Operator Guide

This guide is for the technical self-hoster — comfortable with a shell, environment variables, reverse proxies, and networking. Every recipe here is copy-pasteable and states its assumptions.

This section folds in Loombre's operator-facing documentation as it already exists — the pages below are implementation-verified and organized here, not rewritten. If you're looking for the settings screens instead, see the Admin Guide; if you're looking for how to use Loombre, see the User Guide.

Installing

Installation itself lives in its own top-level section: Install — platform chooser, system requirements per hardware tier, and the unsigned-install trust story (checksums, minisign, GitHub attestation, cosign).

Remote access

Remote access — three first-class, mutually-exclusive ways to reach your Loombre from outside your own network: a private network built into Loombre itself (Loombre Remote), a Cloudflare-connected tunnel needing no open ports (Tunnel), or your server directly on the public internet with its own certificate (Direct). The landing page's decision tree and comparison table help you pick; each path then has its own complete, self-contained setup guide. Direct's own two reference appendices — Caddy/nginx/Traefik recipes and the real requirements a proxy in front of Loombre has to meet (Reverse proxy), and automatic Let's Encrypt certificates via HTTP-01 or DNS-01, the port 80/443 privilege story, and renewal mechanics (Built-in ACME) — are also the right pages if you're running Loombre on your own network behind a proxy you already operate, with no remote-access path enabled at all (the reverse-proxy appendix's final section covers plain LAN-only, no-TLS operation too).

Mail

• Mail deliverability notes — getting a message sent isn't the same as getting it delivered; what's the mail provider's job versus what's genuinely out of reach for a server on a home connection. Setting mail up in the first place is the Admin Guide's Mail page.

Backups, restore & data export

• Backups & restore — what to actually back up (and explicitly what not to), both for the embedded and an external PostgreSQL instance, plus a restore drill you should run before you need it for real.

Separately from a database-level backup, Loombre has a built-in data export/import feature (GET /export, POST /import) for moving your catalog, libraries, and per-user watch progress between instances as an open JSON archive — POST /import requires an administrator session. This is also what the setup wizard's restore step uses. Full request/response detail is in the API Reference.

External PostgreSQL

• External PostgreSQL — running Loombre against a PostgreSQL instance you already operate, instead of the bundled embedded one.

systemd

• systemd — unit files for the Linux tarball install (full walkthrough: docs/install/linux.md).

The loombre command-line tool

• The loombre command-line tool — read-only environment checks (doctor, paths) plus the two privileged operations it exposes: admin reset-pin <username> (a forgotten restricted-content PIN — server-local by design, no equivalent over HTTP) and admin reset-password <username> (a forgotten account password — the same recovery the Admin Guide's Users screen offers over HTTP, for when a browser isn't an option).

Updating & verifying releases

• Updating Loombre — exactly what the built-in update checker does and does not send over the network (nothing is downloaded or applied automatically), and how to verify a release you've downloaded (checksums, minisign, GitHub attestation).

Environment variable reference

• Environment variable reference — every bootstrap/lockout-boundary variable with no settings-screen equivalent, plus the environment-pin variable for every admin-editable setting that has one. Generated automatically from Loombre's own settings list, every time this site is built. Secrets and other pure-infrastructure variables outside the settings list itself (POSTGRES_PASSWORD, LOOMBRE_JWT_SECRET) stay documented in installers/docker/loombre.env.example, linked from that page.

Tier-0 hardware

Loombre is explicitly designed and performance-budgeted for Tier-0 hardware (a 4-core, ~2GHz machine with 4GB RAM — an Intel N100 mini PC or a Raspberry Pi 5 are the reference devices) — not a degraded experience, a first-class one. The enforced budgets (server idle memory, endpoint response time, scan throughput) are listed in Performance budgets, and docs/ops/t0-audit-runbook.md is the runbook used to physically verify them against real hardware. If you're deploying to Tier-0 hardware, that runbook and docs/install/index.md's tier table are the two documents worth reading before you start.