fix: release v1.7.51-alpha install hardening

core/archipelago/src/bootstrap.rs

@@ -56,6 +56,11 @@ pub async fn ensure_doctor_installed() {
         Ok(false) => debug!("Nginx already has /api/app-catalog block"),
         Err(e) => warn!("Nginx bootstrap failed (non-fatal): {:#}", e),
     }
+    match run_bitcoin_rpc_repair().await {
+        Ok(true) => info!("Repaired Bitcoin RPC bind settings and restarted Bitcoin containers"),
+        Ok(false) => debug!("Bitcoin RPC bind settings already usable"),
+        Err(e) => warn!("Bitcoin RPC repair failed (non-fatal): {:#}", e),
+    }
 }
 
 async fn run_runtime_assets() -> Result<bool> {
@@ -169,6 +174,54 @@ fn path_dot(path: &Path) -> String {
     p.to_string_lossy().to_string()
 }
 
+async fn run_bitcoin_rpc_repair() -> Result<bool> {
+    // Older installs can have a container-owned bitcoin.conf with only rpcauth
+    // and printtoconsole. In that state bitcoind is healthy internally, but the
+    // host-network bitcoin-ui proxy to 127.0.0.1:8332 gets connection resets.
+    // Repair it at startup so OTA fixes existing nodes without a manual
+    // uninstall/reinstall.
+    let script = r#"
+set -eu
+conf=/var/lib/archipelago/bitcoin/bitcoin.conf
+[ -f "$conf" ] || exit 0
+changed=0
+ensure_line() {
+    line="$1"
+    key="${line%%=*}"
+    if ! grep -q "^${key}=" "$conf"; then
+        printf '%s\n' "$line" >> "$conf"
+        changed=1
+    fi
+}
+ensure_line server=1
+ensure_line rpcbind=0.0.0.0
+ensure_line rpcallowip=0.0.0.0/0
+ensure_line rpcport=8332
+ensure_line listen=1
+[ "$changed" -eq 0 ] && exit 0
+exit 2
+"#;
+    let status = host_sudo(&["sh", "-lc", script])
+        .await
+        .context("repair bitcoin.conf RPC bind settings")?;
+    match status.code() {
+        Some(0) => Ok(false),
+        Some(2) => {
+            for name in ["bitcoin-knots", "bitcoin-core", "archy-bitcoin-ui"] {
+                let _ = tokio::process::Command::new("podman")
+                    .args(["restart", name])
+                    .status()
+                    .await;
+            }
+            Ok(true)
+        }
+        _ => {
+            warn!("Bitcoin RPC repair helper exited with {}", status);
+            Ok(false)
+        }
+    }
+}
+
 async fn run() -> Result<bool> {
     // Dev-box guard: on contributors' laptops `/home/archipelago/archy` is
     // typically a symlink into the git checkout, and writing through it