Interest in packaging LaraPaper for the official Umbrel App Store

[arquiguru]

Hi! Thanks for LaraPaper — I've been running it as the BYOS for my Kindle e-ink dashboard and it's excellent.

I noticed LaraPaper isn't in the official Umbrel App Store yet (only community stores). I've packaged it as an Umbrel app (single container, SQLite, app_proxy) and it installs and runs cleanly. Before submitting anything to getumbrel/umbrel-apps, I wanted to check with you first, since it's your project:

• Would you rather submit it to the official store yourself? Happy to hand over my package files to save you the effort.
• Or are you fine with me submitting it and crediting you as the developer (manifest developer/repo/website → usetrmnl/larapaper; I'd just be the packager/submitter)?

Either way LaraPaper reaches every Umbrel user by default instead of needing a manual community-store URL. Just didn't want to submit your project over your head. Thanks!

[bnussbau]

Hi there,

LaraPaper is available through my personal community store on Umbrel: https://github.com/bnussbau/umbrel-store/tree/master/bnussbau-trmnl-byos-laravel, which I keep up to date automatically using Renovate Bot. (Admittedly, I still need to rename it to LaraPaper, but otherwise it’s up to date.)

The main reason I haven’t submitted it to the official store yet is that I release updates almost every week, and I don’t want to manually open a PR for every release.

Do you have an example of how this could be automated, for example using Renovate Bot or a similar workflow?

[arquiguru]

Thanks for the quick reply, and for keeping the community-store package current!

I poked around getumbrel/umbrel-apps to see how updates work there. It doesn't run Renovate itself, so updates go in as individual "Update X to vY" PRs that the Umbrel team reviews and merges. The merge stays manual on their side, but for an active app that seems pretty routine.

The release PR itself looks easy to automate. A GitHub Action on release could bump the version + pinned digest and open the PR to the official repo (gh pr create from a fork, or a create-pull-request action), same idea as your Renovate flow but pointed at the monorepo. Have you found a Renovate-native way to open PRs into a repo you don't own? Couldn't find one myself, curious if it works.

I already packaged LaraPaper for the official store (single container, SQLite, app_proxy) and I'm running that package myself here, it drives a Kindle e-ink dashboard. I also swapped the shared baked-in APP_KEY for a per-install one derived from $APP_SEED so each install gets its own.

If it's useful I can set up that auto-PR Action as a working example so releases stay hands-off for you, then either hand it over or co-submit with you as the developer. It's up to you! Just think it'd be great to have it one-click for every Umbrel user.

[bnussbau]

Sorry for taking a while to get back to you.

If you’re interested in setting up the repository so that everything is as automated as possible and easy to maintain, I’d be happy to "officially" publish from my account. Feel free to transfer your repository to my GitHub account (bnussau).

I’d also be happy for you to stay involved as a contributor.

[arquiguru]

Sounds great, happy to do it that way. Here it is: https://github.com/arquiguru/larapaper-umbrel

The repo has the larapaper/ folder exactly as it would land in getumbrel/umbrel-apps, plus a GitHub Action that watches upstream for a new stable release and opens the version + digest bump PR to the official repo for you. It runs daily and also has a manual "Run workflow" button. It only ships strict X.Y.Z releases so betas can never go out, it asserts the image has both linux/amd64 and linux/arm64, and it reuses one branch per version so a re-run updates the existing PR instead of opening a duplicate.

A few packaging notes, all built against the packaging/update/test skills in umbrel-apps:

• APP_KEY is derived per-install from Umbrel's $APP_SEED in exports.sh, so every Umbrel gets its own Laravel key rather than the shared baked-in one. Same primitive the official samourai-server package uses.
• app_proxy whitelists /api/* and /storage/*. Devices poll the API and then fetch the rendered PNG, so leaving /storage/* out gives a blank screen.
• Image is digest-pinned, gallery: [] and no icon field, per their rules for new submissions.

Whenever you're ready, tell me and I'll start the repository transfer to your account. The one-time setup on your side is a fork of getumbrel/umbrel-apps, a PAT stored as the Actions secret UMBREL_APPS_TOKEN, and an Actions variable FORK_OWNER. It's documented in the README. The submitter field in the manifest is yours to set however you'd like it credited.

I'd be glad to stay on as a contributor and keep the automation healthy. Thanks for being open to this!

[bnussbau]

Whenever you're ready, tell me and I'll start the repository transfer to your account.

Let's go!

[arquiguru]

Transfer initiated, you should have an invitation to accept it (GitHub → your notifications, or the repo URL). Once you accept, larapaper-umbrel moves to your account and the old URL redirects.

Two small things after you accept:

• Add the Actions secret UMBREL_APPS_TOKEN and the Actions variable FORK_OWNER (your umbrel-apps fork owner). Until those are set, the scheduled run just skips the PR steps and finishes green with a notice, so it won't spam you with failures.
• The submitter field in larapaper/umbrel-app.yml currently says arquiguru. Set it to whatever you'd like credited.

Then you can hit "Run workflow" on the Submit action to open the first PR to getumbrel/umbrel-apps whenever you're ready.

Happy to be added as a contributor and keep an eye on the automation. Thanks again, this was a fun one to build.

[arquiguru]

Congrats on the transfer, and thanks for adding me as a contributor! Since you did, I pushed one small commit: I narrowed the app_proxy whitelist to the exact device/webhook routes instead of a broad /api/* + /storage/*. It's the same "keep whitelists narrow" point nmfretz raised on my BookLore PR (#5832). The broad version was exposing /api/user, /api/plugin_settings/* etc. publicly for no reason.

Verified on a real e-ink device: the device, image fetch, webhooks and token API all still work, and the management routes now sit behind Umbrel auth.

Very happy to switch to PRs instead of pushing to main directly. Just let me know how you'd like to run it.