## Decision **album-server** is deprecated and will be archived in a later release. album-server is the `album server` command plugin: a Flask REST API that remote-controls one album installation. Running solutions remotely, for example as jobs on an HPC cluster, stays a goal. It will not be built on album-server, and it gets its own decision (see "Not decided here"). ## What album-server is - A command plugin (`console_parsers_album` entry point `server`) in album-app/plugins/album-server. It was released once, as 0.1.0 on PyPI, and was never on conda-forge. It is not a solution plugin (those are #266), although its unmerged `solution-plugin` branch adds one (`album-server_launch-server`). - `album server --port 8080 --host 127.0.0.1` (the defaults) starts Flask's development server around one album instance. - Every route is a GET. - Synchronous: `/`, `/config`, `/index`, `/catalogs`, `/recently-launched`, `/recently-installed`, `/search/<keywords>`, `/add-catalog`, `/remove-catalog`, `/update`, `/upgrade`, `/shutdown`. - Asynchronous: `/install`, `/uninstall`, `/run`, `/test`, `/clone`, `/deploy`. They return a task id, and `/status/<id>` returns the task's status and log records. The query parameters of `/run` become the solution's command-line arguments. - The tasks run in three worker threads of album's `TaskManager`, inside the server process. Everything runs on the server host, as the user who started the server. Paths in arguments are paths on that host, and task ids and logs are lost when the server restarts. ## History | when | what | |---|---| | 2021-04 | album-app/album-app: an experimental Java GUI with `LocalAlbumInstallation` and `RemoteAlbumInstallation(host, port)`, which talks to album through an `AlbumServerService` | | 2021-05 | "Add hips server" (efb6650): the REST server, in core | | 2021-07 | asynchronous tasks through the `TaskManager`; `docs/server.md` | | 2022-03 | moved out of core into the album-server plugin (2280313) | | 2022-04 | last commit on `main` | | 2024-03 | two branches that were never merged: `dependencies-update` (Flask 2.3 and later) and `solution-plugin` | | 2025-10 | album-app/album-app archived | The Java app is the only client in the album-app group, and it is archived. album-client is the client of album-socket (ZeroMQ), not of album-server. album-docs still has `docs/server.md` in its index, marked "Outdated", and the developer wiki lists album-server as "Outdated". ## Why deprecate 1. **Security.** There is no authentication, and every route is a GET, including `/add-catalog`, `/install`, `/run`, `/deploy` and `/shutdown`. Anyone who can reach the port can add a catalog and install and run its code. A server that listens on 127.0.0.1 only is still reachable from a web page open in a browser on the same machine (cross-site request forgery). The 2021 docs already warned that it "enables others with access to the API to run arbitrary scripts on the system". This is the same profile as album-socket (#266). 2. **It does not work with current album.** Checked on `dev` (73925f5) with Python 3.14, Flask 3.1 and the `dependencies-update` branch: the server starts and the read-only routes answer, but `/install` and `/run` return HTTP 500 (`Task.__init__() missing 1 required positional argument: 'method'`), and `/status/<id>` raises `KeyError`. Uninstall, test, clone and deploy build their tasks the same way. From the code: - `main` does not import with Flask 2.3 or later (`flask.json.JSONEncoder`), so album skips the plugin with "Cannot load console parser server". - `/shutdown` relies on `werkzeug.server.shutdown`, which Werkzeug 2.1 removed. - `/deploy` passes the git name and email in swapped positions for the current `Album.deploy`. 3. **It is not a base for remote execution.** It runs everything in its own process, on its own host. Running solutions on a cluster needs a per-user identity on the cluster, submission to the scheduler, a job store that survives restarts, and data staging. HPC sites already offer these in forms they accept (SSH, their own REST APIs, Globus Compute). Using album-server for that would mean a rewrite, not a revival. 4. **No maintenance.** `main` has not changed since 2022-04, the 2024-03 branches were never merged, and nothing tests it against a current album. ## What to use instead - On the local machine: the album CLI, the Python API (`album.api.Album`) and album-gui. - For agents: album-mcp. - On a remote machine: album itself, through SSH (the CLI, or album-mcp over stdio). ## Plan Deprecation, now: - [x] this decision - [ ] a deprecation notice in the README of album-server, as album-app/plugins/album-socket!1 adds for album-socket - [ ] album-docs: mark `docs/server.md` as deprecated with a link to this issue, or remove it from the index - [ ] developer wiki: list album-server as deprecated instead of "Outdated" - [ ] the comment on `DefaultValues.server_port` / `server_host` links this decision: !313 Removal, in a later release: - [ ] archive album-server - [ ] remove `DefaultValues.server_port` and `server_host` once album-server and album-socket (#266) are both archived. Both plugins read `server_port` when they are imported. ## Not decided here Remote execution of solutions, for example as SLURM jobs on an HPC cluster. It stays a goal and will get its own decision. Changelog (unreleased, Deprecated): "album-server (`album server`) is deprecated (#268)". Decided by the maintainer after a review of album-server, prompted by item 6 of !313 (#263). 🤖 Generated with [Claude Code](https://claude.com/claude-code)