Add Videola

[fgilde]

New app: Videola

What it is: a video editor that runs in the browser, with its project model, command bus and file
format in a Rust core compiled to WebAssembly. Import footage, cut it on a timeline, keyframe
anything, grade against real scopes, mix to a loudness target and export an MP4 — on the device
running the container, with nothing uploaded anywhere. Templates that bake into ordinary editable
projects, motion blur averaged over eight real instants of a shutter, spectral noise reduction, 5.1
surround with a position per track, scene detection, plus an HTTP API and an MCP server for agents.

• Project: https://github.com/fgilde/videola
• Website and docs: https://videola.app/
• Image: ghcr.io/fgilde/videola (GHCR, public)
• Licence: GPL-3.0

What is in the PR

Apps/Videola/

File
docker-compose.yml	one service, published on 7331 → container 7331, data under /DATA/AppData/$AppID/data
icon.png	256×256
thumbnail.png, screenshot-1..3.png	1568×884

Metadata: id: org.gilde.videola, main: videola, category Media, index: /,
port_map: "7331", architectures amd64, version: 0.9.1, title, tagline and description in
en_US and de_DE, a tips.before_install, and website / repo / support / docs.

The token in the package is a placeholder

Every /api call needs a token as Authorization: Bearer, and the server refuses to listen on
anything but loopback without one — so a package with no token would install an app that cannot
serve. It therefore ships VIDEOLA_TOKEN=change-this-token, and the before_install tip says, in
so many words, to replace it in the install dialog (openssl rand -hex 24). No host paths, no
socket, no privileged mode.

Architecture

amd64 only, and architectures says so; the image is not published for arm64 today.

Validation

• docker compose config -q on the app: clean.
• ./scripts/build_dist.sh with the app added: builds, and dist/index.json gains
  org.gilde.videola with the expected title, tagline, category, architectures, icon, thumbnail and
  version; dist/apps/org.gilde.videola/ has docker-compose.amd64.yml, meta.json and
  meta.de_DE.json. (rsvg-convert is missing on my machine, which affects every app equally.)
• The project's own test suite checks this package against the server's code: the published port,
  the storage root and the token requirement are read from the server rather than typed out, so a
  drifting package fails that build (apps/server/src/deploy.test.ts).
• The image was pulled and started from the generated compose; the editor loads on the published
  port and /api answers only with the token.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud