docs/homarr-external-coverage-plan.md
Rama main · réplica de lectura del repositorio original.
# Homarr coverage outside the Catalog
Decision-ready research for [#263](https://github.com/ajnart/selfhost-skills/issues/263), **11 October 2026**. Recommendations below are proposals, not approved implementation, installation, account creation, licence purchases or additional tickets. No person's Project, live Homarr configuration, credentials or profiles were inspected.
## Recommendation
Preserve the separate **39 shipped-App integration** work. Expand the Catalog selectively: start with **Miniflux, Homebox, Mealie, Spoolman and Komga**, one App and one useful read-only Homarr widget per independently accepted slice. Keep appliances and existing deployment/network controllers external; keep legacy products, privileged collectors and provider-dependent Apps manual until their specific gates are met. Plan an explicit external-connection boundary before automating any of those connections. Neither generic tiles nor successful connection tests establish useful-widget acceptance.
The classification is **29 container-capable products, 11 external/manual connections, one feed**, plus **three separate infrastructure/discovery guides outside the 41**. Of the 29, **26 are possible new Apps**; Jellyseerr, Overseerr and Readarr are existing-instance-only recommendations. A container route is not maintained-image compatibility, automatic Setup or an approved default. External/manual includes three promotion-blocked products: Anchor, Plant-it and Syncthing Relay.
## Revalidated baseline and method
Before publication, `origin/main` advanced to **`2bd01088e33d19f81dd85e41ec74c47a13177d45`** with absent-peer scheduling fixes. Revalidation found no changes to `internal/catalog` or `internal/apps/homarr` against the inventory snapshot below; **93 / 47 / 41 counts and external-connection limitations remain unchanged**. The report branch was rebased onto that main revision; scheduling citations below retain their recorded source revision.
| Source | Revision and finding |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Canonical repository | Verified private `ajnart/selfhost-skills`; fetched `origin/main` = `5aafb4c1833fd4cd9caf0f7beaac31e625aafe22`. [Catalog assembly][catalog], generated and batch registrations import 91 App packages; `arr` contributes three Apps: **93 Apps**. |
| Latest Homarr release | GitHub latest release is **v2.4.1**, published `2026-10-10T11:36:42Z`; source SHA **`ebbd4876d25a51151444a009ab596e1154d62880`**. [Registry][registry] declares **89 kinds**, including development Mock: **88 real kinds**. |
| Exact comparison | Compare registered App IDs with registry keys using explicit case/name aliases, not branding. **47 matches; 88 − 47 = 41 outside**. Current [Homarr targets][targets] declare eight native integrations and one tile-only Link; no external-kind automation. |
| Historical TypeScript | Committed source **`56f3fbf6c972fa507e5cae7673dc730438714855`**, not dirty working files. Enumerated all committed `apps/*/homarr.json`: among these 41, **only Coolify has a native descriptor**. The old [coverage list][legacy-list] names UniFi as `externalOnly`, not implemented native wiring. Every other row has **no descriptor in that snapshot**. This is not a historical runtime-success claim. |
| Documentation | All 41 Homarr guide sources and three infrastructure guides read at the same Homarr release SHA. Row name links cite those immutable MDX files. Installation sources are first-party README/docs read on the date above; mutable installation guidance is not a pinned tested App version. Context7 was already exhausted, so primary sources were used directly. |
For reproduction, enumerate imports in non-test `internal/catalog/*.go`, extract `Info.ID` values from those packages, then compare with top-level `integrationDefs` keys excluding `mock`. Explicit aliases are `adGuardHome→adguard-home`, `archiveTeamWarrior→archive-team-warrior`, `dashDot→dashdot`, `homeAssistant→home-assistant`, `nzbGet→nzbget`, `paperlessNgx→paperless-ngx`, `peaNut→peanut`, `piHole→pihole`, `qBittorrent→qbittorrent`, `sabNzbd→sabnzbd`, `speedtestTracker→speedtest-tracker`, `technitiumDns→technitium-dns`, `uptimeKuma→uptime-kuma`. Syncthing ≠ Syncthing Relay; Ollama ≠ llama.cpp; FreshRSS ≠ Miniflux; shipped Seerr ≠ verified Jellyseerr/Overseerr support.
## Matrix conventions
- **C**: documented container route; **first/next/gated** are possible new Apps, **defer** means existing instances only. **E**: connect an existing external instance manually by default; **F**: feed, never an App. Priorities are proposals, not facts about shipping.
- Every connection needs a Homarr integration ID. **S** means native `stats`: select meaningful metrics and unique entry `id`, `integrationId`, `metric`; an empty Stats widget is not coverage. The [widget map][widgets] admits Stats for every non-iCal kind, but the [provider registry][stats-providers] and [existing adapters][stats-existing] have **no native metrics for Bindery or Wazuh**; the [Stats resolver][stats-resolver] returns an empty list for them. In those two rows S means nominal compatibility only, **not a useful native Stats widget**. Other widget names are exact upstream kinds. Unless named, there is no extra object-ID selector beyond the integration and widget options. [Stats schema][stats].
- **ACL?** means the verified guide establishes the credential type/route but **does not establish a narrower minimum privilege or read-only token**. Do not invent a scope, call an account-wide key least-privilege, or silently substitute administrator credentials. Any unattended credential acquisition remains unverified unless explicitly stated.
- All Apps still need a pinned image/architecture and licence review, persistent-data/Backup design and own Setup acceptance before Catalog inclusion. A row without a special paid/hardware gate is not a certification that every edition, architecture or use is unrestricted. Homarr-auth requirements and install feasibility are separate evidence.
### Container-capable products: 26 possible new Apps and three legacy-only products
Each row cites its pinned Homarr guide for authentication/data semantics and its install source for feasibility or limitations. Legacy native descriptors: **none in all 29 rows**.
| Kind / evidence | Proposed scope | Verified authentication route and minimum permission | Useful native widget / selectors | Installation limits and genuine gates |
| ------------------------------------------------------------------------------------------ | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Autobrr][h-autobrr] `autobrr`; [install][i-autobrr] | C · next | Settings → API Keys; `apiKey`; ACL? | S: release/action counters | Configure user's indexers/download targets separately; Homarr does not provision tracker accounts. |
| [Bindery][h-bindery] `bindery`; [install][i-bindery] | C · next | Settings/general (`/settings?tab=general` in registry); per-account `apiKey`, `X-Api-Key`; ACL? | `mediaMissing`; no native S metrics | First-run admin route documented upstream; media/download paths and indexer accounts are separate Setup. Metadata providers may require user-supplied keys; not permission to obtain them. |
| [FileFlows][h-fileflows] `fileflows`; [install][i-fileflows], [licensing][fileflows-price] | C · gated | No Homarr secret: unauthenticated `GET /api/status`, not its agent access token | S: queued/processing/processed/time | CPU, scratch disk and media mounts; GPU optional. Free tier is personal-only and limited; organizational use requires commercial licence. Keep Docker Siblings/socket and paid SSO outside default scope. |
| [Jackett][h-jackett] `jackett`; [install][i-jackett] | C · next | Dashboard API key; ACL? | `indexerManager`, S: configured count; no health-history metric | Existing Prowlarr overlaps; user selects explicitly. “Test all” performs Torznab searches, may be rejected by query-dependent indexers; not a zero-side-effect acceptance default. |
| [Jellyseerr][h-jellyseerr] `jellyseerr`; [source][i-jellyseerr] | C · defer legacy installation | Settings API key; ACL? | `mediaRequests-requestList`, `mediaRequests-requestStats`, S; media search/request is optional action | Former upstream now serves Seerr documentation/source. Prefer shipped Seerr for new installs; separately verify an existing legacy instance/version before connecting this exact kind. |
| [Jellystat][h-jellystat] `jellystat`; [install][i-jellystat] | C · next | Settings → API Key; ACL? | S: audio/movie/series/other playback views, last 30 days | PostgreSQL and configured Jellyfin/Emby data collection; no playback history means no useful history, not broken inventory counts. |
| [Komga][h-komga] `komga`; [install][i-komga] | C · first | Settings → API keys; account/key access to selected libraries, `X-API-Key`; finer ACL? | S: available libraries/series/books; no selected library ID required | Local filesystem for `/config`, not NFS/CIFS; JVM heap normally limited around 1 GB, tune by collection. Explicit book-media path; no acquisition automation. |
| [Maintainerr][h-maintainerr] `maintainerr`; [install][i-maintainerr] | C · gated | No authentication for `/api/storage-metrics` | S: handled items/reclaimable storage | Upstream's purpose includes automatic deletion. Install only without active cleanup rules by default; media-server linking and destructive rules need separate approval. x86-64-v2 needed for image features; API private network. |
| [Overseerr][h-overseerr] `overseerr`; [source][i-overseerr] | C · defer duplicate | Settings API key; ACL? | Same request widgets as Jellyseerr, S | Plex-oriented legacy product overlaps shipped Seerr. No new default installation; existing-instance compatibility requires its own version proof. |
| [Readarr][h-readarr] `readarr`; [retirement/install][i-readarr] | C · defer retired | Settings → General API key; ACL? | `calendar`, S; calendar month/window | Official project retired after unusable metadata. Historical Docker route is not a maintained-new-App justification; existing instances only until a deliberate support decision. |
| [RomM][h-romm] `romm`; [source/install guide pointer][i-romm] | C · next | No separate credential for reachable `/api/stats` | S: platforms/ROMs/saves/states/screenshots/size | Database and user-owned ROM/media paths; metadata accounts/keys depend on chosen provider. No ROM provisioning or third-party signup; AGPL-3.0 recorded upstream. |
| [Stash][h-stash] `stash`; [install][i-stash] | C · gated opt-in | Settings → Security API key; ACL? | S: GraphQL collection counters | Adult/private library; explicit opt-in and controlled media access. Avoid default board content exposing collection metadata. |
| [Tube Archivist][h-tubearchivist] `tubearchivist`; [install][i-tubearchivist] | C · gated | Settings API token; ACL? | S: videos/channels/playlists/pending downloads | Elasticsearch plus Redis/data stores, significant disk; upstream cites roughly 2 GB testing / 4 GB larger install. Host/kernel requirements require separate approval; no downloading content as acceptance. |
| [Unmanic][h-unmanic] `unmanic`; [install][i-unmanic] | C · gated | No authentication; GET workers and read-only POST pending-tasks | S: workers/pending tasks; not `mediaTranscoding` | CPU/scratch/media writes, GPU optional. Protect API; processing rules and hardware passthrough separately approved. |
| [xTeVe][h-xteve] `xteve`; [install][i-xteve] | C · gated image policy | No auth or username/password when enabled; read-only POST status after login; ACL? | S: all/active/XEPG streams | Upstream README points to third-party Docker images; require maintained version/architecture selection. User supplies lawful M3U/EPG; no provider subscription creation. |
| [Your Spotify][h-yourSpotify] `yourSpotify`; [install][i-yourSpotify] | C · gated provider | Settings → Account → Public token as `apiKey`; read access to that account's aggregates | S: songs/time/artists; fixed all-time range, no custom selector | Separate API `:8080`, frontend and MongoDB. User-owned Spotify developer application, OAuth consent/redirect and allowed users required; current provider eligibility is a user/account gate, not solved by a Homarr public token. |
| [Homebox][h-homebox] `homebox`; [install][i-homebox] | C · first | Account email as username + password; JWT/login each stats fetch, account's group; finer ACL? | S: items/locations/labels/warranty/value/users | Persistent household inventory; group/currency follow the account, not a selectable other group's ID. Sensitive household data. |
| [Karakeep][h-karakeep] `karakeep`; [install][i-karakeep] | C · next | Settings → API Keys; bookmark-read access; finer ACL? | S: bookmark counters | Official Docker route; search/browser companions and optional AI keys add cost/resources. AI/provider signup is not necessary to establish Homarr reading. |
| [Mealie][h-mealie] `mealie`; [install][i-mealie] | C · first | Profile → API Tokens; user access to intended household | S: household recipes/users, group categories/tags | **Mealie v2** `/api/households/statistics` required; v1 group-only endpoint unsupported. Household is determined by token, not invented global totals. |
| [Miniflux][h-miniflux] `miniflux`; [install][i-miniflux] | C · first | User's API key; access to intended feeds; finer ACL? | S: read/unread entries | PostgreSQL; official image amd64/arm64/armv7/armv6. Documented env first-admin creation is feasible; token acquisition still requires its own Setup proof. Not an iCal feed. |
| [Spoolman][h-spoolman] `spoolman`; [install][i-spoolman] | C · first | No application authentication | S: active spools/remaining weight | SQLite persists under App data with correct ownership; Homarr must use internal API port **8000**, not host mapping 7912. No printer/USB required for inventory; automatic consumption needs separately configured printer software. Private API only. |
| [Tandoor][h-tandoor] `tandoor`; [install][i-tandoor] | C · next | Settings → API; user token **read** scope | S: users/recipes in first accessible space, keywords in token scope | Official Compose/database route. Upstream README describes AGPL plus Commons Clause: review intended commercial/redistribution use, not plain unrestricted-AGPL assumption. No invented space selector. |
| [Trilium][h-trilium] `trilium`; [install][i-trilium] | C · next | TriliumNext Options → ETAPI token; ACL? | S: version/active notes/database size | **TriliumNext ≥0.94.0** metrics endpoint; original Trilium brand alone is insufficient. Persistent notes, client/server synchronization compatibility. |
| [Changedetection.io][h-changedetection] `changedetection`; [install][i-changedetection] | C · next | Settings → API key; ACL? | S: unviewed/total watches from `/api/v1/watch` | Optional browser adds memory; approved target/watch configuration separate. Optional AI charges are not needed for basic statistics. |
| [Healthchecks][h-healthchecks] `healthchecks`; [install][i-healthchecks] | C · next | Project settings → **project-specific read-only API key**; GET `/api/v3/checks/` | S: up/down/grace/new | Self-hosted Docker or existing hosted account; DB and optional mail delivery. Select project through key; do not substitute ping key or hosted-plan assumptions. |
| [NetAlertX][h-netalertx] `netalertx`; [install][i-netalertx] | C · gated network | API token; ACL?; backend API **20212**, not web UI | S: device totals/connected/new/down-alert | Network scan reach/capabilities and possible host networking require separate design/approval. Homarr only reads v2 totals and does not enable scanning. |
| [Scrutiny][h-scrutiny] `scrutiny`; [install][i-scrutiny] | C · gated collector | No API authentication | S: passed/failed/unknown non-archived disks | Separate web/database from collector. Real SMART data requires disk access/device passthrough and collector permissions; empty web UI is not hardware-health acceptance. Prefer existing remote collector over blanket privileges. |
| [Wazuh][h-wazuh] `wazuh`; [install][i-wazuh] | C · gated heavy | Server API username/password with `readonly`; optional indexer Address/user/password with read access to `wazuh-alerts-*`, `wazuh-monitoring-*`, `wazuh-states-*`; indexer-only also supported | `wazuhAgents`, `wazuhAlerts`, `wazuhSummary`, `wazuhTimeline`, `wazuhTopList`, `wazuhVulnerabilities`, `wazuhFim`, `wazuhAuthFailures`; no native S metrics; optional dashboard Address, time/range/severity options | Manager API **55000** ≠ indexer **9200** ≠ dashboard. CA trust, at least 8 GB Docker host RAM for full single-node and `vm.max_map_count≥262144`; no host sysctl/agent enrollment approved here. API-only cannot populate indexer widgets; indexer-only agents may lag 15-minute snapshots. |
| [llama.cpp][h-llamacpp] `llamacpp`; [install][i-llamacpp] | C · gated model | Registry offers **no secret mode**; default unauthenticated llama-server; key-protected compatibility unverified | Dedicated `llamacpp`: health/model/speed/request details; `--metrics` for counters, `/slots` for requests. S: exactly `health`, `tokensGenerated`, `requestsProcessing` ([provider][stats-existing]). | CPU possible, GPU optional; RAM/VRAM depends on chosen model/context. User selects lawful GGUF/model licence; no automatic model download. Not Ollama or proof of key-auth support. |
### External/manual connections and feed: 12
**E** is a scope decision, not a claim these products cannot run anywhere in containers. In particular, Coolify and self-hosted UniFi have install routes but manage infrastructure beyond this Project. Legacy column is limited to the recorded TypeScript snapshot.
| Kind / pinned guide | Class and recommended scope | Verified authentication / minimum permission | Native widget / selectors | Platform, account and promotion blocker; legacy evidence |
| ---------------------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [OpenMediaVault][h-openmediavault] `openmediavault` | E · manual NAS | Administrator username/password required | `healthMonitoring`, `systemResources`, `systemDisks`, S | Debian NAS OS, existing host/storage; `openmediavault-cputemp` plugin for Health Monitoring. No narrower verified role; no OS/plugin installation approval. Legacy: none. |
| [OPNsense][h-opnsense] `opnsense` | E · later read-only connector | System → Access → Users; dedicated API-only user, scrambled password; **Lobby: Dashboard + Reporting: Traffic**; `opnsenseApiKey` + `opnsenseApiSecret` | `firewall`, S | Existing router/firewall OS; cannot replace host routing through a Compose App. No firewall changes or routing modifications in connector acceptance. Legacy: none. |
| [Proxmox][h-proxmox] `proxmox` | E · preferred external pilot | VE `pve` user/token: **PVEAuditor at `/`, Propagate**; privilege-separated token gets same ACL; username/realm/tokenId/secret | `healthMonitoring`, S; cluster tab and node/qemu/lxc/storage sections, no VM ID required | Existing hypervisor; native guide warns PAM may not work. Proposed read-only monitoring only, no VM/host installation or lifecycle control. Legacy: none. |
| [Synology][h-synology] `synology` | E · manual privileged exception | Dedicated DSM account in **default Administrators**; deny shares/apps, permit DSM; initial terms acceptance; **2FA unsupported** | `healthMonitoring`, `systemResources`, `systemDisks`, S; optional real `visibleStorageVolumes`, only Synology-only selection | Existing DiskStation/DSM, hardware/sensor-dependent metrics; trusted DSM certificate. Do not weaken a person's MFA or lockout policy to automate coverage. Admin requirement remains a blocker to a least-privilege default. Legacy: none. |
| [TrueNAS][h-truenas] `truenas` | E · manual versioned exception | API Keys in user menu; preferred `apiKey`, or administrative username/password. Narrow key role **not verified** | `healthMonitoring`, `systemResources`, `systemDisks`, S; pool/dataset-derived values | Existing NAS; HTTPS + CA trust + WebSocket API. 25.10 removed `auxiliary_administrator`; full-admin fallback is not a read-only scope. Generic HTTP requests unavailable. Legacy: none. |
| [UniFi][h-unifiController] `unifiController` | E · manual controller | **Local administrator** username/password; no cloud-only or MFA account supported | `networkControllerSummary`, `networkControllerStatus`, S; aggregate sites, no required site ID | Existing UniFi console/hardware or self-hosted Network Server; 443 vs 8443. Hardware-dependent data; read-only role not verified. Legacy: `externalOnly` list entry, **no native descriptor**. |
| [Unraid][h-unraid] `unraid` | E · later read-only connector | Management Access → API Keys → **Viewer** preset, `apiKey` | `healthMonitoring`, `systemResources`, `systemDisks`, S | Existing licensed OS ([licensing][unraid-price]); API included ≥7.2, API plugin needed earlier. No purchase, plugin install or disk changes authorized. Legacy: none. |
| [Coolify][h-coolify] `coolify` | E · later read-only connector | Intended team; enable API in Settings → Advanced; Security → API Tokens, **read** permission | `coolify`, S; root Address, team encoded by key; no required project ID | Existing PaaS manages Docker/remote hosts; installing it would cross the single-Project scope without a new design. Legacy: [native Coolify descriptor][legacy-coolify], not current Go App or acceptance proof. |
| [Anchor][h-anchor] `anchor` | E · manual pending product proof | Settings bearer API key; note-read permission; exact token ACL **not documented** | `anchorNote`, S; required chosen **`noteId`**; note editing additionally writes | Homarr [client][anchor-client] proves `/api/notes` read/PATCH contract, but authoritative product/image/licence/install identity was not established. Genuine Catalog blocker; do not choose a similarly named Anchor. Legacy: none. |
| [Plant-it][h-plantit] `plantit` | E · manual pending server version | Account username/password with REST access, JWT authentication | S: plants/species/photos/events | Homarr documents server API, but current [upstream README][i-plantit] describes an Android app and slowed development, not a current server installation. Pin matching server release/Compose route before promotion; no Android install as substitute. Legacy: none. |
| [Syncthing Relay][h-syncthingRelay] `syncthingRelay` | E · manual pending image/Access policy | No secret; reachable `/status` **22070**, not relay protocol 22067 | S: sessions/connections/bytes proxied | Official [relay source][i-syncthingRelay] defaults to public pool participation and bandwidth consumption; private mode uses `-pools=""`. A maintained container source and separate public-Access decision remain needed before new App promotion. Existing Syncthing is not this binary. Legacy: none. |
| [iCal][h-ical] `ical` | F · manual; opt-in feed pilot later | Saved secret **`url`** for published/publicly fetchable ICS; no OAuth/login mode | `calendar` only; chosen feed and calendar window | Requires user-approved feed/publication/privacy decision, no App installation. Treat tokenized Address as secret; test requires at least one VEVENT. [Client][ical-client] bounds recurrence expansion; empty feed ≠ service failure; generic HTTP source unavailable. Legacy: none. |
## Infrastructure/discovery: separate from the 41
| Official mechanism | Minimum access and selectors | Useful surface / limits | Proposed decision |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Docker / Podman][h-docker] | Configured environment endpoint with stable ID; inventory capability. Restricted proxy `CONTAINERS=1`, **no POST/lifecycle/remove** for pilot; private network or TLS with explicit CA/client material | Container management and `dockerContainers`; optional endpoint subset. Raw socket grants extensive host control even when mounted read-only | Separate security/ownership design. No socket mount or other-Project discovery by default; scope to this Project and prove enforcement, rather than trust UI capability flags alone. |
| [Docker labels][h-labels] | Depends on approved inventory endpoint; `homarr.name` + `homarr.href`; optional stable ID/board/kind/widget; **no secrets in labels** | Onboarding proposals, credentials entered separately; compatible widget kinds only, one target board | Metadata-only slice after discovery boundary approval. Read-only discovery still needs confirmation before resource creation/adoption; not an external Link scheduler. |
| [Kubernetes][h-kubernetes] | Explicit service account/RBAC or read-only mounted kubeconfig; chosen contexts; ≥1.24. Metrics Server optional | Inventory of pods/services/nodes/etc.; upstream also exposes ConfigMaps/**Secrets**. CPU/memory absent without Metrics Server; not Docker-label App discovery | Out of current Compose product scope. Separate opt-in ADR/security slice; exclude Secrets permission by default and determine which features degrade. “Read-only” is not safe confidentiality scope. |
## Independently verifiable follow-up shapes
These are ticket proposals only; **no additional issues have been published**.
1. **Compatibility/ownership contract**: choose supported Homarr version or capability check before broad automation (current App uses mutable `:dev`). Acceptance: validate exact kinds, secret alternatives, widget schemas and server ports; fail with a Manual step on unsupported capability; preserve manual resources, stable IDs, `--json` and unrelated board items. [Current image/Setup][homarr], [ownership][targets]. Does not block writing this report or unrelated shipped-App work.
2. **One Catalog App at a time**, first the five recommended above: pin image/architecture, licence and persisted-data boundary; prove own Setup/Admin login or explicit Manual step, negative auth and Backup inclusion. **Separate Homarr Link acceptance**: one chosen S metric (e.g. Miniflux unread entries, Spoolman remaining weight) matches authoritative peer data; Homebox group/Mealie household/Komga library permissions are tested. Repeat leaves IDs/resources stable; removal touches only owned resources. An empty installation or HTTP 200 is insufficient. No dependency on implementing every other candidate.
3. **External connection input decision**, then **Proxmox-only pilot**: present competing choices—leave Homarr manual (recommended until approved), or introduce explicit typed external inputs owned by Homarr. Current `app.Link` scheduler requires a Catalog peer; do not fake an installed App or repurpose Unmanaged app tiles. Before implementation decide secret ownership under `internal/project`, named identity/Address/TLS trust, approval, adoption, opt-in widgets and removal (Homarr records only, never external host). Acceptance: PVEAuditor reads a known node/guest, rejects invalid credentials, survives reconnect without duplicates, leaves manual resources/external infrastructure unchanged. [Link contract][link-contract], [scheduler][scheduler], [Unmanaged inventory][installed].
4. **iCal-only input pilot**, independent of Proxmox protocol: existing feed secret, explicit privacy/board consent; verify a known recurring event/time zone/window and malformed/empty-feed outcomes, redact feed Address, repeat/revoke without disturbing other calendars. Requires the external-input ownership decision, never an install definition or automatic calendar publication.
5. **Conditional candidate slices**, independently selectable: NetAlertX network policy; Scrutiny web/collector separation and exact devices; Wazuh server-API agents first, indexer widgets later with separate credentials/CA; llama.cpp CPU/read-only server first with user-supplied model. Each acceptance names useful data and its unavailable state. Hardware, sysctl, enrollment and model downloads are separate approved operations, not implicit Setup.
6. **Existing-instance/legacy/manual guidance**, no new default Apps: Readarr retirement, exact Jellyseerr/Overseerr versions, Anchor product identity, Plant-it server/image provenance, Syncthing Relay public-pool/image policy. Acceptance is a documented version/auth/data contract or explicit unsupported reason. There is no evidence justifying automatic aliases or product replacement.
7. **Discovery security design**, then separate Docker inventory, labels, and Kubernetes slices. Acceptance demonstrates Project/context isolation, denied lifecycle/remove/Secrets actions, no secret labels, explicit adoption, and graceful missing endpoint/metrics. Requires explicit boundary approval/ADR where the single-Project invariant changes; no broad host inventory consent inferred from Homarr installation.
## Decisions and unavoidable blockers
Accepting this research closes a planning gap, **not 41 integrations**. Decide separately: which five Apps to prioritize; whether an external-input feature is wanted at all; supported Homarr version; opt-in widgets versus defaults; and permission/adoption policy. Implementation remains future approved work.
Genuine external blockers are existing NAS/router/hypervisor hardware and operator credentials; Synology/UniFi admin/non-MFA requirements; missing narrow TrueNAS role proof; user-owned Spotify application/consent/eligibility; FileFlows organizational licensing and existing Unraid licence; privileged collection/kernel changes; lawful media/models and upstream image/version evidence for promotion-blocked/retired products. Additional research can resolve missing evidence; it cannot grant privileges, create user accounts or make unsupported upstream software maintained.
Boundaries follow [CONTEXT][context], [ADR 0001][adr1], [ADR 0005][adr5] and [ADR 0007][adr7]: compiled Apps in one Compose Project, inspect/plan/approval/apply/verify, no migration of historical Projects. No code, dependencies, tests, installer, browser or Docker runtime were changed/run. Documentation validation is inventory arithmetic, source/link checks and `git diff --check`; no full Go gate is claimed for this docs-only change.
## Source index
[catalog]: https://github.com/ajnart/selfhost-skills/blob/5aafb4c1833fd4cd9caf0f7beaac31e625aafe22/internal/catalog/default.go
[registry]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/packages/definitions/src/integration.ts
[widgets]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/packages/definitions/src/widget-integration-map.ts
[stats]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/packages/widgets/src/stats/config.ts
[stats-providers]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/packages/integrations/src/stats/providers.ts
[stats-existing]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/packages/integrations/src/stats/existing.ts
[stats-resolver]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/packages/integrations/src/stats/index.ts
[targets]: https://github.com/ajnart/selfhost-skills/blob/5aafb4c1833fd4cd9caf0f7beaac31e625aafe22/internal/apps/homarr/links.go
[homarr]: https://github.com/ajnart/selfhost-skills/blob/5aafb4c1833fd4cd9caf0f7beaac31e625aafe22/internal/apps/homarr/homarr.go
[link-contract]: https://github.com/ajnart/selfhost-skills/blob/5aafb4c1833fd4cd9caf0f7beaac31e625aafe22/internal/app/app.go#L108-L116
[scheduler]: https://github.com/ajnart/selfhost-skills/blob/5aafb4c1833fd4cd9caf0f7beaac31e625aafe22/internal/service/service.go#L459-L543
[installed]: https://github.com/ajnart/selfhost-skills/blob/5aafb4c1833fd4cd9caf0f7beaac31e625aafe22/internal/service/installed_apps.go
[legacy-list]: https://github.com/ajnart/selfhost-skills/blob/56f3fbf6c972fa507e5cae7673dc730438714855/.agents/skills/self-host/workflows/selfhost/references/catalog/homarr-integrations.json
[legacy-coolify]: https://github.com/ajnart/selfhost-skills/blob/56f3fbf6c972fa507e5cae7673dc730438714855/.agents/skills/self-host/workflows/selfhost/references/catalog/apps/coolify/homarr.json
[anchor-client]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/packages/integrations/src/anchor/anchor-integration.ts
[ical-client]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/packages/integrations/src/ical/ical-integration.ts
[context]: https://github.com/ajnart/selfhost-skills/blob/5aafb4c1833fd4cd9caf0f7beaac31e625aafe22/CONTEXT.md
[adr1]: https://github.com/ajnart/selfhost-skills/blob/5aafb4c1833fd4cd9caf0f7beaac31e625aafe22/docs/adr/0001-compiled-apps-compose-is-truth.md
[adr5]: https://github.com/ajnart/selfhost-skills/blob/5aafb4c1833fd4cd9caf0f7beaac31e625aafe22/docs/adr/0005-agents-load-the-skill-on-their-own.md
[adr7]: https://github.com/ajnart/selfhost-skills/blob/5aafb4c1833fd4cd9caf0f7beaac31e625aafe22/docs/adr/0007-one-repo-go-cli-only.md
[h-autobrr]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/autobrr/index.mdx
[h-bindery]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/bindery/index.mdx
[h-fileflows]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/fileflows/index.mdx
[h-jackett]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/jackett/index.mdx
[h-jellyseerr]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/jellyseerr/index.mdx
[h-jellystat]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/jellystat/index.mdx
[h-komga]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/komga/index.mdx
[h-maintainerr]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/maintainerr/index.mdx
[h-overseerr]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/overseerr/index.mdx
[h-readarr]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/readarr/index.mdx
[h-romm]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/romm/index.mdx
[h-stash]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/stash/index.mdx
[h-tubearchivist]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/tubearchivist/index.mdx
[h-unmanic]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/unmanic/index.mdx
[h-xteve]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/xteve/index.mdx
[h-yourSpotify]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/your-spotify/index.mdx
[h-homebox]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/homebox/index.mdx
[h-karakeep]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/karakeep/index.mdx
[h-mealie]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/mealie/index.mdx
[h-miniflux]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/miniflux/index.mdx
[h-spoolman]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/spoolman/index.mdx
[h-tandoor]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/tandoor/index.mdx
[h-trilium]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/trilium/index.mdx
[h-changedetection]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/changedetection/index.mdx
[h-healthchecks]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/healthchecks/index.mdx
[h-netalertx]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/netalertx/index.mdx
[h-scrutiny]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/scrutiny/index.mdx
[h-wazuh]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/wazuh/index.mdx
[h-llamacpp]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/llama-cpp/index.mdx
[h-openmediavault]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/open-media-vault/index.mdx
[h-opnsense]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/opnsense/index.mdx
[h-proxmox]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/proxmox/index.mdx
[h-synology]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/synology/index.mdx
[h-truenas]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/truenas/index.mdx
[h-unifiController]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/unifi-controller/index.mdx
[h-unraid]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/unraid/index.mdx
[h-coolify]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/coolify/index.mdx
[h-anchor]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/anchor/index.mdx
[h-plantit]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/plantit/index.mdx
[h-syncthingRelay]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/syncthing-relay/index.mdx
[h-ical]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/ical/index.mdx
[h-docker]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/docker/index.mdx
[h-labels]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/docker-labels/index.mdx
[h-kubernetes]: https://github.com/homarr-labs/homarr/blob/ebbd4876d25a51151444a009ab596e1154d62880/apps/docs/docs/integrations/kubernetes/index.mdx
[i-autobrr]: https://github.com/autobrr/autobrr#readme
[i-bindery]: https://github.com/vavallee/bindery#readme
[i-fileflows]: https://fileflows.com/docs/installation/docker/
[fileflows-price]: https://fileflows.com/pricing/
[i-jackett]: https://github.com/Jackett/Jackett#docker-installation
[i-jellyseerr]: https://github.com/Fallenbagel/jellyseerr#readme
[i-jellystat]: https://github.com/CyferShepard/Jellystat#readme
[i-komga]: https://komga.org/docs/installation/docker/
[i-maintainerr]: https://github.com/Maintainerr/Maintainerr#readme
[i-overseerr]: https://github.com/sct/overseerr#readme
[i-readarr]: https://github.com/Readarr/Readarr#readme
[i-romm]: https://github.com/rommapp/romm#readme
[i-stash]: https://github.com/stashapp/stash#readme
[i-tubearchivist]: https://github.com/tubearchivist/tubearchivist#readme
[i-unmanic]: https://github.com/Unmanic/unmanic#readme
[i-xteve]: https://github.com/xteve-project/xTeVe#readme
[i-yourSpotify]: https://github.com/Yooooomi/your_spotify#readme
[i-homebox]: https://github.com/sysadminsmedia/homebox#readme
[i-karakeep]: https://github.com/karakeep-app/karakeep#readme
[i-mealie]: https://github.com/mealie-recipes/mealie#readme
[i-miniflux]: https://miniflux.app/docs/docker.html
[i-spoolman]: https://github.com/Donkie/Spoolman/wiki/Installation
[i-tandoor]: https://github.com/TandoorRecipes/recipes#readme
[i-trilium]: https://github.com/TriliumNext/Trilium#readme
[i-changedetection]: https://github.com/dgtlmoon/changedetection.io#readme
[i-healthchecks]: https://github.com/healthchecks/healthchecks#readme
[i-netalertx]: https://github.com/jokob-sk/NetAlertX#readme
[i-scrutiny]: https://github.com/AnalogJ/scrutiny#readme
[i-wazuh]: https://documentation.wazuh.com/current/deployment-options/docker/wazuh-container.html
[i-llamacpp]: https://github.com/ggml-org/llama.cpp#readme
[i-plantit]: https://github.com/MDeLuise/plant-it#readme
[i-syncthingRelay]: https://github.com/syncthing/syncthing/blob/main/cmd/strelaysrv/README.md
[unraid-price]: https://unraid.net/pricing