From 49ef09d7a8ddb8e17e6c8504e7f21c645dde6c51 Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Tue, 22 Sep 2026 01:02:55 -0700
Subject: [PATCH] Deploy wrapper-v2 0.0.2 on media-core

---
 servers/media-core/wrapper-v2/README.md    | 27 +++++++++++++
 servers/media-core/wrapper-v2/compose.yaml | 46 ++++++++++++++++++++++
 2 files changed, 73 insertions(+)
 create mode 100644 servers/media-core/wrapper-v2/README.md
 create mode 100644 servers/media-core/wrapper-v2/compose.yaml

diff --git a/servers/media-core/wrapper-v2/README.md b/servers/media-core/wrapper-v2/README.md
new file mode 100644
index 0000000..ddf474c
--- /dev/null
+++ b/servers/media-core/wrapper-v2/README.md
@@ -0,0 +1,27 @@
+# wrapper-v2 on media-core
+
+- HTTP control: `http://192.168.50.46:18080`
+- WV2D batch decrypt: `192.168.50.46:10020/tcp`
+- Runtime data: `/opt/wrapper-v2/data`
+- Image: locally built `wrapper-v2:0.0.2-100e0a8`
+- Source: official `glomatico/wrapper-v2` main commit `100e0a8`
+
+The image includes user-supplied Apple Music Android native libraries and is
+therefore built locally on media-core rather than published to a registry.
+Authentication state is not stored in Git or in the image.
+
+Compatible gamdl clients use:
+
+```bash
+gamdl \
+  --use-wrapper \
+  --wrapper-url http://192.168.50.46:18080 \
+  --wrapper-decrypt-host 192.168.50.46 \
+  --wrapper-decrypt-port 10020 \
+  --codec-song alac \
+  URL
+```
+
+The first client can complete wrapper login interactively. The persistent
+session is then shared by later clients through the service, not by copying
+credential files between hosts.
diff --git a/servers/media-core/wrapper-v2/compose.yaml b/servers/media-core/wrapper-v2/compose.yaml
new file mode 100644
index 0000000..8ad15b0
--- /dev/null
+++ b/servers/media-core/wrapper-v2/compose.yaml
@@ -0,0 +1,46 @@
+x-arcane:
+  icon: apple-music
+  urls:
+    - https://github.com/glomatico/wrapper-v2
+
+services:
+  wrapper-v2:
+    image: wrapper-v2:0.0.2-100e0a8
+    container_name: wrapper-v2
+    restart: unless-stopped
+    cap_add:
+      - SYS_ADMIN
+      - SYS_CHROOT
+      - SYS_PTRACE
+    security_opt:
+      - apparmor=unconfined
+    ports:
+      - "18080:80"
+      - "10020:10020"
+    environment:
+      WRAPPER_HOST: 0.0.0.0
+      WRAPPER_PORT: "80"
+      WRAPPER_DECRYPT_HOST: 0.0.0.0
+      WRAPPER_DECRYPT_PORT: "10020"
+      WRAPPER_WORKER_TIMEOUT_SECS: "60"
+      WRAPPER_RESTORE_SESSION: "1"
+      WRAPPER_APPLE_INIT: "1"
+    volumes:
+      - type: bind
+        source: /opt/wrapper-v2/data
+        target: /app/rootfs/data/data/com.apple.android.music/files
+        bind:
+          create_host_path: false
+    labels:
+      com.getarcaneapp.arcane.icon: apple-music
+    healthcheck:
+      test: ["CMD-SHELL", "bash -c 'exec 3<>/dev/tcp/127.0.0.1/80'"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+    logging:
+      driver: json-file
+      options:
+        max-size: 10m
+        max-file: "3"