From 186a2c36c82fa42f9271d7ea896a6dc458b3a04e Mon Sep 17 00:00:00 2001 From: archipelago Date: Sun, 2 Aug 2026 20:09:06 -0400 Subject: [PATCH] fix(lnd-ui): manifest declared bridge 18083:80 like the spec did MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Second copy of the wiring fixed in aaa89789. apps/lnd-ui/manifest.yml still declared network_policy: bridge with a 18083 -> 80 port mapping, while docker/lnd-ui/nginx.conf listens on 18083 directly — it has to, so it can proxy the backend on 127.0.0.1:5678 same-origin; the cross-origin fallback is what broke this app on http-only nodes. Publishing a host port to a container port where nothing listens is exactly the failure reproduced on archi-dev-box when recreating from the matching container-specs.sh entry: :18083 refusing connections, HTTP 000. Fixing only the spec would have left the manifest as a live footgun for any code path that provisions this app from its manifest instead. Now host networking with an empty ports list, matching both what actually runs and apps/bitcoin-ui/manifest.yml, which had it right all along. Co-Authored-By: Claude Opus 5 (1M context) --- apps/lnd-ui/manifest.yml | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/apps/lnd-ui/manifest.yml b/apps/lnd-ui/manifest.yml index a33c1c80..713a1afe 100644 --- a/apps/lnd-ui/manifest.yml +++ b/apps/lnd-ui/manifest.yml @@ -22,14 +22,20 @@ app: security: readonly_root: false - network_policy: bridge + network_policy: host - # Bridge networking via archy-net. Container nginx listens on 80; - # host nginx proxies /app/lnd/ -> 127.0.0.1:18083 -> container:80. - ports: - - host: 18083 - container: 80 - protocol: tcp + # Host networking: the container's nginx listens on 18083 directly (see + # docker/lnd-ui/nginx.conf), because it has to proxy the archipelago backend + # on 127.0.0.1:5678 same-origin — a bridge container cannot reach that, and + # the cross-origin fallback broke the app on http-only nodes. `ports:` is + # intentionally empty because host networking bypasses port mapping, exactly + # as in apps/bitcoin-ui/manifest.yml. + # + # This previously declared `bridge` with 18083:80, which publishes the host + # port to a container port where nothing listens. scripts/container-specs.sh + # carried the identical mistake and was fixed alongside this; recreating from + # it on archi-dev-box left :18083 refusing connections. + ports: [] volumes: []