sentriz / gonic Goto Github PK

Hey,

subsonic supports authentication against a ldap server. This feature would be nice. Additionally the oauth support.

thanks
sam

Portainer Volumes:
https://i.imgur.com/wpsSvY0.png
Portainer Env:
https://i.imgur.com/OOUrPvT.png

Am I missing something obvious?

Could you give an example of what the playlist structure would look like in m3u8?. It is a very good option to avoid losing the playlists.

There are subsonic views accepting IDs for different types like getArtistInfo:

id The artist, album or song ID.

Is there any plan on how to handle this or am I missing some view where this is already supported?

My idea would be to provide all ids in the form of album:1,
artist:1 and song:1 or track:1 and maybe add some helper to the params package like:

// GetAlbumId returns the album ID or an error if the type prefix is not `album` or has no integer suffix.
params.GetAlbumId("id") (int, error)
// GetId returns the type prefix or an error if the ID has a wrong format or has no integer suffix.
params.GetId("id") (string, int, error)

Currently getArtistInfo2 is implemented per getArtistInfo spec, getArtistInfo2 uses ID3 tags, but gonic implements it by using lastfm info, to fix this the ambiguous IDs have to be managed.

All other endpoints seem fine from what I can tell, but I get a failed CORS issue when attempting to retrieve getPlaylist.view endpoint.

found this post on reddit:
https://www.reddit.com/r/selfhosted/comments/dznn7d/gonic_golang_subsonic_compatible_server/f8cl7pr

I do have exactly the same behaviour:

"Connection failure. Resource not found. Please check the server address."

Funny thing is, when I tap on the option "open in browser" inside the server setup page in dsub, it opens the right page.

cheers!

Anyone seen this issue before?

I get it navigating to some folders in my Library view. On the gonic logs, I just see a successful request

/rest/getMusicDirectory.view?u=admin&p=enc:<OMITTED>&v=1.2.0&c=DSub&id=8330

I wrote a subsonic-compatible web UI which works great with Airsonic. I'm sure it would also work with gonic, but it looks like I'm getting some CORS issues in the browser.

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://gonic.mydomain.com/rest/getAlbum.view?f=json&c=qooxtun…15&u=USERNAME&s=I79q1o&t=TOKEN&id=56. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).

Would something like this be an easy fix? It looks like all of the errors in my console are for the getAlbum.view endpoint?

When installing with go get, the following error occurs:
package syscall/js: unrecognized import path "syscall/js" (import path does not begin with hostname).
As prerequisites I have only installed go-lang

Are all users of the server reporting to the same last.fm account? Is it possible for it to be per-user?

According to Mozilla Observatory there are security flaws regarding the cookie generated by Gonic against XSS attacks. It does not implement neither Secure HttpOnly SameSite options nor prefixes:

More information can be found here.

https://e-six-two.one/i/q4nyenv5.png

For some reason, the year is set to January.

With this ability it is possible, to use playlists on devices without subsonic client.

Hello

Great software, thank you! I use gonic with Jamstash or Subfire. My question: Is there an option available to browse the folders in alphabetical order (descending/ascending)? I don't know if this is an issue by gonic anyway.
Thanks for any advice.

schui95

I noticed a weird thing with web UI — if a recently added folder has a very long name, it'll cause the list to overflow and "break through" its container:

It should be possible to limit length of these entries either in the backend (by truncating the folder name to some pre-defined length) or by using CSS:

.ellipsis {
  text-overflow: ellipsis;

  /* Required for text-overflow to do anything */
  white-space: nowrap;
  overflow: hidden;
}

The second approach will allow to show full folder name on mouseover with some kind of a tooltip.

For clients apps to tailor the user interface to the exact server capabilities, it would be helpful to expose a way to determine servertype and version.

In an ideal world, the "version" property of the Subsonic responses would be enough.
In practice servers like Gonic implement a subset of the Subsonic API.

Allowing the client apps to learn the server type and version facilitates tailoring exposed functionality to what the server actually support.

Many servers (funk whale, madsonic, ampache, ...) expose a "type" property on all Subsonic responses, for example a ping-response from funkwhale:
{ "subsonic-response": { "status": "ok", "version": "1.16.0", "type": "funkwhale", "funkwhaleVersion": "0.17" } }

Some servers do not expose "type" in responses, but have information in the getLicense-response that can be used to know servertype... For example AirSonic has "email": "[email protected]".

If for example "type" and "gonicVersion" is added to responses, clients like play:Sub Music Streamer (https://apps.apple.com/fr/app/play-sub-music-streamer/id955329386) will be able to make a tailored UI for Gonic.

The latest git tag is v0.4.2, but there are a number of other releases on the master branch (0.5.0, 0.6.0, etc.)

Having these versions tagged makes it very easy to compare what changes between versions.

The README shows some yaml but it does not seem to be docker-compose yaml.

What is it and how does one use it?

Hi,

Maybe a stupid question, but I'll ask it anyway.

I'm working with my home multiroom system. I've used moode audio for a while (because of it's ok layout (albums showing and easy connect to radiostations). It's using the mpd platform. I'm not sure why, but I haven't found any apps to have the music offline on my phone. Therefore I've recently installed airsonic, tried to run it in jukebox mode, then tried to connect it to snapcast. I don't like the web layout and I'm not sure if the community is supporting airsonic. Then I found the revel and navidrome projects. Now I stumbled across gonic, it seems like you have a lot of things going. Then to my questions:

Why did you chose the subsonic platform, why not eg. mpd platform?

Is implementing ratings per track a goal?

At the moment device profiles (the one set in the web UI) are per-user, not server-wide (which is understandable), but DB seems to have a UNIQUE constraint on client name:

2020/03/24 03:02:40 response  303  for `/admin/create_transcode_pref_do`
gorm error/src/server/ctrladmin/handlers.go:292 UNIQUE constraint failed: transcode_preferences.client, transcode_preferences.profile

Maybe it'd be better to check for "user ID and client name" combo instead? This way different users can set different transcoding profiles for same clients.

(I'd rather have a server-wide transcoding profile list, but this might be unacceptable for others, so... :D)

Stuck on "Shuffle list is loading" in Audinaut.

Hello @sentriz!

First of all, thank you so much for making this awesome server! It works wonders in low-CPU/RAM environments, compared to traditional JVM-powered Subsonic implementations.

But I think there's still one thing that many people would love to see: transcoding support. Are there any plans for implementing it? If not (or if you don't have enough time for it), will you accept any PRs that implement this?

I currently have a Gonic database with 83007 tracks. After Gonic finishes running an incremental scan, I get:

Apr 29 14:00:22 gonic[318]: 2020/04/29 14:00:22 finished scan in 4m33.9894
92757s, +727/83734 tracks (19 err)

The errors are related to tag reading from a few flac and m4a files.

After this, I see the new number of tracks as 83734 via the web interface, which is correct. Then, cleanup runs, and I get:

Apr 29 14:02:53 idris gonic[318]: 2020/04/29 14:02:53 finished clean in 2m30.910
381764s, -0 tracks

Right after this, the number of tracks reverts to 83007 tracks again.

What is interesting is that even if I run a full scan, Gonic does not seem to pick up all the tracks.

It seems that Gonic does not support the getGenres endpoint. Is this in the roadmap? (I know you are busy, I just graduated and I know the final year pains.)

This is affecting a user of my Subsonic client:
https://gitlab.com/sumner/sublime-music/issues/109#note_284391742
(arguably, my client should be more resilient to not having certain endpoints missing, and that's a goal I have in the future, but I just wanted to make you aware on the server-side.)

I love the ability to force a full scan. Do you think we could implement a force 'partial' scan? Possibly something that takes a directory as an argument? I have a massive library and if I need to force update a single artist / album, a 'force full scan' takes almost 2 hours for me.

Would be nice to change the admin account name :)

hi everyone in the issues

notably
#20, #19, #18, #14, #13, and #7

I'm currently in my final year of college and very busy with a big project and other deadlines :(
Our Christmas holidays are coming soon though. I'll definitely be working gonic then.

Sorry for the wait, and thanks for opening the issues

The play:Sub Music Streamer (https://apps.apple.com/fr/app/play-sub-music-streamer/id955329386) failed to connect to Gonic server (eg. https://gonic.example.com) with correct login credentials.

The docker logs command shows:

gonic_1                  | 2019/11/25 13:04:40 response  400  for `/rest/ping.view`

Thank you for your work!

Steps to reproduce:

1. Log in as admin.
2. Either creat a user or use an existing one.
3. Click on the Change Password link next to any account.

The password should change for the chosen user, but the admin password changes instead.

What
Add an option to force a full rescan. In other words, rescan all files even when the file modified timestamp has not changed.

Why
It's possible for a file's contents to change without having it's modified timestamp updated. For example, my harmonize tool makes use of this in order to detect when a file needs to be reencoded.

Additional Information
My initial Gonic library scanned my Opus 192kbps collection. I later reencoded the collection as Opus 128kbps. The file paths and modified timestamps were unchanged.

After a library rescan, I noticed that album titles were missing. Note that the last row has a title. All albums except for the last row were added to my Gonic library prior to reencoding it.

sqlite> select * from albums where parent_id = 2578;
id          updated_at                           modified_at                         left_path   right_path                             right_path_u_dec  parent_id   cover       tag_artist_id  tag_title   tag_title_u_dec  tag_brainz_id  tag_year  
----------  -----------------------------------  ----------------------------------  ----------  -------------------------------------  ----------------  ----------  ----------  -------------  ----------  ---------------  -------------  ----------
2579        2019-12-02 00:56:01.796632971+00:00  2019-12-01 23:00:51.10143354+00:00  Zero Cult/  Zero Cult - Clouds Garden-2010 (FLAC)                    2578        cover.jpg   348                                                        0         
2580        2019-12-02 00:56:01.798885783+00:00  2019-12-01 23:00:40.711482557+00:0  Zero Cult/  Zero Cult - Closer Than Ever (2016) [                    2578        cover.jpg   348                                                        0         
2581        2019-12-02 00:56:01.803979479+00:00  2019-12-01 23:00:21.041575276+00:0  Zero Cult/  Zero Cult - Aleph (2014) FLAC-Web                        2578        cover.jpg   348                                                        0         
2582        2019-12-02 00:56:01.806533632+00:00  2019-12-01 23:01:03.921373022+00:0  Zero Cult/  Zero Cult - Excort (Unicorn Music, EP                    2578        cover.jpg   348                                                        0         
2583        2019-12-02 00:56:01.805637216+00:00  2019-12-01 23:01:14.571322713+00:0  Zero Cult/  Zero Cult - Ikebana                                      2578        cover.jpg   348                                                        0         
2584        2019-12-02 00:56:01.811363163+00:00  2019-12-01 23:01:31.05124481+00:00  Zero Cult/  Zero Cult - Shining (2012) FLAC-Web                      2578        cover.jpg   348                                                        0         
2585        2019-12-02 00:56:01.808944789+00:00  2019-12-01 23:00:30.161532297+00:0  Zero Cult/  Zero Cult - Art of Harmony                               2578        cover.jpg   348                                                        0         
2586        2019-12-02 00:56:01.810638947+00:00  2019-12-01 23:01:45.371177063+00:0  Zero Cult/  Zero Cult - Vacuum (Cosmicleaf Rec. 2                    2578        cover.jpg   348                                                        0         
2587        2019-12-02 00:56:01.792687937+00:00  2019-12-01 23:01:23.861278809+00:0  Zero Cult/  Zero Cult - Inside Out (2015) FLAC-We                    2578        cover.jpg   348                                                        0         
2588        2019-12-02 00:56:01.803065489+00:00  2019-12-01 23:01:03.23137628+00:00  Zero Cult/  Zero Cult - Dreams in Stereo                             2578        cover.jpg   348                                                        0         
2589        2019-12-02 00:56:01.800880099+00:00  2019-12-01 23:01:55.071131142+00:0  Zero Cult/  Zero Cult - Where Rivers Have No Name                    2578        cover.jpg   348                                                        0         
2590        2019-12-02 00:56:01.807273372+00:00  2019-12-01 23:01:27.601261124+00:0  Zero Cult/  Zero Cult - Tangoa (2018)                                2578        cover.jpg   348                                                        0         
2591        2019-12-02 00:56:01.793452163+00:00  2019-12-01 23:00:20.621577255+00:0  Zero Cult/  Zero Cult - Absolute Zero (2013)                         2578        cover.jpg   348                                                        0         
2592        2019-12-02 00:56:01.795370157+00:00  2019-12-02 00:55:30.080528292+00:0  Zero Cult/  Zero Cult - Pop Insanity (2013) FLAC-                    2578        cover.jpg   348            Pop Insani                                  2013      

Cant seem to find any?

Currently, m4b audio books do not seem to be picked up by a Gonic scan.

Taglib has support for their metadata.

Would it be possible to support these files in the future please?

Thanks for this great project !

But a major feature of Airsonic is missing, be able to have multiple libraries.

As far as I can tell scans can only be triggered manually from the webui.

It would be nice to have automatic scheduled scanning. Or even better scanning triggered by file changes in the music dir.

Using the latest docker version (0.4.3), scanner report:
2019/12/16 14:25:28 finished scan in 379.254659ms, +226/435 tracks (0 err)

But only 209 track are added to the database.
The folder structure is: Artist/Album/Tracks

What seem to not work correctly are the 2 folders were i put various mp3.
For those 2 folders, sometimes 2 songs are added to the database, sometimes more, never all.

Thanks for gonic !

Hello,
recently gonic started throwing errors when I want to play a playlist.
I tried multiple clients until I had a look at my logs today. Just to have a clean and reproducable setup, I restarted the docker client and did the absolut minimum to cause it again.

Steps:

1. start gonic using sentriz/gonic:latest@sha256:2033827c90073f3dfdcbea26e9482521595fb8ce27257410af1b35796d6
2. Go to any client. I tried Audinaut, DSub and Music Stash.
3. Open a playlist.

Thats it. Upon opening the playlist it shows the below errors in the log and every client responds a bit different but most say there was a server error.

2020/05/26 16:25:04 starting gonic v0.8.8
2020/05/26 16:25:04 provided config
2020/05/26 16:25:04     cache-path      /cache
2020/05/26 16:25:04     config-path     
2020/05/26 16:25:04     db-path         /data/gonic.db
2020/05/26 16:25:04     jukebox-enabled false
2020/05/26 16:25:04     listen-addr     :80
2020/05/26 16:25:04     music-path      /music
2020/05/26 16:25:04     proxy-prefix    
2020/05/26 16:25:04     scan-interval   720
2020/05/26 16:25:04     version         false
2020/05/26 16:25:04 starting job 'scan timer'
2020/05/26 16:25:04 starting job 'session clean'
2020/05/26 16:25:04 starting job 'http'
2020/05/26 16:25:15 http: panic serving 172.17.0.1:42946: runtime error: invalid memory address or nil pointer dereference
goroutine 34 [running]:
net/http.(*conn).serve.func1(0xc000488000)
	/usr/local/go/src/net/http/server.go:1772 +0x139
panic(0xa34380, 0xf90e60)
	/usr/local/go/src/runtime/panic.go:975 +0x3e3
go.senan.xyz/gonic/server/ctrlsubsonic/spec.NewTCTrackByFolder(0xc0000ee0f0, 0x0, 0xc0000ee0f0)
	/src/server/ctrlsubsonic/spec/construct_by_folder.go:49 +0xae
go.senan.xyz/gonic/server/ctrlsubsonic.(*Controller).ServeGetPlaylist(0xc000382d00, 0xc000498400, 0xc0002ec500)
	/src/server/ctrlsubsonic/handlers_common.go:169 +0x6fb
go.senan.xyz/gonic/server/ctrlsubsonic.(*Controller).H.func1(0xbc55e0, 0xc0004800a0, 0xc000498400)
	/src/server/ctrlsubsonic/ctrl.go:91 +0x33
net/http.HandlerFunc.ServeHTTP(0xc0003c4940, 0xbc55e0, 0xc0004800a0, 0xc000498400)
	/usr/local/go/src/net/http/server.go:2012 +0x44
go.senan.xyz/gonic/server/ctrlsubsonic.(*Controller).WithUser.func1(0xbc55e0, 0xc0004800a0, 0xc000498300)
	/src/server/ctrlsubsonic/middleware.go:88 +0x4cb
net/http.HandlerFunc.ServeHTTP(0xc000480020, 0xbc55e0, 0xc0004800a0, 0xc000498300)
	/usr/local/go/src/net/http/server.go:2012 +0x44
go.senan.xyz/gonic/server/ctrlsubsonic.(*Controller).WithRequiredParams.func1(0xbc55e0, 0xc0004800a0, 0xc000498300)
	/src/server/ctrlsubsonic/middleware.go:52 +0x121
net/http.HandlerFunc.ServeHTTP(0xc0002e43f0, 0xbc55e0, 0xc0004800a0, 0xc000498300)
	/usr/local/go/src/net/http/server.go:2012 +0x44
go.senan.xyz/gonic/server/ctrlsubsonic.(*Controller).WithParams.func1(0xbc55e0, 0xc0004800a0, 0xc000498200)
	/src/server/ctrlsubsonic/middleware.go:33 +0x17c
net/http.HandlerFunc.ServeHTTP(0xc000480040, 0xbc55e0, 0xc0004800a0, 0xc000498200)
	/usr/local/go/src/net/http/server.go:2012 +0x44
go.senan.xyz/gonic/server/ctrlbase.(*Controller).WithCORS.func1(0xbc55e0, 0xc0004800a0, 0xc000498200)
	/src/server/ctrlbase/ctrl.go:82 +0x300
net/http.HandlerFunc.ServeHTTP(0xc000480060, 0xbc55e0, 0xc0004800a0, 0xc000498200)
	/usr/local/go/src/net/http/server.go:2012 +0x44
go.senan.xyz/gonic/server/ctrlbase.(*Controller).WithLogging.func1(0xbc5920, 0xc0004a4000, 0xc000498200)
	/src/server/ctrlbase/ctrl.go:65 +0x9d
net/http.HandlerFunc.ServeHTTP(0xc000480080, 0xbc5920, 0xc0004a4000, 0xc000498200)
	/usr/local/go/src/net/http/server.go:2012 +0x44
github.com/gorilla/mux.(*Router).ServeHTTP(0xc0000f0600, 0xbc5920, 0xc0004a4000, 0xc000498000)
	/go/pkg/mod/github.com/gorilla/[email protected]/mux.go:210 +0xe2
net/http.serverHandler.ServeHTTP(0xc0000e42a0, 0xbc5920, 0xc0004a4000, 0xc000498000)
	/usr/local/go/src/net/http/server.go:2807 +0xa3
net/http.(*conn).serve(0xc000488000, 0xbc7060, 0xc000482040)
	/usr/local/go/src/net/http/server.go:1895 +0x86c
created by net/http.(*Server).Serve
	/usr/local/go/src/net/http/server.go:2933 +0x35c
2020/05/26 16:25:15 http: panic serving 172.17.0.1:42950: runtime error: invalid memory address or nil pointer dereference
goroutine 54 [running]:
net/http.(*conn).serve.func1(0xc0000a2320)
	/usr/local/go/src/net/http/server.go:1772 +0x139
panic(0xa34380, 0xf90e60)
	/usr/local/go/src/runtime/panic.go:975 +0x3e3
go.senan.xyz/gonic/server/ctrlsubsonic/spec.NewTCTrackByFolder(0xc0004d0d20, 0x0, 0xc0004d0d20)
	/src/server/ctrlsubsonic/spec/construct_by_folder.go:49 +0xae
go.senan.xyz/gonic/server/ctrlsubsonic.(*Controller).ServeGetPlaylist(0xc000382d00, 0xc000222400, 0xc00021e480)
	/src/server/ctrlsubsonic/handlers_common.go:169 +0x6fb
go.senan.xyz/gonic/server/ctrlsubsonic.(*Controller).H.func1(0xbc55e0, 0xc000198100, 0xc000222400)
	/src/server/ctrlsubsonic/ctrl.go:91 +0x33
net/http.HandlerFunc.ServeHTTP(0xc0003c4940, 0xbc55e0, 0xc000198100, 0xc000222400)
	/usr/local/go/src/net/http/server.go:2012 +0x44
go.senan.xyz/gonic/server/ctrlsubsonic.(*Controller).WithUser.func1(0xbc55e0, 0xc000198100, 0xc000222300)
	/src/server/ctrlsubsonic/middleware.go:88 +0x4cb
net/http.HandlerFunc.ServeHTTP(0xc000198000, 0xbc55e0, 0xc000198100, 0xc000222300)
	/usr/local/go/src/net/http/server.go:2012 +0x44
go.senan.xyz/gonic/server/ctrlsubsonic.(*Controller).WithRequiredParams.func1(0xbc55e0, 0xc000198100, 0xc000222300)
	/src/server/ctrlsubsonic/middleware.go:52 +0x121
net/http.HandlerFunc.ServeHTTP(0xc00008d380, 0xbc55e0, 0xc000198100, 0xc000222300)
	/usr/local/go/src/net/http/server.go:2012 +0x44
go.senan.xyz/gonic/server/ctrlsubsonic.(*Controller).WithParams.func1(0xbc55e0, 0xc000198100, 0xc000222200)
	/src/server/ctrlsubsonic/middleware.go:33 +0x17c
net/http.HandlerFunc.ServeHTTP(0xc000198040, 0xbc55e0, 0xc000198100, 0xc000222200)
	/usr/local/go/src/net/http/server.go:2012 +0x44
go.senan.xyz/gonic/server/ctrlbase.(*Controller).WithCORS.func1(0xbc55e0, 0xc000198100, 0xc000222200)
	/src/server/ctrlbase/ctrl.go:82 +0x300
net/http.HandlerFunc.ServeHTTP(0xc000198080, 0xbc55e0, 0xc000198100, 0xc000222200)
	/usr/local/go/src/net/http/server.go:2012 +0x44
go.senan.xyz/gonic/server/ctrlbase.(*Controller).WithLogging.func1(0xbc5920, 0xc0004a40e0, 0xc000222200)
	/src/server/ctrlbase/ctrl.go:65 +0x9d
net/http.HandlerFunc.ServeHTTP(0xc0001980c0, 0xbc5920, 0xc0004a40e0, 0xc000222200)
	/usr/local/go/src/net/http/server.go:2012 +0x44
github.com/gorilla/mux.(*Router).ServeHTTP(0xc0000f0600, 0xbc5920, 0xc0004a40e0, 0xc000222000)
	/go/pkg/mod/github.com/gorilla/[email protected]/mux.go:210 +0xe2
net/http.serverHandler.ServeHTTP(0xc0000e42a0, 0xbc5920, 0xc0004a40e0, 0xc000222000)
	/usr/local/go/src/net/http/server.go:2807 +0xa3
net/http.(*conn).serve(0xc0000a2320, 0xbc7060, 0xc0001c0000)
	/usr/local/go/src/net/http/server.go:1895 +0x86c
created by net/http.(*Server).Serve
	/usr/local/go/src/net/http/server.go:2933 +0x35c

Not sure if this is relevant but I recently started renaming a few songs. I'm pretty sure this should not affect anything but I just thought it could help pinpoint the problem.

Thanks for gonic btw :)

I am not entirely sure why, but when streaming/downloading an m4b file, an incorrect mimetype video/mp4 is returned, instead of audio/m4b. I believe this is when the stream.view handler is invoked.

I haven't really seen a reference to this anywhere in the Gonic sources, is it possible that the mimetype is something http.ServeFile() returns, along with the file?

If so, is it possible to overwrite this with the mimetypes defined in Gonic?

The mimetype for m4b is definitely audio/m4b, see here

I am currently testing this issue via Play:Sub.

It would be great if gonic supported libre.fm as an alternative to Last.fm. Libre.fm should implement the same scrobbling API as Last.fm, so the only differences would need to be the authentication flow.

If this is something you'd consider adding to the project I'd be happy to help with the implementation!

Airsonic includes more metadata information than gonic does, specifically year and genre. Can we get these included in the response from gonic?

$ go get senan.xyz/g/gonic/cmd/gonic
$ gonic
-bash: gonic: command not found

Trying to install this on Arch. Sorry I don't really know anything about go if I'm missing something obvious.

Also ability to import via M3U8 files would be amazing.

the "Subsonic API" actually varies with time (different releases) and space (different forks) so it would be quite interesting to see which parts are actually implemented in gonic. the supysonic server has this API implementation status page which details what they implemented and why. for example, shares are not implemented and might never be. it also has a list of revisions to the API which could prove quite useful.

has equivalent work been done on gonic?

thanks for this nice project!

Ability to add podcast RSS feeds to monitor and download new episodes.

Currently, Gonic does not detect and follow symbolic links pointing to directories.

Not having the ability to specify multiple paths, e.g. one for audio books, music, podcasts, etc, it is currently not possible to add multiple sources.

Implementing symbolic links support would be one way of allowing this.

Using the Mozilla Laboratory addon on Gonic, it generates the following Content Security Policy (CSP):

default-src 'none'; font-src https://cdn.materialdesignicons.com; form-action 'self'; img-src 'self'; script-src 'unsafe-inline'; style-src 'self' https://cdn.materialdesignicons.com/3.6.95/css/

This seems to work well, when used for instance behind nginx as a reverse proxy.
However, this policy shows the presence of unsafe-inline scripts in Gonic. Using inline JS is a security flaw at the foundation of an XSS attack, which is when an attacker finds a way to inject scripts into the page (more information here).

I found the related content in the code. This script should be externalized in a separate .js file before we can remove script-src 'unsafe-inline'; from the CSP.

it would be nice if i could ignore some parts of a tree.

e.g.
.gonicignore file in the root with contents:

html
lost+found
templates

I have those folders for some other projects and they need not be scanned.

I'd like to implement this and send a PR if you would accept it.

should respond to gonic --version ?

Add the parameter "lang" to the last.fm requests and add a selection or text field for the parameter next to the api key