Update Suwayomi server and replace FlareSolverr with Byparr

Apps/Suwayomi/docker-compose.yml

@@ -2,7 +2,7 @@ name: suwayomi
 
 services:
   suwayomi:
-    image: ghcr.io/suwayomi/tachidesk:v2.1.2087
+    image: ghcr.io/suwayomi/suwayomi-server:v2.3.2243
     user: $PUID:$PGID
     container_name: suwayomi
     restart: unless-stopped
@@ -33,9 +33,9 @@ services:
       WEB_UI_CHANNEL: bundled
       WEB_UI_UPDATE_INTERVAL: 0.0
       EXTENSION_REPOS: >-
-        ["https://raw.githubusercontent.com/keiyoushi/extensions/repo/index.min.json"]
+        ["https://raw.githubusercontent.com/keiyoushi/extensions/repo/index.json"]
       FLARESOLVERR_ENABLED: true
-      FLARESOLVERR_URL: http://suwayomi-flaresolverr:8191
+      FLARESOLVERR_URL: http://suwayomi-bypass:8191
     volumes:
       - /DATA/Media/Mangas/:/home/suwayomi/.local/share/Tachidesk/downloads
       - /DATA/AppData/$AppID/data/:/home/suwayomi/.local/share/Tachidesk
@@ -48,8 +48,8 @@ services:
           memory: 1G
 
   flaresolverr:
-    image: ghcr.io/flaresolverr/flaresolverr:v3.4.6
-    container_name: suwayomi-flaresolverr
+    image: ghcr.io/thephaseless/byparr:latest@sha256:01a46a2865d9a6db5eb8ead04ec0dd33b8fbe233e8565ae70b50d4cc0af4cfb0
+    container_name: suwayomi-bypass
     user: 0:0
     restart: unless-stopped
     environment:
@@ -59,6 +59,8 @@ services:
       resources:
         limits:
           memory: 512M
+    networks:
+      - pcs
 
 networks:
   pcs:
@@ -67,11 +69,12 @@ networks:
 
 x-casaos:
   main: suwayomi
+  webui_port: 80
   index: /
   store_app_id: suwayomi
   pre-install-cmd: |
-    mkdir -p /DATA/AppData/suwayomi/data &&
-    mkdir -p /DATA/Media/Mangas
+    mkdir -p /DATA/AppData/$AppID/data/ /DATA/Media/Mangas/ &&
+    chown -R $PUID:$PGID /DATA/AppData/$AppID/ /DATA/Media/Mangas/
   architectures:
     - amd64
     - arm64
@@ -83,7 +86,7 @@ x-casaos:
     - https://cdn.jsdelivr.net/gh/Yundera/AppStore@main/Apps/Suwayomi/screenshot-1.png
     - https://cdn.jsdelivr.net/gh/Yundera/AppStore@main/Apps/Suwayomi/screenshot-2.png
     - https://cdn.jsdelivr.net/gh/Yundera/AppStore@main/Apps/Suwayomi/screenshot-3.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Yundera/AppStore@main/Apps/Suwayomi/screenshot-1.png
+  thumbnail: https://cdn.jsdelivr.net/gh/Yundera/AppStore@main/Apps/Suwayomi/thumbnail.png
   title:
     en_us: Suwayomi
   tagline:

Apps/Suwayomi/rationale.md

@@ -0,0 +1,25 @@
+# Suwayomi — Rationale
+
+## What deviation / exception is being requested
+The FlareSolverr bypass service (`ghcr.io/thephaseless/byparr`) runs as `user: 0:0` (root). The main Suwayomi service runs as `$PUID:$PGID`. Authentication uses Suwayomi's built-in simple login (`AUTH_MODE: simple_login`).
+
+## Why it is necessary
+- **Byparr (FlareSolverr)**: Runs a headless Chromium browser to bypass Cloudflare protection on manga sources. The official image requires root to launch the browser process, manage browser profiles, and handle system-level dependencies (fonts, certificates, shared libraries).
+- **Suwayomi**: Runs correctly as `$PUID:$PGID` — no root required.
+
+## Security mitigations in place
+- Only the Byparr sidecar runs as root — the main Suwayomi service runs as `$PUID:$PGID`
+- Byparr has no volumes mounted — no access to host filesystem
+- Byparr has no Caddy labels — not publicly accessible, only reachable within the `pcs` network
+- Memory limits on both services (1G Suwayomi, 512M Byparr)
+- CPU shares configured on both services (50 Suwayomi, 20 Byparr)
+- No privileged mode, no elevated capabilities
+- Authentication enabled with `AUTH_MODE: simple_login` using `$APP_DEFAULT_PASSWORD`
+
+## Alternatives considered and rejected
+- `user: $PUID:$PGID` for Byparr — headless Chromium requires root for sandbox and system library access; the upstream image does not support non-root execution
+
+## Data protection
+- Suwayomi data persists in `/DATA/AppData/$AppID/data/`
+- Downloaded manga persists in `/DATA/Media/Mangas/`
+- Byparr stores no persistent data — it is stateless