feat(container): manifest-declared generated secrets + companion/quadlet hardening

lfg2025/archy

Generated-secrets system: apps declare `generated_secrets` in their manifest
(kinds hex16/hex32/bcrypt); `container::secrets::ensure_generated_secrets`
materialises them 0600/rootless in resolve_dynamic_env — idempotent and
self-healing (recovers wrongly root-owned secrets with no privilege). Replaces
per-app Rust (deletes ensure_fmcd_password). fedimint-clientd/gateway manifests
now declare fmcd-password / fedimint-gateway-hash.

companion.rs: rebuild the auto-built :latest image when its build context changes
(staleness check) so baked-in fixes (e.g. guardian-UI CSS) actually reach nodes.

quadlet.rs: skip PublishPort under Network=host (podman rejects the combo, exit
125) + regression tests.

UI: "Fedimint Guardian" rename, fedimint-clientd/nostr-rs-relay/meshtastic tagged
as Services (headless backends), gateway icon fallback.

Deployed + verified on .228 (generated-secrets fixed fedimint-gateway start;
grafana/strfry orphan crash-loop units removed).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

This commit is contained in:

archipelago

2026-06-21 05:11:07 -04:00

co-authored by

Claude Opus 4.8

parent db7d424bff

commit 03a4ee1b30

16 changed files with 521 additions and 52 deletions

									
										core/archipelago/src/container/mod.rs
									
		+1
		
												View File
												
				@@ -11,6 +11,7 @@ pub mod lnd;

				pub mod prod_orchestrator;

				pub mod quadlet;

				pub mod registry;

				pub mod secrets;

				pub mod traits;

				pub use boot_reconciler::{BootReconciler, DEFAULT_INTERVAL as RECONCILER_DEFAULT_INTERVAL};