diff --git a/README.md b/README.md
index 85338f7b..2da2c664 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,7 @@ turn almost any device into a file server with resumable uploads/downloads using
 
 * top
     * [quickstart](#quickstart) - just run **[copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py)** -- that's it! 🎉
+        * [at home](#at-home) - make it accessible over the internet
         * [on servers](#on-servers) - you may also want these, especially on servers
     * [features](#features)
     * [testimonials](#testimonials) - small collection of user feedback
@@ -147,6 +148,17 @@ some recommended options:
   * see [accounts and volumes](#accounts-and-volumes) (or `--help-accounts`) for the syntax and other permissions
 
 
+### at home
+
+make it accessible over the internet  by starting a [cloudflare quicktunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/) like so:
+
+first download [cloudflared](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/) and then start the tunnel with `cloudflared tunnel --url http://127.0.0.1:3923`
+
+as the tunnel starts, it will show a URL which you can share to let anyone browse your stash or upload files to you
+
+since people will be connecting through cloudflare, run copyparty with `--xff-hdr cf-connecting-ip` to detect client IPs correctly
+
+
 ### on servers
 
 you may also want these, especially on servers:
diff --git a/copyparty/__version__.py b/copyparty/__version__.py
index bafbfc2f..0028fbb3 100644
--- a/copyparty/__version__.py
+++ b/copyparty/__version__.py
@@ -1,8 +1,8 @@
 # coding: utf-8
 
-VERSION = (1, 12, 1)
+VERSION = (1, 12, 2)
 CODENAME = "locksmith"
-BUILD_DT = (2024, 4, 9)
+BUILD_DT = (2024, 4, 12)
 
 S_VERSION = ".".join(map(str, VERSION))
 S_BUILD_DT = "{0:04d}-{1:02d}-{2:02d}".format(*BUILD_DT)
diff --git a/copyparty/web/splash.html b/copyparty/web/splash.html
index 4e625afa..1828afec 100644
--- a/copyparty/web/splash.html
+++ b/copyparty/web/splash.html
@@ -94,7 +94,7 @@ <h1 id="l">login for more:</h1>
 		<div>
 			<form method="post" enctype="multipart/form-data" action="{{ r }}/{{ qvpath }}">
 				<input type="hidden" name="act" value="login" />
-				<input type="password" name="cppwd" placeholder="password" />
+				<input type="password" name="cppwd" placeholder=" password" />
 				<input type="submit" value="Login" />
 				{% if ahttps %}
 				<a id="w" href="{{ ahttps }}">switch to https</a>
diff --git a/docs/changelog.md b/docs/changelog.md
index a16e93a8..13574527 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -1,3 +1,23 @@
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2024-0409-2334  `v1.12.1`  scrolling stuff
+
+## new features
+
+* while viewing pictures/videos, the scrollwheel can be used to view the prev/next file 844d16b9
+
+## bugfixes
+
+* #81 (scrolling suddenly getting disabled) properly fixed after @icxes found another way to reproduce it (thx) 4f0cad54
+* and fixed at least one javascript glitch introduced in v1.12.0 while adding dirkeys 989cc613
+  * directory tree sidebar could fail to render when popping browser history into the lightbox
+
+## other changes
+
+* music preloader is slightly less hyper f89de6b3
+* u2c.exe: updated TLS-certs and deps ab18893c
+
+
+
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
 # 2024-0406-2011  `v1.12.0`  locksmith
 
diff --git a/docs/devnotes.md b/docs/devnotes.md
index 57d47d15..10a14a2d 100644
--- a/docs/devnotes.md
+++ b/docs/devnotes.md
@@ -22,7 +22,6 @@
     * [complete release](#complete-release)
 * [debugging](#debugging)
     * [music playback halting on phones](#music-playback-halting-on-phones) - mostly fine on android
-* [todo](#todo) - roughly sorted by priority
     * [discarded ideas](#discarded-ideas)
 
 
@@ -312,17 +311,11 @@ mostly fine on android,  but still haven't find a way to massage iphones into be
 * conditionally starting/stopping mp.fau according to mp.au.readyState <3 or <4 doesn't help
 * loop=true doesn't work, and manually looping mp.fau from an onended also doesn't work (it does nothing)
 * assigning fau.currentTime in a timer doesn't work, as safari merely pretends to assign it
+* on ios 16.7.7, mp.fau can sometimes make everything visibly work correctly, but no audio is actually hitting the speakers
 
 can be reproduced with `--no-sendfile --s-wr-sz 8192 --s-wr-slp 0.3 --rsp-slp 6` and then play a collection of small audio files with the screen off, `ffmpeg -i track01.cdda.flac -c:a libopus -b:a 128k -segment_time 12 -f segment smol-%02d.opus`
 
 
-# todo
-
-roughly sorted by priority
-
-* nothing! currently
-
-
 ## discarded ideas
 
 * optimization attempts which didn't improve performance