Files

T

Worph 39f82e1f96 Import the MetaMesh app family from Worph/AppStore

23 apps (MetaCore, the library/network/client tiers and 13 MetaFeeder*)
move out of the general-purpose Worph/AppStore into their own store so the
MetaMesh family releases on its own cadence.

- asset URLs repointed to cdn.jsdelivr.net/gh/Worph/MetaAppStore@main
- store scaffolding added (category/recommend/featured lists, licence,
  contributing, gitattributes)
- psd-source/meta-icons-v2 icon generator follows the apps

MetaMCP stays in Worph/AppStore: it is third-party metatool-ai software,
not part of MetaMesh.

2026-09-13 16:18:29 +00:00

2.7 KiB

Raw Blame History

MetaStremio — Rationale

What deviation / exception is being requested

The addon endpoint is served without an authentication gate — no AppShield sidecar, the Caddy labels point straight at the container.
metastremio runs user: 0:0.
It mounts /DATA/AppData/metacore/meta-core — another app's AppData directory.

Why it is necessary

A Stremio addon is consumed by the Stremio client, not by a browser. The client fetches /manifest.json and the catalog/stream endpoints over plain HTTP with no cookie jar, no redirect handling and no way to complete an interactive OIDC login. Putting AppShield in front makes the addon uninstallable in Stremio: the client receives the Authelia login page instead of JSON and reports the addon as invalid. This is the same class of exception the guidelines allow for a public endpoint.
MetaStremio writes its service registration into /meta-core/services/, a directory created and owned by MetaCore's root-running container.
/meta-core is the shared leader-election and service-discovery directory. MetaCore is a hard prerequisite of this app.

Security mitigations in place

The addon URL is unguessable in practice: it is metastremio-<user>.<domain>, a per-user hostname on the user's own PCS.
The container mounts no user media. Under Architecture V3 it has no /files mounts at all; every byte it serves is fetched over WebDAV from MetaCore and is bounded by what MetaCore exposes.
It writes only to /DATA/AppData/metastremio/cache/ (transcoding segments), declared in x-compose-app.folders.
cpu_shares: 50; image tag pinned.

Alternatives considered and rejected

AppShield in front of everything. Breaks the app completely — see above.
AppShield with ALLOWED_PATHS for the addon routes. With AUTH_HASH inert under Maison, an allowed path is reachable with no credential at all, so this is the current arrangement with extra moving parts and a misleading "it's protected" appearance.
OAUTH_RESOURCE (OAuth 2.1 Bearer) on the addon paths. The correct answer for machine clients in general, but Stremio has no OAuth support; it would still break.
A shared-secret path prefix in the manifest URL. Considered as a follow-up; it moves the secret into a URL the user pastes around, and Stremio surfaces addon URLs in its UI.

Data protection

MetaStremio stores no user data of its own beyond a transcoding cache that is safe to delete. Because it is a public endpoint, the user should treat the addon URL as the access control: anyone with it can browse the catalog the user's own MetaCore exposes. This is stated in tips.before_install.

2.7 KiB Raw Blame History