DVinyl’s Big Rewrite, Docker’s Quirky Quotes, and Nextcloud’s Patch Tuesday

Homelab Highlights for 2026-07-24: self-hosting and homelab notes worth knowing.

[Audio embed placeholder]

The Lead: DVinyl v3.0: Self-Hosted Collection Manager Gets Major Rewrite

DVinyl, a self-hosted app that started as a vinyl collection tracker, has been completely rewritten in TypeScript for version 3.0. The update transforms it into a centralized hub for managing any collection, adding features like custom item types built via UI, multi-collection support on a single instance, and OIDC/SSO integration with tools like Authentik and Keycloak.

Why it matters: This rewrite addresses scalability and complexity from community-driven feature additions, turning a niche tool into a flexible platform for organizing physical and digital collections, which is a common homelab need.

Source: demo.kyonew.me

The Feed

Docker CLI’s —env-file Flag Has a Persistent Parsing Quirk

A long-standing open issue reports that the Docker CLI’s --env-file flag does not parse quotes in environment variable values the same way docker compose does, which can cause scripts to fail when variables contain spaces.

Why it matters: For homelab automation, this is a subtle bug that can break deployments. The noted workaround is to use the env_file key in a Docker Compose YAML file instead, which handles parsing correctly.

Source: GitHub

Nextcloud Issues July Maintenance Updates for Key Versions

Nextcloud has released maintenance updates for Hub 25 Autumn (v32.0.13), 26 Winter (v33.0.7), and 26 Spring (v34.0.2), recommending users update for important bug fixes, stability, and security upgrades.

Why it matters: These are routine but important patches for a core self-hosted platform. The updates are designed to be quick and safe, emphasizing the importance of keeping infrastructure current for security and reliability.

Source: Nextcloud Community

Security Camera Found with GitHub Admin Token in Login Page Code

A researcher discovered a Hanwha security camera’s web interface contained a plain-text GitHub admin token within its client-side JavaScript, providing access to the company’s GitHub organization.

Why it matters: This highlights a critical failure in secrets management and build pipelines, serving as a cautionary tale for anyone developing or packaging software to ensure sensitive tokens are never included in shipped artifacts.

Source: Hacker News

Community Megathread Highlights AI-Assisted Plex Projects

A Plex-focused community megathread showcases projects like SUBmarine, which identifies Plex media available on subscribed streaming services, and Kino Swipe, a Tinder-like interface for libraries. The thread requires clear AI use disclosure.

Why it matters: It reflects how communities are adapting to AI-assisted project sharing, surfacing practical tools for media management while enforcing transparency about development methods.

Source: GitHub

One Thing to Try

Try running a single, well-defined homelab task—like writing a Dockerfile or a configuration snippet—with different AI coding agents (e.g., Claude Code, Codex). Note how each handles context and specificity. For best results, provide a clear example of your existing code style in the prompt.

Sources

Transcript

Host A: Welcome to Homelab Highlights, the show that surfaces practical homelab wins and useful self-hosted tools.

Host A: Let’s start with a Docker CLI quirk that’s been popping up again. [conversational] Over on GitHub, there’s this open issue about the --env-file flag not handling quotes correctly. It’s one of those parsing bugs that doesn’t hit everyone, but when it does, it’s a real head-scratcher.

Host B: Yeah, the bug report’s been open for a while. The core of it is that if you have values with spaces in your .env file, the Docker CLI doesn’t parse them the same way docker compose does. So a variable that works fine in your compose stack can fail when you pass it via the command line flag.

Host A: [thoughtful] The discussion thread shows a few people hitting this when they’re scripting deployments. One commenter pointed out the workaround is straightforward: just use docker compose with the env_file key in your YAML, which handles it correctly. The consensus seems to be it’s a breaking change that’s kept it from being fixed.

Host B: [lighter] So the practical takeaway is, if you’re automating and your environment variables have spaces or special characters, stick with docker compose for that part. It’s a good little footgun to be aware of.

Host A: Shifting to infrastructure, Nextcloud has their July maintenance updates out. They’re strongly recommending updates for three specific versions: Hub 25 Autumn, 26 Winter, and 26 Spring.

Host B: [curious] Right, so if you’re on version 32, that’s 25 Autumn, update to 32.0.13. Version 33, which is 26 Winter, goes to 33.0.7. And the latest, version 34 for 26 Spring, the patch is 34.0.2.

Host A: These are your typical monthly patches—bug fixes, stability, and security upgrades. The team emphasizes these are designed to be quick and safe, avoiding major overhauls. They’ve got the full changelog on their site if you want the nitty-gritty.

Host B: Now, here’s a security story that’s making the rounds. A report details a case where a Hanwha security camera was found to have a GitHub admin token embedded right in its login page JavaScript. Not in the firmware, but in the client-side code anyone could download.

Host A: [skeptical] Yeah, the token was reportedly discovered by a researcher poking around the web interface. It was plain text, sitting there in the minified JS. The token apparently provided access to the company’s GitHub organization, which is a serious exposure.

Host B: It’s a stark reminder of how development artifacts can accidentally ship. This is secrets management failing at the build stage. The researcher noted the token was revoked after disclosure, but it’s a cautionary tale for anyone packaging software.

Host A: [quick aside] If you’re building anything that ships, it’s a good moment to double-check your pipelines for this kind of thing. Automated scanning should catch it, but clearly, it didn’t here.

Host A: For our main tool focus, we’re looking at DVinyl, which just hit version 3.0 with a complete rewrite. This started a few months back as a self-hosted app for tracking a vinyl collection.

Host B: [conversational] The community asked for more—books, games, DVDs, LEGO sets—and the developer kept adding them. But as the codebase got complex, they decided to rebuild from scratch in TypeScript with a new architecture.

Host A: This rewrite unlocked some major features. First, you can now create custom item types with no code—define your own fields, icons, and layouts right in the UI. It also supports multiple independent collections on one instance.

Host B: [with emphasis] A big one for homelabbers is the new OIDC and SSO support. It hooks into Authentik, Keycloak, Authelia, and similar, with auto-provisioning. They’ve also added digital media tracking and finally have proper documentation in a wiki.

Host A: If you want to poke around without installing, there’s a read-only live demo already populated with sample collections for vinyl, LEGO, and more. The repo is on GitHub under Kyonew/DVinyl.

Host B: [thoughtful] One neat operational detail: the developer includes a docker-compose.yml example that sets up a PostgreSQL database with clear instructions on volume mounts. The docs mention that while SQLite is default, they recommend PostgreSQL for any serious collection, citing performance benchmarks for larger datasets.

Host B: On the community side, there’s an interesting monthly projects megathread over on a Plex-focused subreddit. The moderators created it because they were getting inundated with project posts.

Host A: [conversational] They set up rules: you must declare any AI use, be detailed about what you built, include links, and it has to be Plex-related. They even provided a submission template.

Host B: One project shared is called SUBmarine, openly built with Claude. It compares your Plex library to streaming services you subscribe to via a free TMDB API key, aiming to identify what you could delete to free up space.

Host A: [with a small lift] Another is Kino Swipe, a Flask app that adds a Tinder-like swipe interface to your Plex or Jellyfin library. The developer noted using AI for front-end HTML help but reviewed all the code personally.

Host B: Both are open-sourced with Docker setups. The SUBmarine author even pre-empted questions, noting you can always re-add content later if streaming libraries change. It’s a snapshot of how communities are trying to manage AI-assisted project sharing.

Host A: Here’s a quick tip pulled from that community thread on AI coding agents. One user ran Claude Code, Codex, and Gemini CLI against the same project for a week.

Host B: [conversational] Their finding was that Claude Code held context well but could get expensive. The fix was discipline: fresh sessions per task, tight scope. For Codex, being precise upfront avoided ambiguity stalls.

Host A: [with emphasis] The bigger takeaway is that how you frame the task matters. For homelab stuff like Dockerfiles, include a snippet of your existing style in the prompt. It helps the AI match your conventions, saving cleanup time.

Host A: That’s Homelab Highlights for Friday. Until next time, happy hosting!