Implement multi-container app installation for Immich and Penpot, enhance Docker package scanning, and update Nginx configuration for iframe support

- Added support for installing Immich and Penpot stacks, including necessary Docker images and network configurations.
- Updated DockerPackageScanner to exclude Immich and Penpot related containers from app listings.
- Enhanced Nginx configuration to support iframe embedding for Immich and Penpot applications, improving user experience.
- Modified deployment scripts to ensure proper setup of first-boot container creation services.

image-recipe/build-auto-installer-iso.sh

@@ -689,7 +689,31 @@ chmod +x "$WORK_DIR/setup-tor.sh"
 cp "$WORK_DIR/setup-tor.sh" "$ARCH_DIR/scripts/"
 cp "$WORK_DIR/archipelago-setup-tor.service" "$ARCH_DIR/scripts/"
 
-echo "   ✅ Container images bundled (including Tor)"
+# First-boot: create core containers (bitcoin, mempool, btcpay, lnd, fedimint, homeassistant)
+echo "   Creating first-boot container creation service..."
+if [ -f "$SCRIPT_DIR/../scripts/first-boot-containers.sh" ]; then
+    cp "$SCRIPT_DIR/../scripts/first-boot-containers.sh" "$ARCH_DIR/scripts/"
+    chmod +x "$ARCH_DIR/scripts/first-boot-containers.sh"
+    cat > "$WORK_DIR/archipelago-first-boot-containers.service" <<'FBCSERVICE'
+[Unit]
+Description=Create core Archipelago containers on first boot
+After=archipelago-setup-tor.service network-online.target podman.service
+ConditionPathExists=/opt/archipelago/scripts/first-boot-containers.sh
+ConditionPathExists=!/var/lib/archipelago/.first-boot-containers-done
+
+[Service]
+Type=oneshot
+ExecStart=/opt/archipelago/scripts/first-boot-containers.sh
+ExecStartPost=/usr/bin/touch /var/lib/archipelago/.first-boot-containers-done
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
+FBCSERVICE
+    cp "$WORK_DIR/archipelago-first-boot-containers.service" "$ARCH_DIR/scripts/"
+fi
+
+echo "   ✅ Container images bundled (including Tor + first-boot)"
 
 # =============================================================================
 # STEP 4: Create auto-installer script
@@ -930,6 +954,13 @@ if [ -d "$BOOT_MEDIA/archipelago/container-images" ]; then
     if [ -f "$BOOT_MEDIA/archipelago/scripts/archipelago-setup-tor.service" ]; then
         cp "$BOOT_MEDIA/archipelago/scripts/archipelago-setup-tor.service" /mnt/target/etc/systemd/system/
     fi
+    if [ -f "$BOOT_MEDIA/archipelago/scripts/first-boot-containers.sh" ]; then
+        cp "$BOOT_MEDIA/archipelago/scripts/first-boot-containers.sh" /mnt/target/opt/archipelago/scripts/
+        chmod +x /mnt/target/opt/archipelago/scripts/first-boot-containers.sh
+    fi
+    if [ -f "$BOOT_MEDIA/archipelago/scripts/archipelago-first-boot-containers.service" ]; then
+        cp "$BOOT_MEDIA/archipelago/scripts/archipelago-first-boot-containers.service" /mnt/target/etc/systemd/system/
+    fi
     
     echo "   ✅ Container images staged for first-boot loading"
 fi
@@ -1025,6 +1056,7 @@ chroot /mnt/target systemctl enable archipelago.service 2>/dev/null || true
 chroot /mnt/target systemctl enable nginx.service 2>/dev/null || true
 chroot /mnt/target systemctl enable archipelago-load-images.service 2>/dev/null || true
 chroot /mnt/target systemctl enable archipelago-setup-tor.service 2>/dev/null || true
+chroot /mnt/target systemctl enable archipelago-first-boot-containers.service 2>/dev/null || true
 
 # Cleanup
 sync

image-recipe/configs/nginx-archipelago.conf

@@ -27,9 +27,57 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
         
         # Increase timeout for long-running operations (e.g., Docker image pulls)
-        proxy_connect_timeout 300s;
-        proxy_send_timeout 300s;
+        proxy_connect_timeout 600s;
+        proxy_send_timeout 600s;
+        proxy_read_timeout 600s;
+    }
+    
+    # Proxy apps that set X-Frame-Options - strip header so iframe works
+    location /app/nextcloud/ {
+        proxy_pass http://127.0.0.1:8085/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
         proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+    location /app/vaultwarden/ {
+        proxy_pass http://127.0.0.1:8082/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+    }
+    location /app/immich/ {
+        proxy_pass http://127.0.0.1:2283/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+    location /app/penpot/ {
+        proxy_pass http://127.0.0.1:9001/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
     }
     
     # Proxy WebSocket