fix: ISO boot, container installs, VPN, nginx, companion input
- LUKS auto-unlock: initramfs hook + systemd service + nofail fstab - Rootfs packages: add passt, aardvark-dns, netavark, nftables for Podman 5.x - nginx: resolver + variable proxy_pass for external domains (DNS at boot) - Boot: loglevel=0 suppresses kernel warnings, serial console for QEMU - Container installs: write configs before chown, sudo chown for LUKS volumes - Container installs: build UI sidecars locally (not from registry) for auth injection - Bitcoin UI: inject RPC auth from secrets file, --no-cache rebuild - Secrets: chown to archipelago user in first-boot (backend needs read access) - Podman: image_copy_tmp_dir for read-only /var/tmp in user namespace - NostrVPN: enable service in auto-install, always include public relays - NostrVPN: read tunnel IP from nvpn status (not just config file) - VPN invite: v2 base64 no-pad format matching phone app - Companion input: relay always active, kiosk skips relay listener (prevents double input) - dev-start.sh: production build includes AIUI deployment Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Dorian
co-authored by
Claude Opus 4.6
Claude Opus 4.6
parent
82419c52ab
commit
7393c5f158
@@ -274,6 +274,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
podman \
|
||||
uidmap \
|
||||
slirp4netns \
|
||||
passt \
|
||||
aardvark-dns \
|
||||
netavark \
|
||||
nftables \
|
||||
fuse-overlayfs \
|
||||
tor \
|
||||
python3 \
|
||||
@@ -922,10 +926,20 @@ else
|
||||
echo " Capturing backend binary from live server..."
|
||||
fi
|
||||
|
||||
# Try to get from live server first (unless BUILD_FROM_SOURCE=1)
|
||||
# Try to get backend binary: local release build → local install → remote → container build
|
||||
BACKEND_CAPTURED=0
|
||||
if [ "$BUILD_FROM_SOURCE" != "1" ]; then
|
||||
# Direct copy from ARCHIPELAGO_BIN env, local install, or remote
|
||||
|
||||
# Check for local release binary first (works for both BUILD_FROM_SOURCE and normal mode)
|
||||
LOCAL_RELEASE="$(cd "$SCRIPT_DIR/.." && pwd)/core/target/release/archipelago"
|
||||
if [ -f "$LOCAL_RELEASE" ]; then
|
||||
cp "$LOCAL_RELEASE" "$ARCH_DIR/bin/archipelago"
|
||||
chmod +x "$ARCH_DIR/bin/archipelago"
|
||||
echo " ✅ Backend from local release build ($(du -h "$ARCH_DIR/bin/archipelago" | cut -f1))"
|
||||
BACKEND_CAPTURED=1
|
||||
fi
|
||||
|
||||
if [ "$BACKEND_CAPTURED" = "0" ] && [ "$BUILD_FROM_SOURCE" != "1" ]; then
|
||||
# Direct copy from ARCHIPELAGO_BIN env or local install
|
||||
BIN="${ARCHIPELAGO_BIN:-/usr/local/bin/archipelago}"
|
||||
if [ -f "$BIN" ]; then
|
||||
cp "$BIN" "$ARCH_DIR/bin/archipelago"
|
||||
@@ -2006,12 +2020,65 @@ DATA_UUID=$(blkid -s UUID -o value "$DATA_PART")
|
||||
echo "# LUKS2 encrypted data — auto-unlock with key file" > /mnt/target/etc/crypttab
|
||||
echo "archipelago-data UUID=$DATA_UUID /root/.luks-archipelago.key luks,discard" >> /mnt/target/etc/crypttab
|
||||
|
||||
# Configure LUKS auto-unlock: three layers to ensure it works
|
||||
# Layer 1: cryptsetup-initramfs config (tells update-initramfs to embed key)
|
||||
mkdir -p /mnt/target/etc/cryptsetup-initramfs
|
||||
cat > /mnt/target/etc/cryptsetup-initramfs/conf <<'CRYPTCONF'
|
||||
KEYFILE_PATTERN="/root/.luks-*.key"
|
||||
UMASK=0077
|
||||
CRYPTCONF
|
||||
|
||||
# Layer 2: initramfs hook to force-copy key file
|
||||
mkdir -p /mnt/target/etc/initramfs-tools/hooks
|
||||
cat > /mnt/target/etc/initramfs-tools/hooks/archipelago-luks <<'LUKSHOOK'
|
||||
#!/bin/sh
|
||||
PREREQ=""
|
||||
prereqs() { echo "$PREREQ"; }
|
||||
case $1 in prereqs) prereqs; exit 0;; esac
|
||||
. /usr/share/initramfs-tools/hook-functions
|
||||
if [ -f /root/.luks-archipelago.key ]; then
|
||||
mkdir -p "${DESTDIR}/root"
|
||||
cp /root/.luks-archipelago.key "${DESTDIR}/root/.luks-archipelago.key"
|
||||
chmod 600 "${DESTDIR}/root/.luks-archipelago.key"
|
||||
fi
|
||||
if [ -f /etc/crypttab ]; then
|
||||
mkdir -p "${DESTDIR}/etc"
|
||||
cp /etc/crypttab "${DESTDIR}/etc/crypttab"
|
||||
fi
|
||||
copy_exec /sbin/cryptsetup
|
||||
LUKSHOOK
|
||||
chmod +x /mnt/target/etc/initramfs-tools/hooks/archipelago-luks
|
||||
|
||||
# Layer 3: systemd service as fallback — unlocks LUKS early if initramfs missed it
|
||||
cat > /mnt/target/etc/systemd/system/archipelago-luks-unlock.service <<'LUKSUNIT'
|
||||
[Unit]
|
||||
Description=Unlock Archipelago LUKS data partition
|
||||
DefaultDependencies=no
|
||||
Before=local-fs-pre.target
|
||||
After=systemd-udevd.service
|
||||
Wants=systemd-udevd.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=/bin/bash -c '\
|
||||
if [ -e /dev/mapper/archipelago-data ]; then exit 0; fi; \
|
||||
DATA_DEV=$(blkid -t TYPE=crypto_LUKS -o device 2>/dev/null | head -1); \
|
||||
if [ -z "$DATA_DEV" ]; then exit 0; fi; \
|
||||
cryptsetup open --type luks2 --key-file /root/.luks-archipelago.key "$DATA_DEV" archipelago-data'
|
||||
|
||||
[Install]
|
||||
WantedBy=local-fs-pre.target
|
||||
LUKSUNIT
|
||||
chroot /mnt/target systemctl enable archipelago-luks-unlock.service 2>/dev/null || \
|
||||
ln -sf /etc/systemd/system/archipelago-luks-unlock.service /mnt/target/etc/systemd/system/local-fs-pre.target.wants/archipelago-luks-unlock.service
|
||||
|
||||
# Create fstab
|
||||
cat > /mnt/target/etc/fstab <<EOF
|
||||
# Archipelago Bitcoin Node OS
|
||||
UUID=$(blkid -s UUID -o value "$ROOT_PART") / ext4 errors=remount-ro 0 1
|
||||
UUID=$(blkid -s UUID -o value "$EFI_PART") /boot/efi vfat umask=0077 0 1
|
||||
/dev/mapper/archipelago-data /var/lib/archipelago ext4 defaults 0 2
|
||||
/dev/mapper/archipelago-data /var/lib/archipelago ext4 defaults,nofail,x-systemd.device-timeout=60 0 2
|
||||
EOF
|
||||
|
||||
# Configure hostname
|
||||
@@ -2055,7 +2122,13 @@ if [ -f /mnt/target/usr/lib/podman/netavark ]; then
|
||||
cat > /mnt/target/home/archipelago/.config/containers/containers.conf <<'CONTAINERSCONF'
|
||||
[network]
|
||||
network_backend = "netavark"
|
||||
default_rootless_network_cmd = "pasta"
|
||||
|
||||
[engine]
|
||||
image_copy_tmp_dir = "/var/lib/archipelago/containers/tmp"
|
||||
CONTAINERSCONF
|
||||
mkdir -p /mnt/target/var/lib/archipelago/containers/tmp
|
||||
chown -R 1000:1000 /mnt/target/var/lib/archipelago/containers/tmp
|
||||
chown -R 1000:1000 /mnt/target/home/archipelago/.config/containers
|
||||
echo " Configured netavark backend (container DNS enabled)"
|
||||
else
|
||||
@@ -2623,15 +2696,9 @@ if [ -d "$BOOT_MEDIA/archipelago/plymouth-theme" ]; then
|
||||
chroot /mnt/target plymouth-set-default-theme archipelago 2>/dev/null || \
|
||||
ln -sf /usr/share/plymouth/themes/archipelago/archipelago.plymouth \
|
||||
/mnt/target/etc/alternatives/default.plymouth 2>/dev/null || true
|
||||
# Enable splash and ACPI in GRUB
|
||||
if ! grep -q "splash" /mnt/target/etc/default/grub; then
|
||||
sed -i 's/GRUB_CMDLINE_LINUX_DEFAULT="\(.*\)"/GRUB_CMDLINE_LINUX_DEFAULT="\1 splash"/' \
|
||||
/mnt/target/etc/default/grub 2>/dev/null || true
|
||||
fi
|
||||
if ! grep -q "acpi=force" /mnt/target/etc/default/grub; then
|
||||
sed -i 's/GRUB_CMDLINE_LINUX_DEFAULT="\(.*\)"/GRUB_CMDLINE_LINUX_DEFAULT="\1 acpi=force"/' \
|
||||
/mnt/target/etc/default/grub 2>/dev/null || true
|
||||
fi
|
||||
# Configure clean boot: splash, suppress kernel noise, hide cursor
|
||||
sed -i 's/GRUB_CMDLINE_LINUX_DEFAULT=".*"/GRUB_CMDLINE_LINUX_DEFAULT="quiet splash loglevel=0 rd.systemd.show_status=false vt.global_cursor_default=0 acpi=force"/' \
|
||||
/mnt/target/etc/default/grub 2>/dev/null || true
|
||||
echo " Installed Archipelago Plymouth theme on target"
|
||||
fi
|
||||
|
||||
@@ -2816,6 +2883,7 @@ chroot /mnt/target systemctl enable archipelago-load-images.service 2>/dev/null
|
||||
chroot /mnt/target systemctl enable archipelago-setup-tor.service 2>/dev/null || true
|
||||
chroot /mnt/target systemctl enable archipelago-first-boot-containers.service 2>/dev/null || true
|
||||
chroot /mnt/target systemctl enable archipelago-kiosk.service 2>/dev/null || true
|
||||
chroot /mnt/target systemctl enable nostr-vpn.service 2>/dev/null || true
|
||||
# Enable claude-api-proxy (create symlink manually — chroot systemctl can fail)
|
||||
chroot /mnt/target systemctl enable claude-api-proxy.service 2>/dev/null || \
|
||||
ln -sf /etc/systemd/system/claude-api-proxy.service /mnt/target/etc/systemd/system/multi-user.target.wants/claude-api-proxy.service 2>/dev/null || true
|
||||
@@ -3079,15 +3147,21 @@ fi
|
||||
set timeout=5
|
||||
set default=0
|
||||
|
||||
# Serial console for QEMU/headless testing
|
||||
insmod serial
|
||||
serial --unit=0 --speed=115200
|
||||
terminal_input serial console
|
||||
terminal_output serial console
|
||||
|
||||
# Load font for graphical menu — fallback to text mode on hardware without gfxterm
|
||||
if loadfont ($root)/boot/grub/font.pf2; then
|
||||
set gfxmode=auto
|
||||
set gfxpayload=keep
|
||||
insmod gfxterm
|
||||
insmod png
|
||||
terminal_output gfxterm
|
||||
terminal_output gfxterm serial
|
||||
else
|
||||
terminal_output console
|
||||
terminal_output console serial
|
||||
fi
|
||||
|
||||
# Archipelago GRUB theme
|
||||
@@ -3103,7 +3177,7 @@ else
|
||||
fi
|
||||
|
||||
menuentry "Install Archipelago" --hotkey=i {
|
||||
linux ($root)/live/vmlinuz boot=live components quiet splash loglevel=0 rd.systemd.show_status=false vt.global_cursor_default=0 acpi=force
|
||||
linux ($root)/live/vmlinuz boot=live components quiet splash loglevel=0 rd.systemd.show_status=false vt.global_cursor_default=0 acpi=force console=ttyS0,115200 console=tty0
|
||||
initrd ($root)/live/initrd.img
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user