wanderer, the self-hosted trail database, put its mobile app into public beta. Android joins through the Google Play open test or an APK from the app-v* pre-releases on GitHub; iOS and iPadOS take TestFlight. The app records and navigates trails, downloads regions for offline use, and syncs with your instance. Some corners are read-only for now: comments, summit logs and lists. The feature matrix at wanderer.to/app tells you exactly where it is thin, which is the honest way to ship a beta.
Admins: read this before upgrading
v0.21.0 makes POCKETBASE_PROXY_SECRET a required environment variable. Inbound ActivityPub deliveries are now authenticated between the web and db services, and that is the shared secret. Set the same random value on both services, generated with something like openssl rand -hex 32. If it is missing, or the two values differ, your instance rejects all incoming federation. This is the kind of upgrade that fails silently by design, so it is worth doing in the right order.
A security pass in the same release
The release also closes a long list of gaps, mostly around federation and sharing. Remote actors can no longer delete local trails or lists they do not own. Comments, summit logs and likes bind the author to the authenticated user, so content cannot be created in someone else’s name. Anonymous and remote accounts lose their paths to private trails, lists and comments, share updates can no longer grant access to another user’s trail, and the SSRF filter now blocks IPv6 transition addresses that embed internal IPv4 addresses. Five advisories ride in one PR, with a handful more alongside.
Also in v0.21.0
The statistics page counts trails marked as completed as activities, gains period presets, a custom range and a calendar that browses on its own. Komoot imports keep the provider’s difficulty rating instead of filing everything as easy. There is a new info panel for plugins, an OIDC_SCOPES override, OAuth signups that keep your provider username, and a privacy policy at /privacy. Translations filled in for Czech and Italian, and trail date filters now cover the whole selected day in your local time zone. Under the hood: cards and galleries load thumbnails instead of full-resolution photos, and elevation profile smoothing got faster.
My read
The beta is the fun part; the env var is the part that bites whoever skims. That is the shape of federation upgrades generally: one shared secret set on both services, or every delivery fails without saying why. Read the install page, then go look at your trails in your pocket. Test the offline regions first; that is the feature that decides whether the app earns a place on the next hike.
Source: the v0.21.0 release notes.