From 210f7f1b1289e0dae2feb1383fdd272b33e37379 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 1 Sep 2026 10:37:09 -0400
Subject: [PATCH] =?UTF-8?q?chore(catalog):=20re-sign=20the=20catalog=20?=
 =?UTF-8?q?=E2=80=94=20NPM=20letsencrypt=20mount=20+=20NET=5FBIND=5FSERVIC?=
 =?UTF-8?q?E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Regenerated from the fixed apps/nginx-proxy-manager/manifest.yml (the
only semantic change vs the previous signed catalog) and signed with
the release-root key. Catalog-covered nodes pick this up on their next
hourly fetch and the NPM start/die loop ends: s6 gets its /etc/letsencrypt
mount back and the internal nginx can bind 80/443/81 again under
--cap-drop=ALL.
---
 releases/app-catalog.json | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/releases/app-catalog.json b/releases/app-catalog.json
index ebc96768..30b2b65c 100644
--- a/releases/app-catalog.json
+++ b/releases/app-catalog.json
@@ -4046,7 +4046,8 @@
               "CHOWN",
               "SETUID",
               "SETGID",
-              "DAC_OVERRIDE"
+              "DAC_OVERRIDE",
+              "NET_BIND_SERVICE"
             ],
             "network_policy": "isolated",
             "no_new_privileges": true,
@@ -4065,6 +4066,14 @@
               "source": "/var/lib/archipelago/nginx-proxy-manager",
               "target": "/data",
               "type": "bind"
+            },
+            {
+              "options": [
+                "rw"
+              ],
+              "source": "/var/lib/archipelago/nginx-proxy-manager/letsencrypt",
+              "target": "/etc/letsencrypt",
+              "type": "bind"
             }
           ]
         }
@@ -5420,7 +5429,7 @@
     }
   },
   "schema": 1,
-  "signature": "5f5bbb02ab88c9fbc4bf62a2c237a3e58912bd33ecf5bba67ad2705f0331b62a08b0e04dc6b03f76c236e5d4d316d80e982b112ecf0313a5a5e29c3289531308",
+  "signature": "f982faeb9823062d9d39f6e4b38a171b4442cad0f35e74792ea161b5d77246ab9128044acbdc390ec23f921363af2d13bbba66c558b188d14d06a3f9a7f42406",
   "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
   "updated": "2026-09-01"
 }