Publish curated LumaOps source from bd357aa0c9f2007ecaab2bb439c4917ba69f1e34

Validated workflow-only runner optimization. [skip ci]

.gitattributes

@@ -0,0 +1 @@
+*.sh text eol=lf

.gitea/workflows/managed-validation.yml

@@ -1,6 +1,8 @@
 name: Managed validation
 
 on:
+  push:
+    branches: [main]
   pull_request:
   workflow_dispatch:
     inputs:
@@ -23,7 +25,7 @@ jobs:
     name: full
     # Public fork code must never execute automatically on the private runner.
     if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
-    runs-on: ubuntu-latest
+    runs-on: linux-validation
     timeout-minutes: 40
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

README.md

@@ -1,76 +1,74 @@
 # LumaOps
 
-LumaOps brengt al je ondersteunde RGB-hardware samen in één lokale webinterface.
-Vanuit je browser beheer je apparaten, ruimtes, groepen, scènes, planningen, back-ups
-en diagnostiek. Er is geen cloudaccount nodig: de toepassing, database en
-hardware-engine draaien samen op je eigen Linux- of Unraid-server.
+<p align="center"><strong>Local control for the RGB devices you own.</strong></p>
+<p align="center"><a href="#interface-tour">Interface tour</a> · <a href="#what-it-does">Capabilities</a> · <a href="#quick-start">Quick start</a> · <a href="#architecture">Architecture</a> · <a href="#deployment-and-hardware">Deployment</a></p>
 
-> **Release status:** 0.1.0 is een release candidate. Begin met één apparaat en een
-> statische kleur op lage helderheid. RGB-protocollen zijn vaak reverse-engineered;
-> directe hardwarebesturing houdt altijd een beperkt risico in.
+LumaOps brings supported RGB hardware into one self-hosted web interface. Manage devices, rooms, groups, scenes, schedules, backups and diagnostics from a browser while the application, SQLite database and hardware engine stay on your Linux or Unraid server. No cloud account is required.
 
-## Wat je krijgt
+> **Release stage:** 0.1.0 is a release candidate. Start with one device and a low-brightness static colour. Some RGB protocols are reverse engineered; direct hardware control carries a bounded hardware risk.
 
-- één responsieve interface voor inventaris, bediening, scènes en automatiseringen;
-- lokale opslag in SQLite met controleerbare back-up en restore;
-- audit- en diagnostiekfuncties zonder ruwe secrets in exports;
-- OpenRGB 1.0rc3 als ingebedde hardware-engine;
-- een afgeschermde interne OpenRGB SDK-verbinding op `127.0.0.1:6742`;
-- expliciete USB-, HID- en I²C-device mappings in plaats van een privileged container.
+## Interface tour
 
-Native WLED- en Home Assistant-connectors zijn nog niet inbegrepen in 0.1.0.
+![LumaOps device inventory populated with synthetic RGB hardware](docs/screenshots/devices-demo.png)
 
-## Snel starten
+*Devices: inspect the inventory and control options before connecting hardware.*
 
-Vereisten: Docker Compose v2, Linux/Unraid x86_64 en toegang tot de benodigde
-hardware-device nodes.
+![LumaOps scenes view populated with synthetic lighting scenes](docs/screenshots/scenes-demo.png)
+
+*Scenes: organise reusable lighting presets for the devices and rooms you control.*
+
+Both images show the actual frontend in test mode with synthetic API responses. They contain no real devices, accounts or operational data; they do not demonstrate hardware compatibility. Some interface labels currently remain in Dutch even when English is selected.
+
+## What it does
+
+| Area | Capability |
+| --- | --- |
+| Device inventory | Discover supported hardware and organise devices by room or group. |
+| Lighting control | Apply colours, scenes and schedules through a responsive local UI. |
+| Operations | Inspect diagnostics and audit records; create and restore local backups. |
+| Hardware boundary | Map only required USB, HID and I²C devices into a non-privileged container. |
+
+LumaOps embeds **OpenRGB 1.0rc3** as the hardware engine. Its SDK connection stays on `127.0.0.1:6742` inside the container. Native WLED and Home Assistant connectors are not included in 0.1.0.
+
+## Quick start
+
+Requirements: Docker Compose v2, Linux or Unraid x86_64, and the device nodes needed by your actual hardware. Inspect `docker-compose.yml` before starting; remove or replace example `/dev/hidraw0` and `/dev/i2c-0` mappings if your host uses different devices.
 
 ```sh
 cp .env.example .env
-# Vervang LUMAOPS_ADMIN_TOKEN in .env door een unieke waarde:
-openssl rand -base64 32
+openssl rand -base64 32  # put the result in LUMAOPS_ADMIN_TOKEN in .env
 docker compose build
 docker compose up -d
 ```
 
-Open vervolgens `http://SERVER-IP:1223`, meld je aan met de ingestelde beheertoken
-en doorloop de setupwizard. De token is standaard verplicht omdat de webinterface
-op het LAN luistert. Gebruik `SECURE_COOKIES=true` zodra je LumaOps achter HTTPS
-plaatst; laat dit op `false` voor rechtstreekse HTTP-toegang op een vertrouwd LAN.
+Open `http://SERVER-IP:1223`, sign in with the token you configured, and complete the setup wizard. Authentication is required because the web interface listens on the LAN by default. Keep `SECURE_COOKIES=false` for direct HTTP on a trusted LAN; set it to `true` behind HTTPS.
 
-Map alleen de hardware die je werkelijk nodig hebt. Voor netwerkapparaten die
-broadcast, multicast of mDNS vereisen, staat een gedocumenteerde host-network
-override klaar:
+## First hardware session
+
+Discover the explicitly mapped device, confirm its identity and select a low-brightness static colour. Verify the result on the physical device before saving a scene or enabling a schedule. Expand to additional devices only after the first controller behaves as expected.
+
+If nothing appears, inspect device-node permissions and OpenRGB detection before changing container privileges. The screenshots use synthetic responses; they are an interface preview, not a compatibility list. Keep port `6742` private and use the authenticated LumaOps interface for remote control.
+
+## Architecture
+
+```mermaid
+flowchart LR
+    Browser[Browser UI] --> API[LumaOps application]
+    API --> DB[(SQLite and app data)]
+    API --> SDK[Loopback OpenRGB SDK]
+    SDK --> Hardware[Explicitly mapped devices]
+```
+
+The container has a read-only root filesystem, only bounded writable data and configuration paths, and no privileged mode. The OpenRGB SDK is **not authenticated or encrypted**: never publish port `6742`. Only map hardware nodes the application needs.
+
+## Deployment and hardware
+
+Persist `appdata/openrgb/`, `appdata/lumaops/`, `data/` and `logs/`, back up the application state, and test restore before relying on schedules. Use an HTTPS reverse proxy for access beyond a trusted LAN. Hardware that requires broadcast, multicast or mDNS can use the documented host-network override:
 
 ```sh
 docker compose -f docker-compose.yml -f docker/compose.host-network.yml up -d
 ```
 
-Publiceer poort `6742` nooit. Het OpenRGB SDK-protocol heeft zelf geen
-authenticatie of transportbeveiliging.
+For device permissions, supported controllers and Unraid setup, see [hardware access](docs/HARDWARE_ACCESS.md) and [Unraid deployment](docs/UNRAID_DEPLOYMENT.md). Operational references include [backup and restore](docs/BACKUP_AND_RESTORE.md), [security](docs/SECURITY.md), [troubleshooting](docs/TROUBLESHOOTING.md) and [testing](docs/TESTING.md).
 
-## Documentatie
-
-- [Unraid-installatie](docs/UNRAID_DEPLOYMENT.md)
-- [Hardwaretoegang](docs/HARDWARE_ACCESS.md)
-- [Back-up en herstel](docs/BACKUP_AND_RESTORE.md)
-- [Veiligheidsmodel](docs/SECURITY.md)
-- [Probleemoplossing](docs/TROUBLESHOOTING.md)
-- [Testen en verificatie](docs/TESTING.md)
-- [OpenRGB upstream synchroniseren](docs/OPENRGB_UPSTREAM_SYNC.md)
-- [Gedocumenteerde OpenRGB-corepatches](docs/CORE_PATCHES.md)
-- [Publieke releasegrens](docs/PUBLIC_RELEASE.md)
-
-De broncode is bewust als OpenRGB-fork opgebouwd. LumaOps staat onder `lumaops/`,
-de containerlaag onder `docker/` en projectdocumentatie onder `docs/`.
-
-## OpenRGB en licentie
-
-LumaOps bouwt op [OpenRGB](https://openrgb.org), ontwikkeld door de OpenRGB-
-community. De geïmporteerde 1.0rc3-bron, oorspronkelijke copyrightvermeldingen en
-licentieteksten blijven behouden. LumaOps en de gecombineerde distributie vallen
-onder **GPL-2.0-or-later**. Wie images of binaries verspreidt, moet de bijbehorende
-broncode en wijzigingen onder die licentie beschikbaar maken.
-
-Zie [LICENSE](LICENSE) voor de volledige licentietekst en [CONTRIBUTING.md](CONTRIBUTING.md)
-voor de upstream bijdragevoorwaarden.
+The product application is in `lumaops/`; container integration is in `docker/`; the imported OpenRGB source and changes remain identifiable. LumaOps builds on [OpenRGB](https://openrgb.org) and is distributed under **GPL-2.0-or-later**; see [LICENSE](LICENSE) and [CONTRIBUTING.md](CONTRIBUTING.md).

docker-compose.migration.yml

@@ -0,0 +1,45 @@
+# Append after docker-compose.yml and docker-compose.unraid.yml. These required
+# paths are verified cold clones, including the otherwise anonymous /config.
+# Pass MIGRATION_ENV_FILE as Compose --env-file to preserve interpolation parity.
+name: lumaops-managed
+services:
+  lumaops:
+    network_mode: ${MIGRATION_NETWORK:?exact original network required}
+    labels:
+      io.itworx.migration-attempt: ${MIGRATION_ATTEMPT:?journaled migration attempt required}
+    image: ${MIGRATION_IMAGE:?set an attempt-specific candidate image}
+    env_file:
+      - ${MIGRATION_ENV_FILE:?set the protected external runtime env file}
+    build:
+      labels:
+        org.opencontainers.image.source: jens/lumaops
+        org.opencontainers.image.revision: ${MIGRATION_SOURCE_REVISION:?full verified Git commit required}
+        org.opencontainers.image.source-tree: ${MIGRATION_SOURCE_TREE:?verified Git tree required}
+        org.opencontainers.image.version: ${MIGRATION_BUILD_ID:?broker build ID required}
+        org.opencontainers.image.created: ${MIGRATION_BUILD_DATE:?broker UTC build date required}
+    volumes:
+      - type: bind
+        source: ${MIGRATION_CONFIG_ROOT:?verified cold clone of anonymous config volume required}
+        target: /config
+        bind:
+          create_host_path: false
+      - type: bind
+        source: ${MIGRATION_OPENRGB_ROOT:?verified cold clone of openrgb configuration required}
+        target: /config/openrgb
+        bind:
+          create_host_path: false
+      - type: bind
+        source: ${MIGRATION_LUMA_CONFIG_ROOT:?verified cold clone of lumaops configuration required}
+        target: /config/lumaops
+        bind:
+          create_host_path: false
+      - type: bind
+        source: ${MIGRATION_DATA_ROOT:?verified cold clone of application data required}
+        target: /data
+        bind:
+          create_host_path: false
+      - type: bind
+        source: ${MIGRATION_LOGS_ROOT:?verified cold clone of logs required}
+        target: /logs
+        bind:
+          create_host_path: false

docs/LEGACY_DEPLOYMENT_MIGRATION.md

@@ -0,0 +1,24 @@
+# Controlled legacy deployment migration
+
+`docker-compose.migration.yml` is an optional operator override after the base and
+Unraid Compose files; it does not alter the default deployment. Follow the explicit
+ProjectBrain `scripts/legacy-deployment-migration/` transaction, not a normal retry.
+
+Every writable mount must be cold-cloned after the original container stops:
+the anonymous `/config` volume, `/config/openrgb`, `/config/lumaops`, `/data` and
+`/logs`. Required migration variables point only to those verified clones.
+Original data, immutable image and container are retained for rollback.
+
+The override requires immutable build metadata, an attempt-specific image and
+container ownership label. Missing variables fail closed; missing mount sources
+are not silently created. Preserve runtime environment and device/security settings.
+Commit the new broker configuration only after verifying health, HTTP behavior
+and the actual receipt. Never fabricate the old image's unknown source revision.
+
+Real offline Compose rendering tests verify merged mounts and missing-variable
+rejection. This file alone does not prove a completed production migration.
+
+`MIGRATION_NETWORK` is mandatory and must preserve the inspected existing
+`lumaops_default` network, overriding the normal Unraid bridge setting only for
+this migration. Device bindings, capabilities, root filesystem protection,
+security options and tmpfs are validated against the original before cutover.

docs/screenshots/README.md

@@ -0,0 +1,5 @@
+# Image provenance
+
+`devices-demo.png` was captured from the real LumaOps Vite frontend at 1440 × 900 pixels. A local browser intercepted the API and supplied three explicitly synthetic RGB devices in test mode. The screenshot contains no real hardware, account or infrastructure data. It illustrates the interface; it does not prove hardware integration or deployment readiness.
+
+`scenes-demo.png` was captured from the same frontend and browser session at 1440 × 900 pixels. The intercepted API supplied three synthetic lighting scenes in test mode. The image illustrates scene management; no physical lights were controlled.

scripts/export-public-source.sh

@@ -27,6 +27,7 @@ git -C "$ROOT_DIR" archive --format=tar HEAD | tar -xf - -C "$OUTPUT_DIR"
 
 # Production deployment dispatch belongs to the private operations repository.
 rm -f "$OUTPUT_DIR/.gitea/workflows/unraid-deploy.yml"
+rm -f "$OUTPUT_DIR/.gitea/workflows/public-source-sync.yml"
 
 for forbidden in \
     '.env' '*.pem' '*.key' '*.p12' '*.pfx' '*.db' '*.sqlite' '*.sqlite3' \

scripts/openrgb-upstream-guard.sh

@@ -41,7 +41,7 @@ declare -a UNEXPECTED_FILES=()
 for file in "${CHANGED_FILES[@]}"; do
     allowed=0
     case "$file" in
-        .dockerignore|.env.example|.gitleaks.toml|.gitignore|Dockerfile|README.md|SECURITY.md|docker-compose*.yml|docker-compose*.yaml|startup/main_FreeBSD_Linux_MacOS.cpp|ResourceManager.cpp|ResourceManager.h|.github/*|.gitea/*)
+        .dockerignore|.env.example|.gitattributes|.gitleaks.toml|.gitignore|Dockerfile|PUBLIC-SOURCE-MANIFEST.sha256|README.md|SECURITY.md|docker-compose*.yml|docker-compose*.yaml|startup/main_FreeBSD_Linux_MacOS.cpp|ResourceManager.cpp|ResourceManager.h|.github/*|.gitea/*)
             allowed=1
             ;;
         docs/*|lumaops/*|docker/*|scripts/*)