docs/maintainers/handbook.md aktualisiert

Thats how I until now understood process of adding an env var. Thought it might help other's who are new. I am very open to suggestions, other best practices, corrected typos...

docs/abra/index.md

@@ -10,7 +10,9 @@ title: Abra
 
 `abra` is the flagship client & command-line for Co-op Cloud. It has been developed specifically for the purpose of making the day-to-day operations of operators and maintainers pleasant & convenient. It is libre software, written in Go and maintained and extended by the community :heart:
 
-Once you've got `abra` installed, you can start your own Co-op Cloud deployment. `abra` allows you to create, deploy and maintain libre software apps. It supports working with existing servers or can create new servers (supported providers: [Servers.coop](https://servers.coop/) & [Hetzner](https://hetzner.com)). It can also help you manage your DNS configuration (supported providers: [Gandi](https://gandi.net)).
+`abra` is the flagship client & command-line tool for Co-op Cloud. It has been developed specifically for the purpose of making the day-to-day operations of [operators](https://docs.coopcloud.tech/operators/) and [maintainers](https://docs.coopcloud.tech/maintainers/) pleasant & convenient. It is libre software, written in [Go](https://go.dev) and maintained and extended by the community 💖
+
+Once you've got `abra` installed, you can start your own Co-op Cloud deployment.
 
 - [Install](/abra/install): You want to install `abra` :100:
 - [Quick start](/abra/quickstart): You're ready to get started using `abra` :muscle:

docs/abra/trouble.md

@@ -4,7 +4,7 @@ title: Troubleshoot
 
 ## Where do I report `abra` bugs / feature requests?
 
-You can use [this issue tracker](https://git.coopcloud.tech/toolshed/organising/issues/new/choose).
+You can use [this issue tracker](https://git.coopcloud.tech/toolshed/abra/issues/new).
 
 ## SSH connection issues?
 
@@ -83,3 +83,21 @@ This appears to be an upstream issue for which we can't do much in `abra` to sol
 ## Caller path in debug stacktrace doesn't exist
 
 Debug stacktrace currently begins with `/drone/` due to CI. Remove the initial `/drone/` and the path is relative to the abra project root.
+
+## "Failed to select default branch"
+
+General speaking, this error should not happen in the > v0.10.x `abra` version series. You can try upgrading if you're on an old version: `abra upgrade`.
+
+If you're really stuck, `rm -rf`'ing the relevant recipe repository and catalogue might do the trick.
+
+```
+$ abra app new foobar
+FATA[0000] unable to validate recipe: failed to select default branch in /root/.abra/catalogue
+$ rm -rf ~/.abra/recipes/foobar ~/.abra/catalogue
+```
+
+Otherwise, you can try manually cloning the recipe repository to the correct location.
+
+```
+$ git clone https://git.coopcloud.tech/coop-cloud/MyCoolRecipe.git ~/.abra/recipes
+```

docs/abra/upgrade.md

@@ -55,8 +55,6 @@ And test things work.
 
 ### `0.9.x-beta` -> `0.10.x-beta`
 
-> 🎺🎺🎺 Get the [release candidate](https://git.coopcloud.tech/toolshed/abra/releases/tag/0.10.0-rc1-beta) 🎺🎺🎺
-
 * `abra` will now write the app deployment version to the app env file
   (`$ABRA_DIR/servers/<server>/<domain>.env`) against the `TYPE=/RECIPE=` env
   var. This has a number of implications which are detailed in the [release
@@ -113,6 +111,11 @@ And test things work.
   to accomodate the work done around operator collaboration and stable
   versioning.
 
+* `abra app deploy` / `upgrade` / `rollback` / etc. now show the deployment
+  progress, retry attempts and the healthcheck status.
+
+* Failed deployments will write output logs to file in `~/$ABRA_DIR/logs`.
+
 * `abra app errors` went away. It never really worked and was retired. You can
   rely on `abra app logs` for the time being.
 
@@ -127,6 +130,9 @@ And test things work.
 
 * `abra recipe fetch` now accepts an `--all` flag to fetch all repositories.
 
+* It's now possible to set the character charset for a password. See
+  [`#521`](https://git.coopcloud.tech/toolshed/abra/issues/521) for more.
+
 ### `0.8.x-beta` -> `0.9.x-beta`
 
 None at this time.

docs/federation/membership.md

@@ -16,6 +16,8 @@ title: Membership
 | [Local IT](https://local-it.org/)  | - | - | `@moritz:matrix.local-it.org` + `@simon_sth:matrix.org`|
 | Mirsal ™  | - | - | `@mirsal:1312.media` |
 | [UTAW](https://utaw.tech) | -  | - | `@javielico:matrix.org` |
-| [BeWater](https://bewater.contact) | Waiver | - | `@decentral1se` |
+| `@decentral1se` | Waiver | - | `@decentral1se` |
 | [ruangrupa](https://ruangrupa.id) | - | - | Henry `@babystepper:matrix.org` |
 | [Ammar](https://social.coop/@ammaratef45) | - | - | `@ammaratef45:matrix.org` |
+| [MIR](https://mirnet.org/) | ✅ | - | `@brooke:pub.solar` |
+| [Red Abya Yala](https://abyayala.sutty.nl/) | - | - | `@fauno:sutty.nl` |

docs/federation/resolutions/in-progress/030-docs-naming-survey.md

@@ -0,0 +1,35 @@
+# Co-op Cloud resolution 030: docs / naming survey
+
+- Topic: Budget for a survey about the Co-op Cloud documentation 
+- Date: 2025-04-03
+- Deadline: 2025-04-17
+- Size: large
+
+## Summary
+
+Allocate up to €160 for the production and analysis of a survey to get feedback on the Co-op Cloud documentation (https://docs.coopcloud.tech), with a particular focus on the "operator" and "maintainer" names.
+
+Optional feedback on what docs example survey takers think we could benefit from observing and/or an optional description of how documentation can be improved in general will be present but not necessary acted on as part of this resolution.
+
+## Details
+
+- We've received some feedback that the key "Operators" and "Maintainers" names can be confusing, especially for non-native-English speakers
+- We're interested in getting wide input, from both the existing Co-op Cloud community, and the wider democratic tech space -- including from people unfamiliar with Co-op Cloud
+- As well as specific input on this naming question, it would also be useful to gather general feedback on the documentation, collecting suggestions on structure, clarity, format (including potential other media like screencasts, videos, or educational materials)
+
+Our rough plan / budget for this work is:
+- collecting information 1-2h
+- design survey 1-2h
+- distribute survey 1-2h
+- analyse survey 1-2h
+- 4-8 hours
+
+## Budget 0YY: Docs / naming survey
+
+* Budget amount: up to EUR 160
+
+* Who will implement this: 3wordchant & Ammar
+
+* When will the money be spent: in Q1 2025
+
+ * What is the money for: paying for work on a community survey about the Co-op Cloud documentation

docs/federation/resolutions/passed/027.md

@@ -0,0 +1,22 @@
+---
+title: "Resolution 027"
+---
+
+- Topic: MIR joins the Co-op Cloud Federation
+- Date: 18-01-25
+- Deadline: 31-01-25
+- Size: Large
+
+### Summary
+
+[MIR](https://mirnet.org) would like to the join the Co-op Cloud Federation.
+Several members of the project are involved in hacking recipes, there has been
+personal contact via a call with `@decentral1se` (also several federation
+members have expressed enthusiasm for them joining) and they have ambitions to
+co-develop Co-op Cloud.
+
+### Details
+
+MIR can contribute fees at this time:
+
+`@decentral1se` is happy to vouch 💖

docs/federation/resolutions/passed/028.md

@@ -0,0 +1,15 @@
+# Resolution 028: Red Abya Yala joins the Co-op Cloud Federation
+
+- Topic: Red Abya Yala joins the Co-op Cloud Federation
+- Date: 16-01-2025
+- Deadline: 30-01-2025
+- Size: large
+
+## Summary
+
+Red Abya Yala is the network of Coopcloud nodes from Escuela Común.  It has facilitated Coopcloud workshops during Escuela Común and some members have contributed to recipes.
+
+Representative: `@fauno:sutty.nl`
+
+* https://abyayala.sutty.nl/
+* https://escuelacomun.yanapak.org/

docs/federation/resolutions/passed/029.md

@@ -0,0 +1,74 @@
+# Resolution 29 Budget 14: Federation Radmin
+
+- Topic: Establish Budget 14, to pay for up to 12 hours a month of "radmin" (radical administration) work, to help the federation run smoother, for an initial period of 12 months.
+- Date: 05-04-2025
+- Deadline: 19-04-2025
+- Size: Large
+
+## Summary
+
+Experience shows that solid administration is the basis for effective self-organisation. We call this "radmin" (radical admin) because this admin work acts as motor which boosts our self-organisation and coordination potential.
+
+We are in a unique position to discuss and implement a financial model which can meet our vision of sustainability based on our democratic structure and decision making process. We believe that it is more important than ever to make software project governance work without dictators. This role plays a critical role in making that possible.
+
+Autonomic has been carrying out the financial administration so far but cannot continue to do this due to low capacity. No other federation member can pick up this work at this time. To make progress, we propose to create a strict mandate for a paid radmin role which will be published as an open call. Anyone can fill this role, claim the budget and support the federation.
+
+Federation members will decide on who fills the role based on an evaluation of the candidates. The open call draft will specify exact details once this decision is approved and will be presented to federation members. The open call will be agreed upon by discussion with fedi members feedback, not decision making.
+
+## Details
+
+### Mandate
+
+* Up to 12 hours a month @ 20 EUR per hour based on the currently available federation membership dues
+* Establishing a financial bookkeeping structure for the federation with associated documentation
+* Instigating handover from Autonomic finance admin
+* Leading a discussion which establishes a shared understanding of what financial sustainability means for the federation today with associated documentation
+* Designing and implementing a new federation membership fees system which supports financial sustainability and is passed with a large decision
+* Contributing to the Co-op Cloud [wiki](https://docs.coopcloud.tech) (training provided)
+* Making sure invoices are submitted correctly and approving them via the Co-op Cloud Open Collective (OC)
+* Managing budgets and facilitating timetracking against those budgets (e.g. https://kimai.coopcloud.tech)
+* Herding cats
+* Timetrack to be done on the activity level via our [Kimai](https://kimai.coopcloud.tech) for accountability
+* Invoicing for your time each month to the Co-op Cloud OC
+
+### Extension
+
+**IMPORTANT**: Extensions to this mandate can **only** be established through official decision making process. 
+
+We expect that this radmin work will continue to be necessary as long as the federation exists, so it can be a stable source of (some) income in the future.
+
+### Duration
+
+The term duration of this role is 1 year with a start date which will be decided in conversation with the contractor.
+
+### Recall
+
+The term of duration can be recalled by the federation via established decision making channels (large resolution) if issues cannot be resolved through dialogue and constructive feedback.
+
+In the event of recall, there will be a collaborative feedback session between the federation and the contractor with the implementors of this propsal.
+
+### Buddy system
+
+Implementors of this resolution commit to a fixed monthly meeting, date/time to be determined, to check in and discuss challenges, progress, plans etc. This could preferably occur during the [Kite-flying hours (R024)](https://docs.coopcloud.tech/federation/resolutions/passed/024/) unless privacy needs require otherwise.
+
+This is an important accountability structure which is not aimed to surveil the contractor but ensure that both the federation and the radmin role are working well together and where things can be improved, take action together to resolve it.
+
+### Open call
+
+An open call is to be publised based on this proposal and shared openly. The open call will be presented as a draft to federation members before publishing. Exact details of the process, evaluation, start/end date etc. will be included in the text.
+
+## Budget 014
+
+The role is paid primarily from the current membership fees, as decided on [R002](https://docs.coopcloud.tech/federation/resolutions/passed/002/). The hope is that by filling this role, we can increase this budget through the design and implementation of a more sustainable financial model for the federation (see mandate above).
+
+- Budget amount:
+    - 250 EUR per month (hours for contractor)
+    - 40 EUR per month (hours for implementors / buddys)
+    - **Total**: 290 EUR per month
+- Who will implement this: decentral1se, kawaiipunk (Autonomic)
+- When will the money be spent: On an ongoing basis
+- What is the money for: Paying the working hours of whoever fills the role
+
+## Legal
+
+The contractor must function as a freelancer contractor and is responsible for their own invoices and taxes. Currently the Co-op Cloud project is stewarded by Autonomic Co-operative Limited and does not have it's own legal entity, so the freelance contract will be with Autonomic Co-operative Limited.

docs/intro/bikemap.md

@@ -6,4 +6,4 @@ title: Bike map
 
 - We are working towards a stable `1.0.0` release.
 
-- What we're currently working on is listed on this issue tracker: [`coop-cloud/organising`](https://git.coopcloud.tech/coop-cloud/organising/issues).
+- What we're currently working on is listed on this issue tracker: [`toolshed/projects`](https://git.coopcloud.tech/toolshed/-/projects).

docs/intro/faq.md

@@ -8,12 +8,10 @@ Co-op Cloud aims to make hosting libre software apps simple for small service pr
 
 ## Who is behind the project?
 
-The project was started by workers at [Autonomic](https://autonomic.zone/) which
-is a [worker-owned co-operative](https://en.wikipedia.org/wiki/Worker_cooperative) who provides
-technologies and infrastructure to empower users to make a positive impact on
-the world. Numerous other like minded co-ops have since joined our
-[Federation](/federation/) and rely *Co-op Cloud* in production.
-
+The project was initiated by workers at [Autonomic](https://autonomic.zone/), a
+[worker-owned co-operative](https://en.wikipedia.org/wiki/Worker_cooperative).
+Numerous other like minded co-ops have since joined the
+[Federation](/federation/) and rely on *Co-op Cloud* in production.
 
 ## Why Co-op Cloud?
 

docs/intro/inspirations.md

@@ -2,5 +2,7 @@
 title: Inspirations
 ---
 
-* [Dmytri Kleiner: "You can't code away their wealth"](https://yewtu.be/watch?v=FEU632_Em3g). Also, [The Telekommunist Manifesto](https://www.networkcultures.org/_uploads/%233notebook_telekommunist.pdf). Reading / checking out Kleiners work is a must IMHO -- `@decentral1se`.
-* [CoopCycle](https://coopcycle.org/en/) - heavily inspired the Federation model and how we shaped the first decisions on how to do it. -- `@decentral1se`
+* [CoopCycle](https://coopcycle.org/en/)
+* [Dmytri Kleiner: "You can't code away their wealth"](https://yewtu.be/watch?v=FEU632_Em3g)
+* [The Telekommunist Manifesto](https://www.networkcultures.org/_uploads/%233notebook_telekommunist.pdf)
+* [Free Software Syndicalism](https://oxygen.offdem.net/pub/synware-free-software-syndicates)

docs/intro/managed.md

@@ -4,10 +4,14 @@ title: Managed hosting
 
 !!! danger "We're still working this out, you can help too!"
 
-    If you're a co-operative or a tech collective who wants to appear on this list, please [get in touch](/intro/contact/)! We want to expand the number of service providers using the Co-op Cloud so that project is more widely available to end-users and organisations who can influence the direction and co-fund the development.
+    If you're a co-operative or a tech collective who wants to appear on this
+    list, please [get in touch](/intro/contact/)! We want to expand the number
+    of service providers using Co-op Cloud so that project is more widely
+    available to end-users and organisations who can influence the direction
+    and co-fund the development.
 
-The Co-op Cloud is still [beta quality software](https://en.wikipedia.org/wiki/Software_release_life_cycle#Beta) :bomb: but you can still work with a tech co-op or collective to host some part or all of your online digital services with it. Organisations who want to support the project can get in touch with Co-op Cloud service providers via the following list for a quote on what they're looking for and how much it will cost. Service providers can then factor in some percentage of the cost to co-fund the development of this project.
+*Co-op Cloud* is still [beta quality software](https://en.wikipedia.org/wiki/Software_release_life_cycle#Beta) :bomb: but you can still work with a tech co-op or collective to host some part or all of your online digital services with it. Organisations who want to support the project can get in touch with *Co-op Cloud* service providers via the following list for a quote on what they're looking for and how much it will cost. Service providers can then factor in some percentage of the cost to co-fund the development of this project.
 
 - [Autonomic Co-op](https://autonomic.zone) (contact: [`helo@autonomic.zone`](mailto:boop@autonomic.zone))
-- [Local-IT](https://local-it.org/) (contact [`info@local-it.org`](mailto:info@local-it.org))
-- [Solisoft](https://solisoft.top) (contact [`contact@solisoft.top`](mailto:contact@solisoft.top))
+- [makeITsocial](https://makeitsocial.net) (managed hosting, see [price calculator](https://makeitsocial.net/kolli-cloud/))
+- [Local-IT](https://local-it.org/) ([selfhosting](https://wiki.local-it.org/s/kollicloud-wiki/doc/selfhosting-guide-1xZJt8UIha) & cooperative hosting, contact: [`info@local-it.org`](mailto:info@local-it.org))

docs/intro/strategy.md

@@ -6,23 +6,21 @@ From our experiences working and organising as Autonomic, the tech co-op who [in
 
 ## Technological Saviors?
 
-The urgency to build an alternative is based on an analysis of our current reality.
+The urgency to build an alternative to ["corporate clouds"](https://2023.transmediale.de/en/event/counter-cloud-strategies) is based on an analysis which we summarise briefly here.
 
-The monopolisation of our digital lives, the stranglehold of corporate control (aka [GAFAM](https://degooglisons-internet.org/en/)), represents a grave threat to our collective freedom, our societies and our hopes for a good life on planet earth.
+We begin with the monopolisation of our digital lives, the stranglehold of corporate control (aka [GAFAM](https://degooglisons-internet.org/en/)), which represents a grave threat to our collective freedom, our societies and our hopes for a good life on planet earth.
 
-We begin with an acknowledgment of their vast accumulation of network effects and resources. We also acknowledge that no single project, product or organisation can create the required shift to a more widespread public interest technology.
+We acknowledge the vast accumulation of network effects and resources accrued by these monopolies. This is the basis of our understanding that no single project, "product" or organisation can create the required shift to a more widespread public interest technology.
 
-> Technology alone will not save us.
->
-> Simply deploying libre software is not enough. 
+When we say public interest technology, we mean a technology which is not built in the service of monopoly. We are speaking of a technology which emerges from elements of democracy: bottom-up decision making, social need, community ownership and ecological thinking. Our aspiration is a technology which is built in the service of social justice, equality and collective freedom.
 
-Our strategy is to mutualise our resources to facilitate this shift.
+Our strategy is to mutualise our resources to facilitate this shift. We harbour no illusions: technology alone will not "save us" and simply deploying libre software is not enough. We do not operate in a bubble and do not wish to remain contained within a subculture.
 
 We can say that _Co-op Cloud_ is a libre software infrastructure project. It is based on open standards, is copyleft licensed and is open and democratically managed.
 
 We can also say that _Co-op Cloud_ is a social movement of hosters, hackers, technologists and their allies who defend a vision of collective self-management.
 
-We are committed to an organisational form which allows us to accumulate knowledge, solidarity, experience and resources. We claim a rich history of grassroots social resistance, direct action and collective liberation.
+We are committed to an organisational form which allows us to accumulate knowledge, solidarity, experience and resources. We claim a rich history of grassroots social resistance, direct action and struggle for collective liberation.
 
 We propose to go beyond a reductive technological vision of social change.
 

docs/maintainers/handbook.md

@@ -124,6 +124,45 @@ You can also access it in your configs using the following syntax:
 {{ env "FOO" }}
 ```
 
+### Example: Adding environment variables to existing recipe
+Here is a four step example how to add a new environment variable to a recipe without breaking existing deployments. 
+
+1. add env-var to the `compose.yml` in section `environment`:
+   ```yaml
+       environment:
+         # ... existing envs
+         - REQUIRE_AUTH_FOR_PROFILE_REQUESTS=${REQUIRE_AUTH_FOR_PROFILE_REQUESTS:-false}
+         # ... other existing envs
+   ```
+
+   With `${REQUIRE_AUTH_FOR_PROFILE_REQUESTS:-false}` you set a default value (`false`), ensuring not to break existing deployments. 
+   If you're sure that it won't cause problems, if operators of existing deployments don't set the variable, you could also just put:
+   ```yaml
+       environment:
+         # ... existing envs
+         - REQUIRE_AUTH_FOR_PROFILE_REQUESTS
+         # ... other exisitng envs
+   ```
+   
+   Note: If you need to break something, make sure to add a [release note](/maintainers/handbook/#how-do-i-write-version-release-notes) explaining to operators what they should change before upgrading.
+
+2. add env-var to the `.env.sample`
+   ```yaml
+   #REQUIRE_AUTH_FOR_PROFILE_REQUESTS=true
+   ```
+
+3. now you can use the environment-variable in your `.tmpl` files, e.g. add to `homserver.yaml.tmpl`
+   ```yaml
+   require_auth_for_profile_requests: {{ env "REQUIRE_AUTH_FOR_PROFILE_REQUESTS" }}
+   ```
+   
+4. increase number of YAML-version in `abra.sh` (e.g. from `v30` to `v31`), only then it will be deployed. 
+   ```yaml
+   export HOMESERVER_YAML_VERSION=v31
+   ```
+
+   Note: If during development and testing you have to increase it several times, you can just "flatten" it in the end. Only make sure that you `undeploy`/`deploy` your existing instance.
+
 ### Global environment variables
 
 - `TYPE`: specifies the recipe name
@@ -374,7 +413,7 @@ And once more, we can validate this tag has been created with `cd ~/.abra/recipe
 
 ## How are new recipe versions tested?
 
-This is currently a manual process. Our best estimates are to do a backup and run a test deployment and see how things go.
+This is currently a manual process. Our best estimates are to do a backup and run a test deployment and see how things go. [We are working on improving this](https://git.coopcloud.tech/toolshed/-/projects/31).
 
 Following the [entry above](/maintainers/handbook/#how-do-i-release-a-new-recipe-version), before running `abra recipe release --publish <recipe>`, you can deploy the new version of the recipe. You find an app that relies on this recipe and pass `-C/--chaos` to `ugrade` so that it accepts the locally unstaged changes.
 
@@ -398,9 +437,9 @@ And then create a text file which corresponds to the version release, e.g. `1.1.
 
 You can also add release notes for the next release into a special file `release/next`. This file will be used when running `abra recipe release`.
 
-!!! warning "Not available previous versions of Abra"
+!!! warning "Watch out for old versions of `abra` 🚧"
 
-    Using `release/next` is only available in > 0.9.x series of `abra`.
+    This feature is only available in the > 0.9.x series of `abra`.
 
 ## How do I generate the recipe catalogue
 
@@ -431,7 +470,7 @@ You can pass `--publish` to have `abra` automatically publish those changes.
 
     In order to have `abra` publish changes for you automatically, you'll have to have write permissons to the git.coopcloud.tech repository and your account must have a working SSH key configuration. `abra` will use the SSH based URL connection details for Git by automagically creating an `origin-ssh` remote in the repository and pushing to it.
 
-## How is I make the catalogue automatically regenerate after new versions are published? 
+## How do I make the catalogue automatically regenerate after new versions are published? 
 
 "I'd like to make it so that whenever I push a new git tag to the
 [`coop-cloud/rallly` repository](https://git.coopcloud.tech/coop-cloud/rallly)
@@ -457,13 +496,21 @@ release`](#how-do-i-release-a-new-recipe-version)), it automatically does the
 
 ## How does automatic catalogue regeneration work?
 
-TODO
+**TODO: write up properly**
+
+Context: the catalogue lives in a git repo here: https://git.coopcloud.tech/toolshed/recipes-catalogue-json
+
+The expectation is that this repo will only be updated automatically. While manual commits are possible, they're likely to be overwritten.
+
+Automatic regeneration is handled by this Drone step, in the separate `auto-recipes-catalogue-json` repo: https://git.coopcloud.tech/toolshed/auto-recipes-catalogue-json/src/branch/main/.drone.yml#L5-L25
+
+This is run on a daily schedule (question: where is `nightly-app-date` configured?), and can also be triggered by recipe repositories to make new versions available quicker – see "[How do I make the catalogue automatically regenerate after new versions are published?](#how-do-i-make-the-catalogue-automatically-regenerate-after-new-versions-are-published)" above.
 
 ## How do I enable healthchecks
 
 A healthcheck is an important and often overlooked part of the recipe configuration. It is part of the configuration that the runtime uses to figure out if a container is really up-and-running. You can tweak what command to run, how often and how many times to try until you assume the container is not up.
 
-There are no real univesal configs and most maintainers just pick up what others are doing and try to adapt. There is some testing involved to see what works well. You can browse the existing recipe repositories and see from there.
+There are no real universal configs and most maintainers just pick up what others are doing and try to adapt. There is some testing involved to see what works well. You can browse the existing recipe repositories and see from there.
 
 You'll often find the same one used for things like caches & supporting services, such as Redis:
 
@@ -533,6 +580,32 @@ word" style generator but instead a string of characters to match the exact
 length. This can be useful if you have to generate "key" style values instead
 of passwords which admins have to type out in database shells.
 
+## How do I change secret generation characters?
+
+It is also possible to tell `abra` which characters it should use to generate secrets with from your recipe config.
+
+You do this by adding an additional modifier in the inline comment on the secret definition in the `.env.sample` / `.env` file.
+
+Here are some examples:
+
+```bash
+SECRET_ADMIN_INIT_PASSWORD_VERSION=v1 # length=64 charset=default,safespecial
+SECRET_SERVICE_PASSWORD_VERSION=v1 # length=64 charset=default,special
+```
+
+The possible Values are:
+
+|                    Value                     |                               Characters                                |                                        Description                                        |
+| -------------------------------------------- | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
+| `special`                                    | `!@#$%^&*_-+=`                                                          | Uses only Special Characters                                                              |
+| `safespecial`                                | `!@#%^&*_-+=`                                                           | Uses only Special Characters, but removes the dollar sign for Console safety              |
+| `default,special`                            | `abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%^&*_-+=` | Uses uppercase letters, lowercase letters and numbers and special characters              |
+| `default,safespecial`                        | `abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#%^&*_-+=`  | Uses uppercase letters, lowercase letters and numbers and console safe special characters |
+| `default`                                    | `abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789`             | Uses uppercase letters, lowercase letters and numbers                                     |
+| any other value or not setting one will be treated as `default` | `abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789`             | Uses uppercase letters, lowercase letters and numbers                                     |
+
+The setting does only apply when you also set a length modifier to the secret (documented [here](/maintainers/handbook/#how-do-i-change-secret-generation-length)), so it is not applicable for the "easy to remember word" style generator that used when you don't set a length.
+
 ## How are recipes added to the catalogue?
 
 > This is so far a manual process which requires someone who's been added to the

docs/operators/handbook.md

@@ -479,16 +479,16 @@ COMPOSE_FILE="$COMPOSE_FILE:compose.wildcard.yml"
 2. Generate a self-signed certificate using the [command listed here](https://letsencrypt.org/docs/certificates-for-localhost/#making-and-trusting-your-own-certificates). Unless using `localhost` you may want to edit that where it appears in the command, and/or add multiple (sub)domains to the certificate e.g: `subjectAltName=DNS:localhost,DNS:myapp.localhost`
 3. Run these commands:
 ```
-abra app secret insert localhost ssl_cert v1 "$(cat localhost.crt)"
-abra app secret insert localhost ssl_key v1 "$(cat localhost.key)"
+abra app secret insert localhost ssl_cert v1 localhost.crt -f
+abra app secret insert localhost ssl_key v1 localhost.key -f
 ```
 4. Re-deploy `traefik` with `--force` and voila!
 
 ## Remote recipes
 
-!!! warning "This is only available in the currently unreleased version of `abra`"
+!!! warning "Watch out for old versions of `abra` 🚧"
 
-    Please see [this issue](https://git.coopcloud.tech/toolshed/organising/issues/583) to track current progress towards a release. All feedback and testing are welcome on this new feature. The design is not finalised yet.
+    This feature is only available in the > 0.10.x series of `abra`.
 
 It is possible to specify a remote recipe in your `.env` file:
 
@@ -506,7 +506,9 @@ $ABRA_DIR/recipes/mygit_org_myorg_cool-recipe
 
 ## Saving the version to the app `.env` file
 
-!!! warning "This is only available in the currently unreleased version of `abra`"
+!!! warning "Watch out for old versions of `abra` 🚧"
+
+    This feature is only available in the > 0.10.x series of `abra`.
 
 If you `abra app new`/`abra app deploy`/`abra app upgrade`/`abra app rollback`,
 the version that is deployed will be written to your app `.env` file. You can
@@ -531,7 +533,9 @@ with `[version]` `--chaos/-C` or `--ignore-env-version/-i`.
 
 ## How is the new deployment version determined?
 
-!!! warning "This is only available in the currently unreleased version of `abra`"
+!!! warning "Watch out for old versions of `abra` 🚧"
+
+    This feature is only available in the > 0.10.x series of `abra`.
 
 ### `.env` version
 
@@ -548,21 +552,24 @@ with `[version]` `--chaos/-C` or `--ignore-env-version/-i`.
 This is the most flexible command so it can be hard to follow. It is possible
 to deploy the following kinds of versions with `abra app deploy`:
 
-1. latest recipe version (standard `abra app deploy`)
-2. version retrieved from the app `.env` (`abra app deploy` + `TYPE=custom-html:1.7.1+1.27.2`)
-3. latest commit (`--chaos/-C` / `abra app deploy` + no released recipe versions)
-4. latest commit with unstaged changes (`abra app deploy --chaos/-C`)
-5. recipe version or Git hash (`abra app deploy 1.7.1+1.27.2`)
+1. latest recipe version if no `.env` version (standard `abra app deploy`)
+1. version retrieved from the app `.env` (`abra app deploy` + `TYPE=custom-html:1.7.1+1.27.2`)
+1. latest commit (`--chaos/-C` / `abra app deploy` + no released recipe versions)
+1. latest commit with unstaged changes (`abra app deploy --chaos/-C`)
+1. recipe version or Git hash (`abra app deploy 1.7.1+1.27.2`)
 
 The app `.env` version is always used as the recipe checkout version if
 present.
 
-For 2), if the app **is undeployed** and there is an app `.env` version
-present, then it will be used. This is the *only time* the app `.env` version
-is used using `abra app deploy`. This is done to reduce unwanted upgrades (we
-do not automatically choose the latest release).
+The version is chosen using the following priority logic.
+
+1. cli argument
+1. `.env` file
+1. deployed app
+1. recipe catalogue (if undeployed)
 
 Use `--ignore-env-version/-i` to deploy the latest release version or commit.
+
 In all cases 3-5, the app `.env` version is **ignored** as a version candidate.
 
 ### `abra app upgrade`

docs/operators/tutorial.md

@@ -30,6 +30,7 @@ You need to keep port `:80` and `:443` free on your server for web proxying to y
     When running `usermod ...`, you may need to (depending on your system) log
     in and out again of your shell session to get the required permissions for
     Docker.
+    Alternatively you can run [`newgrp`](https://www.man7.org/linux/man-pages/man1/newgrp.1.html) to register the group chnage.
 
 ```
 # ssh into your server
@@ -38,9 +39,18 @@ ssh <server-domain>
 # docker install convenience script
 wget -O- https://get.docker.com | bash
 
+# check if the docker group exists
+groups | grep docker
+
+# if the docker group doesn't already exist, add it manually
+sudo groupadd docker
+
 # add user to docker group
 sudo usermod -aG docker $USER
 
+# check that docker installed correctly
+docker run hello-world
+
 # exit and re-login to load the group
 exit
 ssh <server-domain>
@@ -52,6 +62,7 @@ docker network create -d overlay proxy
 # now you can exit and start using abra
 exit
 ```
+Abra can't deploy any applications in future steps if the docker group cannot run without sudo. If you install docker a different way, it may not create a docker group automatically. The [official Docker documentation](https://docs.docker.com/engine/install/linux-postinstall/) can help if you run into further issues.
 
 ??? question "Do you support multiple web proxies?"
 
@@ -68,6 +79,8 @@ Your entries in your DNS provider setup might look like the following.
 
 Where `116.203.211.204` can be replaced with the IP address of your server.
 
+Warning: If the you are in the same local netwrok as the server, you might run into [NAT Hairpin](https://superuser.com/questions/663820/port-forwarding-from-inner-network-to-inner-network-hairpin-nat) issues.
+
 ??? question "How do I know my DNS is working?"
 
     You can use a tool like `dig` on the command-line to check if your server has the necessary DNS records set up. Something like `dig +short <domain>` should show the IP address of your server if things are working.
@@ -88,7 +101,7 @@ that everything is working try listing the `--help` command or `-h` to view
 output:
 
 ```bash
-abra -h 
+abra -h
 ```
 
 You may need to add the `~/.local/bin/` directory to your `$PATH` variable, in
@@ -99,12 +112,18 @@ you have immediate access to `abra` on the current terminal.
 export PATH=$PATH:$HOME/.local/bin
 ```
 
-If you run into issues during installation, [please report a ticket](https://git.coopcloud.tech/toolshed/organising/issues/new) :pray: Once you're all set up, we **highly** recommend configuring command-line auto-completion for `abra`. See `abra autocomplete -h` for more on how to do this.
+If you run into issues during installation, [please report a ticket](https://git.coopcloud.tech/toolshed/organising/issues/new) :pray:
 
 ??? question "Can I install `abra` on my server?"
 
     Yes, this is possible. However, the instructions for this setup are different. For more info see [this handbook entry](/operators/handbook/#running-abra-server-side).
 
+### Set up autocomplete
+
+Most `abra` commands require typing the fully qualified domain name for your app, so we **highly** recommend configuring command-line auto-completion. See `abra autocomplete -h` for more on how to do this. The instructions vary depending on which shell you use.
+
+With autocomplete enabled, you can run a command like `abra app deploy myapp.example.com` by just typing `abra app deploy myapp<tab>`.
+
 ### Add your server
 
 Now you can connect `abra` with your server. You must have a working SSH configuration for your server before you can proceed. That means you can run `ssh <server-domain>` on your command-line and everything Works :tm:. See the [`abra` SSH troubleshooting](/abra/trouble/#ssh-connection-issues) for a working SSH configuration example.
@@ -131,14 +150,14 @@ It is important to note that `<server-domain>` here is a publicy accessible doma
 
     Yes, this is possible. You need to pass `-D` to `server add` and ensure
     that your `Host ...` entry in your SSH configuration includes the name.
-    So, for example:
-
+    So, for example, in `~/.ssh/config`:
+    ```
       Host example.com example
         ...
-
+    ```
     And then:
 
-      abra server add -D example
+      abra server add example
 
 You will now have a new `~/.abra/` folder on your local file system which stores all the configuration of your Co-op Cloud instance.
 
@@ -159,7 +178,7 @@ In order to have your Co-op cloud deployment serve the public internet, we need
 
 Traefik is the main entrypoint for all web requests (e.g. like NGINX) and
 supports automatic SSL certificate configuration and other quality-of-life
-features which make deploying libre apps more enjoyable. 
+features which make deploying libre apps more enjoyable.
 
 **1. To get started, you'll need to create a new app:**
 
@@ -173,7 +192,7 @@ will suggest `<app-name>.server.org` or prompt you with a list of servers.
 
 **2. Configure this new `traefix` app**
 
-You will want to take a look at your generated configuration and tweak the `LETS_ENCRYPT_EMAIL` value. You can do that by running `abra app config`:
+You will want to take a look at your generated configuration and update the placeholder `LETS_ENCRYPT_EMAIL` value, used by Let's Encrypt to manage SSL certificates. You can do that by running `abra app config`:
 
 ```bash
 abra app config <traefik-domain>
@@ -190,7 +209,7 @@ files exist at relevantly named path:
 Variables starting with `#` are optional, others are required. Some things to
 consider here is that by default our *Traefik* recipe exposes the metric
 dashboard unauthenticated on the public internet at the URL `<traefik-domain>`
-it is deployed to, which is not ideal. You can disable this with:
+it is deployed to, which while helpful for debugging, is not ideal in production environments. You can disable this with:
 
 ```
 DASHBOARD_ENABLED=false
@@ -198,6 +217,8 @@ DASHBOARD_ENABLED=false
 
 **3. Now it is time to deploy your app:**
 
+Ensure `<traefic-domain>` is registered in `/etc/hosts` then run:
+
 ```
 abra app deploy <traefik-domain>
 ```
@@ -219,7 +240,7 @@ The `-S` or `--secrets` flag is used to generate secrets for the app: database c
 
     Take care, these secrets are only shown once on the terminal so make sure to take note of them! `abra` makes use of the [Docker secrets](/operators/handbook/#managing-secret-data) mechanism to ship these secrets securely to the server and store them as encrypted data. Only the apps themselves have access to the values from here on, they're placed in `/run/secrets` on the container file system.
 
-Then we can deploy Nextcloud:
+Make sure` <nextcloud-domain>` is registered in `/etc/hosts`, then we can deploy Nextcloud:
 
 ```bash
 abra app deploy <nextcloud-domain>

docs/specs/backup/maintain.md

@@ -6,7 +6,7 @@ backup/restore logic.
 
 ## Tools
 
-Two of the current "blessed" options are, which both implement the [backupbot specification](link to spec)
+Two of the current "blessed" options are, which both implement the [backupbot specification](/specs/backup/spec/).
 
 - [`backup-bot-two`](https://git.coopcloud.tech/coop-cloud/backup-bot-two)
 - [`abra`](https://git.coopcloud.tech/toolshed/abra)

mkdocs.yml

@@ -116,11 +116,16 @@ nav:
               - federation/resolutions/passed/022.md
               - federation/resolutions/passed/023.md
               - federation/resolutions/passed/024.md
+              - federation/resolutions/passed/025.md
+              - federation/resolutions/passed/026.md
+              - federation/resolutions/passed/027.md
+              - federation/resolutions/passed/028.md
+              - federation/resolutions/passed/029.md
           - "Stalled":
               - federation/resolutions/stalled/013.md
           - "In Progress":
-              - federation/resolutions/in-progress/025.md
-              - federation/resolutions/in-progress/026.md
+              - federation/resolutions/index.md
+              - federation/resolutions/in-progress/030-docs-naming-survey.md
       - "Minutes":
           - federation/minutes/index.md
           - "Recently":
@@ -148,7 +153,7 @@ nav:
       - "Recipes": abra/recipes.md
       - "Hack": abra/hack.md
       - "Troubleshoot": abra/trouble.md
-      - "Cheat Sheet": abra/cheat-sheet.md       
+      - "Cheat Sheet": abra/cheat-sheet.md
   - "Specifications":
       - specs/index.md
       - "Backups":