diff --git a/server_apps.go b/server_apps.go
index ddb53acefd7244f6ccf41a16713a40d52e637ea1..ea0aa14e0f77753e37547593f0bf5020bd69ab04 100644
--- a/server_apps.go
+++ b/server_apps.go
@@ -7,6 +7,7 @@ import (
 	"io"
 	"log"
 	"net/http"
+	"path"
 	"regexp"
 	"strings"
 	"time"
@@ -21,6 +22,7 @@ import (
 
 type appDescriptor struct {
 	repository string
+	pathInRepo string
 	appInfo    *appInfo
 }
 
@@ -38,10 +40,11 @@ var (
 	reAppRepo = regexp.MustCompile(`^([a-zA-Z\-_\.0-9]+)/([a-zA-Z\-_0-9]+)$`)
 )
 
-func (s *server) parseAppToml(ctx context.Context, obj *object.Commit) (*appInfo, error) {
-	f, err := obj.File("flow3r.toml")
+func (s *server) parseAppToml(ctx context.Context, pathInRepo string, obj *object.Commit) (*appInfo, error) {
+	p := path.Join(pathInRepo, "flow3r.toml")
+	f, err := obj.File(p)
 	if err != nil {
-		return nil, fmt.Errorf("toml open failed: %w", err)
+		return nil, fmt.Errorf("toml open (%q) failed: %w", p, err)
 	}
 	reader, err := f.Reader()
 	if err != nil {
@@ -99,7 +102,7 @@ func (s *server) parseAppToml(ctx context.Context, obj *object.Commit) (*appInfo
 	}, nil
 }
 
-func (s *server) getAppInfo(ctx context.Context, repo string) (*appInfo, error) {
+func (s *server) getAppInfo(ctx context.Context, pathInRepo, repo string) (*appInfo, error) {
 	url := "https://git.flow3r.garden/" + repo
 	g, err := git.Clone(memory.NewStorage(), nil, &git.CloneOptions{
 		URL: url,
@@ -116,7 +119,7 @@ func (s *server) getAppInfo(ctx context.Context, repo string) (*appInfo, error)
 		return nil, fmt.Errorf("no branches")
 	}
 	var bname string
-	for name, _ := range cfg.Branches {
+	for name := range cfg.Branches {
 		bname = name
 		break
 	}
@@ -141,7 +144,7 @@ func (s *server) getAppInfo(ctx context.Context, repo string) (*appInfo, error)
 	highsetVerNil := true
 	firstTime := make(map[int]*appInfo)
 	for {
-		info, err := s.parseAppToml(ctx, obj)
+		info, err := s.parseAppToml(ctx, pathInRepo, obj)
 		if err == nil {
 			ver := info.version
 			firstTime[ver] = info
@@ -149,6 +152,8 @@ func (s *server) getAppInfo(ctx context.Context, repo string) (*appInfo, error)
 				highestVer = ver
 				highsetVerNil = false
 			}
+		} else {
+			log.Printf("%s@%s: %v", repo, obj.Hash.String(), err)
 		}
 		if len(obj.ParentHashes) == 0 {
 			break
@@ -224,7 +229,8 @@ func (s *server) getAppRegistry(ctx context.Context) ([]*appDescriptor, error) {
 
 		dec := toml.NewDecoder(reader)
 		var dat struct {
-			Repo string
+			Repo       string
+			PathInRepo string `toml:"path_in_repo"`
 		}
 		err = dec.Decode(&dat)
 		reader.Close()
@@ -232,6 +238,7 @@ func (s *server) getAppRegistry(ctx context.Context) ([]*appDescriptor, error) {
 			log.Printf("App %q: couldn't parse TOML: %v", m[1], err)
 			continue
 		}
+		log.Printf("%+v", dat)
 		n := reAppRepo.FindStringSubmatch(dat.Repo)
 		if n == nil {
 			log.Printf("App %q: invalid repo %q", m[1], dat.Repo)
@@ -239,11 +246,12 @@ func (s *server) getAppRegistry(ctx context.Context) ([]*appDescriptor, error) {
 		}
 		res = append(res, &appDescriptor{
 			repository: dat.Repo,
+			pathInRepo: dat.PathInRepo,
 		})
 	}
 
 	for _, app := range res {
-		info, err := s.getAppInfo(ctx, app.repository)
+		info, err := s.getAppInfo(ctx, app.pathInRepo, app.repository)
 		if err != nil {
 			log.Printf("App %q: %v", app.repository, err)
 			continue
@@ -267,7 +275,7 @@ func (s *server) handleApps(w http.ResponseWriter, r *http.Request) {
 	type app struct {
 		RepoURL     string `json:"repoUrl"`
 		Commit      string `json:"commit"`
-		DownloadURL string `json:"downloadURL"`
+		DownloadURL string `json:"downloadUr"`
 		Name        string `json:"name"`
 		Menu        string `json:"menu"`
 		Author      string `json:"author"`
@@ -302,6 +310,7 @@ func (s *server) handleApps(w http.ResponseWriter, r *http.Request) {
 			Version:     a.appInfo.version,
 		})
 	}
+	w.Header().Add("Access-Control-Allow-Origin", "*")
 	w.Header().Add("Content-Type", "application/json")
 	j := json.NewEncoder(w)
 	j.Encode(resp)
diff --git a/server_releases.go b/server_releases.go
index 6919d24fc18437414f2e872d619254faef4b3126..ffbef4ae14825ef9c76ba2e1b409a48cc6504996 100644
--- a/server_releases.go
+++ b/server_releases.go
@@ -96,6 +96,7 @@ func (s *server) handleReleases(w http.ResponseWriter, r *http.Request) {
 			Partitions: partitions,
 		})
 	}
+	w.Header().Add("Access-Control-Allow-Origin", "*")
 	w.Header().Add("Content-Type", "application/json")
 	j := json.NewEncoder(w)
 	j.Encode(resp)