed computing project using the computers here at the house. More on that later once I get it fully working.
Tomorrow I will get back to making our regularly scheduled catch up posts!
I wanted to do a dear diary post before too much more time goes past. I’ve been working on several projects that have been published, such as Activity Relay and Activity Relay Directory, and I have a couple WordPress plugins that about ready to be published as well.
With feedback from my parents, who are on a slower internet connection, I used AI to build a plugin that renders raw video into much more streaming friendly formats – the ArgentWolf Video Processor (AWVP) plugin. Version 1.0 does all of the rendering on server, so for if you are self hosted like myself, it’s nice to use your hardware to do the rendering and it doesn’t require any API tokens or subscriptions.
The next level, and continuing my efforts to explore the Fediverse (a term that refers to open, free, and distributed social media), is leveraging PeerTube. I set up a PeerTube instance at https://video.argentwolf.org, where you can check out recent videos that I’ve uploaded to the blog. PeerTube has a couple nice features, such as automatic captions, transcoding, better streaming options, and the ability to use ‘runners’ to do these jobs. Runners are clients on various computers that do a job and part of the processing, and now that we have a couple additional computers around for the kids, I’ve set up runners on their workstations, so when they are idle, which is most of the time, they can be useful for other things.
You will notice that the videos here recently are served up a bit differently. They are embedded from the PeerTube instance, and not WordPress’ native video interface. AWVP 2.0 allows me to do all my video uploads through WordPress, configure the metadata, and send it to the runners for transcoding without leaving WordPress’s editor interface. AWVP 2.0 is in the Release Candidate (RC) status right now, and as I get through my backlog of posts and test it a bit more, I expect to publish the new version soon, perhaps this weekend or next week.
Work continues on another plugin, Argent Wolf Post Notifier, which will fill a gap I have of properly notifying users of new posts, again in a proper self hosted manner without external services.
One of the annoying things about WordPress, and enabling user registration is the spam bots hammmering your site. So, time for another plugin! Argent Wolf Access Guard is designed to thwart these bot attempts. No captchas or other things necessary. So far, it has blocked nearly 1,000 attempts to create a spam account on the site. This protection also leverages my Argent Wolf Email Verification Plugin, which, if a spam account does register, it is prevented from fully activating the user until a verification email is clicked. And since they don’t use real email addresses, they never verify, and the accounts are deleted after seven days.
This will also tie into the over watch program, Argent Sentinel (not a WordPress Plugin), which can block the offending IPs at the firewall automatically on configured servers. This is a self learning and protecting methodology across all protected hosts to defend against malicious IPs/hosts.
The home network continues to grow and be refined. I have set the kids up with workstations on Ubuntu connected to a SAMBA domain controller, and leveraging ZFS, they can log into any computer and have their profile and home directory synchronized via ZFS snapshots. The practical effect is that they can go to any workstation, log in, and it is transparent to them which computer they are on, compared to my experience with Windows machines where the profiles didn’t truly roam and when you saved things on a computer, they didn’t necessarily follow you unless you saved it on your embarrassingly small network drive.
I’ve also gotten into the Minecraft hosting business. A client wanted a Minecraft server set up for their group, so I had some extra capacity on the server, and set that up for them. I also set up a family Minecraft server using Pterodactyl and Wings. Pterodactyl is the control plane and Wings are the ‘nodes’ that run the server. I put the family Minecraft server on one of the workstations, and that has been working out well. That way the kids can leverage what I set up for the infrastructure, without impacting the server. I bought the workstations bit higher spec just for this purpose.
With the software releases I’ve been doing, I make announcement posts. When the posts on the blog are reshared by my Friendica (https://friendica.argentwolf.org/profile/alan/conversations), the server gets a lot of traffic in a big burst. Friendica (and PHP) didn’t handle that so well, so yesterday I, with the help of my AI tech support, set up caching on Nginx which has greatly reduced that problem. We had to make sure that the caching only affected some of the Friendica endpoints, and not the other parts which should not be cached. This allowed me to unblock the GoToSocial clients which, for whatever reason, really liked to hammer the instance and previously caused PHP timeouts/overloads.
GitHub had an outage on their runners a while back, so not to be deterred, I now have my own Forgejo instance (a self hosted GitHub replacement), which I am slowly migrating all of the projects over to it. One of the nice things, is that like PeerTube, it uses runners to do the jobs and can take advantage of the additional available workstations to quickly process jobs in parallel and much faster than what is provided by GitHub (for free, anyway) to do the various code actions and build the packages.
I’ve also taken to making a couple tweaked docker images for Jellyfin. Jellyfin is the media server software that allows us to stream our videos and music to devices. There are two issues that have come up. One is that with a relatively large library, the SQLite version of Jellyfin tends to crash and get hung up, which is inconvenient and it only does that when I’m away and the wife needs it to work so the kids will leave her alone. Switching to the experimental PostgreSQL edition, a much more robust database back end, fixed that problem. FFMPEG, which Jellyfin uses, recently had a security vulnerability, which while fixed in newer editions of Jellyfin is still present in the operational PostgreSQL editions. So I made some images that use a fixed (I’d say patched, but we just disabled the offending codec which caused the remote code execution CVE). Then there is a bug having to do with time precision, where PostgreSQL is more precise than the SQLite version, resulting in every library scan to reflect several thousand updates when nothing actually changed. This was fixed in later editions, 12.2, but that version isn’t ready yet with the PostgreSQL integration. So I backported that fix to 10.11.11 and built an image with all the fixes. Those can be found here: https://github.com/thystra/jellyfin-security-images The awsec2 images currently have those fixes in them.
I have a couple other projects in work – a maintenance tracking app for Nextcloud and a home school management program, but those are still early. Right now I’m focusing on finishing the infrastructure build out and protective measures for the spam bots and performance tuning.
So, the work continues and I’m now working through my backlog of posts while getting through these infrastructure updates, here at the homelab of Theseus. Between the homelab, homeschool, homesteading, sports, Scouts, and other activities, dull moments are rare around here!
That’s about it for now. My journaling time is done, and I have a bunch of chores and things to do! Until next time!
Activity Relay 3.1.0 and Activity Relay Directory 1.3.0 are released!
Activity Relay 3.1.0 and Activity Relay Directory 1.3.0 are released. This synchronized release brings together some notable improvements in the heartbeat protocol. These enhancements allow a Relay operator to push stats and information to Directory servers automatically, keeping information up to date.
Live installations of the Relay and Directory may be found at:
On the Relay itself, the policy information will be presented on the default home page:
On the Directory, this information will be reflected as well with time stamps on when it was received and last checked for health by the Directory:
Other relays may be manually added to the Directory by the Directory operator/Admin. I have manually collected a list of Fediverse relays and populated my Directory installation with information about them. These sites are not automatically updated with regard to policy, but are verified as reachable by the Directory server.
Relays that are restricted (Approval Required) or closed to sign ups will appear as such on the Directory. Relays that go offline or are otherwise unreachable will appear in the offline list, eventually moving to the Graveyard after 30 days of offline time. Offline relays can be added the the Directory, but they will not become visible on the index until they pass an online check.
As always, if you want to make your own front facing website, you can disable the built in pages and use your own endpoints!
Comments, feedback, and bug reports are all welcome! Repo links below, available in both .deb and docker images. If you found these useful, please consider a tip to my Ko-fi to support further development! Thank you!
Activity-Relay Directory 1.2 expands relay discovery, long-term availability tracking, and the public-facing Directory while preserving the authenticated V1 lifecycle protocol and the frozen /v1/relays compatibility API.
Highlights
More resilient relay discovery and bulk imports
Retention and automatic retry of unavailable relay candidates
ActivityStreams Group relay actor support
Four public operational relay tiers
30-day transition to the Graveyard tier
Aggregate online, offline, and pending-verification counts on the public-facing Directory page
Local tier-scoped exports and public plain-text relay downloads
Automatic recovery of previously unavailable relays
Debian upgrade handling that reloads systemd definitions without automatically restarting an active Directory
ARD 1.3 is mapped out and will be paired with a synchronized release of Activity Relay server. The 1.3 edition will allow for additional information, e.g. notes, state, and filtering, to be provided by Relay server operators rather than manually input by the Directory server operator/admin.
Activity-Relay 3.0.1 is a focused reliability release for follower-state handling and relay fan-out.
Fixed
Prevent stale mutual-follow responses from recreating incomplete Redis follower records.
Validate follower state before persistence.
Ignore malformed persisted follower records when loading relay state.
Isolate invalid or unplannable delivery targets so one bad receiver cannot abort healthy fan-out.
Keep queue reservations and remaining-delivery counts aligned with deliveries actually planned.
Harden manual follower acceptance ordering.
Update Forgejo container/release CI for Debian Trixie’s split Docker client packages.
No configuration or data migration is required.
The 3.0.1 candidate was production-tested on relay.argentwolf.org, including real WordPress fan-out to healthy Friendica and Mastodon receivers while an independently failing receiver continued through its isolated retry path.
Container: ghcr.io/thystra/activity-relay:3.0.1
See docs/releases/v3.0.1.md and CHANGELOG.md for complete details.
The attached files are the exact canonical artifacts produced and accepted by the Forgejo release workflow.
I’m pleased to announce the release of Jellyfin Hotcache. This is a helper for Jellyfin that I built to address a fairly simple problem: my kids love to watch the same media over and over, but I’d rather they not spin up the NAS drives every time they want to watch the same episode again.
Jellyfin Hotcache identifies frequently and recently played media and stages a copy on a specified cache drive—ideally an SSD or NVMe device. It preserves the original media on the slower storage, renames that copy for safekeeping, and replaces Jellyfin’s original media path with a symlink pointing to the cached copy.
This helps reduce unnecessary spin-ups of the media drives and can improve playback startup and access times for frequently watched content.
Hotcache is packaged for Debian/Ubuntu-compatible Linux systems. It supports Jellyfin playback history stored in both SQLite and PostgreSQL, and works with both bare-metal and containerized Jellyfin installations. Container installations require the cache directory to be mounted into Jellyfin at the same absolute path so that Jellyfin can follow the cache symlinks.
Hardened Jellyfin Docker Images
Along with Hotcache, I’ve also put together some updated and hardened Jellyfin 10.11.11 Docker images.
These images address CVE-2026-8461, an FFmpeg MagicYUV decoder vulnerability that can result in an out-of-bounds write and potentially remote code execution when a malicious media file is processed.
The hardened Jellyfin 10.11.11 images use a custom Jellyfin FFmpeg 7.1.4 build with the affected MagicYUV decoder disabled. This mitigates CVE-2026-8461 while retaining Jellyfin’s expected hardware-acceleration support.
I’ve also repackaged the Jellyfin PostgreSQL images with separate PostgreSQL 17 and PostgreSQL 18 client-tool variants. Jellyfin’s PostgreSQL backup functionality relies on tools such as pg_dump, and pg_dump cannot back up a PostgreSQL server running a newer major version than the client itself. After I upgraded my database server to PostgreSQL 18, the older client tools in the Jellyfin image could no longer perform the backup.
The resulting images provide explicit PG17 and PG18 variants and are available for both amd64 and arm64:
Jellyfin 12.0 and later currently use Jellyfin FFmpeg 8.1.2 or newer, which contains the upstream fix for CVE-2026-8461, so these hardened FFmpeg images are primarily intended for users remaining on Jellyfin 10.11.11.
If you find any of this useful, I appreciate any tips at my Ko-fi!!
I’ve made and released a couple WordPress Plugins. I went looking for solutions to these problems, but, not finding any, decided to do it myself. After all, if not me, then who?
Email verification. Pretty basic, but most if not all of the plugins that I found were gateways to services that would try to sell you access to an API to figure out if an email was valid or not. They didn’t actually have the user verify their email. So, now we have a plugin that does just that!
For videos, an issue came up when I posted a video: family across the country on a slower connection mentioned that it did not stream very well. Apparently posting raw cell phone video, while very high quality, is too high for the internet. So, now introducing the ArgentWolf Video Processor plugin. This plugin processes your videos on server, no APIs, and implements HLS, which allows your browser or devices to choose the appropriate resolutions for streaming based on your Internet connection.
And while yes, you can render it all before hand, that is a much more unfriendly workflow. This, all you have to do is load and go. Great for self hosted sites or a VPS, shared hosting may be more of a mixed bag depending on the hosting policies. Version 2.0 is in the works with PeerTube support, which will offload the processing to a PeerTube instance instead of the blog host!
I am pleased to announce that Activity Relay 3.0 and Activity Relay Directory 1.0 are released! This brings a conclusion to this passion project. I’ve been dabbling in the Fediverse for a while, and have, for some years, wanted to run my own relay. Of course, there were never very many good relay packages, and of what there were, were incomplete or incompatible with Friendica (or WordPress!, which was what I wanted to use as my platform of choice.
So, now having access to AI, I forked the Yukimochi Activity Relay and spent some time directing AI to fix and modernize the Relay software. 3.0 now supports RFC 9421 HTTP Message Signatures and RFC 9530 Digest Fields – a big thanks to @julian for turning me onto that. A docker image and a .deb package is provided. An optional front end website is also part of it, which can be disabled or otherwise configured with your own custom front end for the statistics.
The most significant addition to this is the link to Activity Relay Directory (ARD). Once I had my relay server up and running, I wanted to advertise it. I messaged the 4 or 5 current list of relays that I could find. I never heard back from any of them, if they even had a way to message them. So how does one advertise a Relay? Thus, the Directory was born.
Relay operators can opt in to have their Relay auto report to a Directory and indicate that it is up. Directory operators can set their Directory to open or closed, and no manual intervention is required. An example can be seen at https://directory.argentwolf.org. Other Relay implementations can use the Protocol to talk to the Directory Server as well.
I am also committing to maintain a list where Relay operators can find other Directories to list their Relay in.
Of course, as the human in charge, all faults are mine. So if there is an issue, please log a bug against the appropriate package. If you have an instance, I’d love to see you connect to the relay. If you host a Relay, please try the directory server.
This was something I’ve wanted for a while, and I’m happy to give back to the Fediverse community.
