RemoteRails Stack Update: Enhancing Your Sovereign Workspace

At RemoteRails, we are committed to providing a secure, performant, and completely sovereign communication and collaboration stack. Our latest update brings a host of powerful new features, vital security patches, and performance optimizations across the core components of your appliance.

Here is a detailed look at what has improved in the latest version of the RemoteRails stack and how these upgrades empower your workspace.

Component Upgrades: User & Administrator Impacts

Tuwunel (v1.8.3)

Our Matrix homeserver engine has received a significant update focusing on everyday convenience and operational reliability:

For Users:

• Instant QR-Code Login: No more typing long passwords or dealing with complex SSO flows on a new mobile device. Users can simply scan a QR code on an already signed in Element Web or Desktop client (in the Settings > Sessions dialog) using their Element X mobile app to instantly authenticate an additional phone or tablet.
• Native Video Thumbnails: Uploading video files into chat rooms now automatically generates and displays a still frame preview inline, replacing generic file icons so users can preview video content before clicking play.
• Seamless WebRTC Calls (LiveKit): To fully support Tuwunel 1.8.3’s updated native network handling, we’ve optimized our CORS and Private Network Access (PNA) configurations. Element Call video conferences now successfully negotiate WebRTC connections across all strict modern browsers, ensuring high-performance communication.

For Administrators:

• Memory & Resource Protection: The new video thumbnail generation includes administrative controls (like media_thumbnail_max_pixels) to tightly cap memory allocation during heavy media decoding, ensuring the container stays well within its Docker memory limits.
• Rendezvous Rate Limiting: The new cross-device authentication sessions are securely bounded in memory with dedicated rate limits and Time-To-Live (TTL) caps, preventing non-conformant clients from exhausting your server’s resources.
• Dynamic Secret Rotation: TURN and registration secrets are now re-read dynamically upon use. For containerized setups, this means you can update the mounted secret files and the application will pick them up without needing to restart the container.
• Private Network Access (PNA) Compliance: To complement Tuwunel 1.8.3’s internal routing enhancements, the Traefik reverse proxy has been updated to seamlessly handle modern cross-origin security requirements. While Tuwunel natively manages standard CORS preflight responses, Traefik now explicitly injects the required Access-Control-Allow-Private-Network: true header. This dual-layered approach guarantees that web applications hosted on public domains (like Element Web) can securely interact with your sovereign, VPN-isolated Matrix backend.

Nextcloud (v34.0.3) 

The heart of your file sharing suite is now faster and more resilient:

For Users:

• Snappier Web Navigation: Optimized lookup of user group memberships means navigating complex folders and loading shared files feels noticeably faster.
• Reliable File Listings: A bug that occasionally caused file properties to vanish during specific API responses (output shape validation) has been fixed, ensuring files are always displayed accurately.

For Administrators:

• Long-Term Redis Support: The Redis cache backend was officially “un-deprecated.” This removes annoying administrative warnings from the Nextcloud logs and guarantees your high-speed transactional file-locking architecture remains fully supported.
• SMB Storage Portability: Connecting Nextcloud to external Windows SMB shares is more reliable, as explicit null-handling for workgroups was patched to improve cross-platform compatibility.

Euro-Office (Document Server)

Working in tandem with Nextcloud to provide your in-browser office suite:

For Users:

• Smarter File Locking: Euro-Office now integrates more intelligently with Nextcloud’s files_lock mechanism. When you open a document to edit, it is automatically and reliably locked to prevent conflicting writes from other users. Additionally, harmless files like Readme.md are now explicitly excluded from aggressive locking when using the text app, preventing annoying “file is locked” errors on basic text files.

For Administrators:

• Federated Locking Support: The underlying API has been aligned to support federated file locking, meaning document locks are now respected even when files are shared across different Nextcloud servers.

Stalwart Mail (v0.16.16)

A major architectural consolidation brings modern features to your sovereign email server:

For Users:

• Instant Delivery & Better Battery Life: Thanks to JMAP Email Delivery Push Notifications and VAPID Web Push support, modern clients no longer have to “poll” the server. Stalwart actively pushes notifications the exact second a message arrives, providing an SMS-like real-time experience while significantly saving mobile battery life.
• Modern WebUI: The web interface for mail management was completely rewritten to provide a cleaner, responsive, and robust experience for managing settings and filtering rules.

For Administrators:

• Unified JMAP Management & CLI: The legacy REST API was retired. Server configuration is now exclusively handled via modern JMAP objects or the brand new stalwart-cli tool, making batched operations and clustered node configurations highly consistent.
• VAPID Web Push Integration: To power the new JMAP push capabilities, administrators now have robust backing for VAPID. This provides a native, self-hosted way to route real-time push notifications to clients securely without relying on opaque third-party notification relays.

Vaultwarden (v1.37.1)

Security and access management are paramount, especially when sharing credentials:

For Users:

• Seamless Organization Invites: Users invited to join shared password “Organizations” (for teams or families) will no longer encounter errors or broken flows when accepting their invitations, guaranteeing a smooth onboarding experience.

For Administrators:

• Critical Security Patches & Compatibility: Administrators must apply this update to maintain compatibility with Bitwarden clients version 2026.7.0 and later. It also patches severe vulnerabilities, including Server-Side Request Forgery (SSRF) and Cross-Organization access bypasses.
• Alpine Image Compilation Fixes: For administrators compiling their own images, deep-level OpenSSL issues in rust-musl have been resolved to ensure secure, lightweight Docker image builds.

LiveKit (v1.13.5)

Powering your WebRTC audio and video conferencing:

For Users:

• Broader Device Compatibility: By introducing support for a wider array of H.264 video profiles, participants joining calls from older smartphones, specialized hardware, or specific web browsers will experience reliable video decoding, eliminating “black screens”.

For Administrators:

• Enhanced Telemetry: Administrators gain deeper visibility into network issues with new Prometheus metrics tracking stream start latency and downstream packet push efficiency, making it easier to diagnose slow connections.

Recent Historical Improvements (Previous Major Releases)

To provide a complete picture of how the RemoteRails stack has evolved, here are the milestone features introduced in the previous major releases leading up to today:

Nextcloud (v32 & v33): The v33 release introduced AI Task Processing parallelization (occ taskprocessing:worker) and new OpenMetrics monitoring endpoints, while v32 brought massive stability and internal dependency updates to the core Vue.js components.

Tuwunel (v1.7): Officially stabilized upstream Single Sign-On (SSO) via OpenID Connect (OIDC)—the core feature that allows Tuwunel to perfectly integrate with our Defguard identity provider. It also introduced the OIDC Device Authorization Grant (allowing smart TVs to log in via a browser) and completely reworked concurrent federation data fetching to speed up cross-server syncing.

Stalwart Mail (v0.15): Solidified the “classic” All-in-one collaboration server architecture by offering robust support for CalDAV, CardDAV, and WebDAV alongside email, plus built-in per-mailbox encryption using S/MIME or OpenPGP keys.

Vaultwarden (v1.35 & v1.36): Version 1.36 introduced Item Archiving to keep vaults tidy, while the milestone v1.35 release officially introduced Single Sign-On (SSO) capabilities using OpenID Connect (OIDC)—the foundation of our Defguard integration.

LiveKit (v1.11 & v1.12): Version 1.12 brought enhanced disconnect reporting to help administrators distinguish between user-initiated hangups and network drops, while v1.11 enabled Data Tracks by default for robust real-time data streaming alongside audio and video.

The Seamless Update Process

Managing a complex, self-hosted stack used to be a daunting task, but the RemoteRails appliance is built on a highly modular, containerized architecture designed for painless maintenance.

To apply an update, administrators do not need to execute complex migration scripts or take the entire server offline for extended periods. The update process is elegantly simple:

1. Configuration Update: Administrators update their stack’s configuration manifests to reference the new version tags for each component.
2. Image Fetching: The orchestration engine reaches out to the secure registries to quietly download the latest, verified container images in the background.
3. Service Restart: The engine briefly stops the old containers and spins up the new ones in their place.

Because all persistent data (like databases, files, and media) is safely stored in isolated, persistent volumes on your host machine, the application containers themselves can be rapidly swapped out. While there is a brief, expected window of downtime (typically a few seconds to a minute, depending on the database size) as the new services boot up and apply any necessary database migrations, the automated process eliminates the need for extended, manual maintenance windows.

Note on Best Practices: While our architecture handles the heavy lifting, we always advise following standard upgrade paths—specifically for heavy database applications like Nextcloud. Ensure you always upgrade sequentially through major versions to maintain strict database integrity.

The most recent updates reinforce the reliability, speed, and feature completeness of your sovereign cloud. We encourage all administrators to apply these updates to take advantage of the latest improvements.