lfg2025/archy
1
0
Fork 0
Code Issues 24 Pull Requests 4 Actions Packages Projects Releases 71 Wiki Activity

chore(catalog): sign catalog with port auth policy — 20 UIs gated, exemptions declared

Browse Source 
Embeds the manifest port declarations (bind: 127.0.0.1 + auth: gated on 20
HTTP UIs, auth: local on loopback backends, auth: none + rationale on
protocol ports) into the signed catalog so nodes enforce the app gate.
Also carries bitcoin-ui/lnd-ui 1.7.119 version drift.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
archipelago
2026-08-04 06:28:06 -04:00
co-authored by Claude Fable 5
parent 6d9d87caa6
commit 8210ca0a2a
1 changed files with 95 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
releases/app-catalog.json
+95 -14
View File
@@ -25,6 +25,7 @@
"name": "AI Assistant",
"ports": [
{
"auth": "local",
"bind": "127.0.0.1",
"container": 80,
"host": 5180,
@@ -228,6 +229,8 @@
"name": "Mempool Web",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 8080,
"host": 4080,
"protocol": "tcp"
@@ -302,6 +305,8 @@
"name": "NBXplorer",
"ports": [
{
"auth": "local",
"bind": "127.0.0.1",
"container": 32838,
"host": 32838,
"protocol": "tcp"
@@ -374,6 +379,8 @@
"name": "Ark Wallet",
"ports": [
{
"auth": "local",
"bind": "127.0.0.1",
"container": 3535,
"host": 3535,
"protocol": "tcp"
@@ -462,12 +469,15 @@
"name": "Bitcoin Core",
"ports": [
{
"auth": "local",
"bind": "127.0.0.1",
"container": 8332,
"host": 8332,
"protocol": "tcp"
},
{
"auth": "none",
"auth_rationale": "Bitcoin p2p gossip. Peers are anonymous by design and speak the Bitcoin wire protocol, not HTTP.",
"container": 8333,
"host": 8333,
"protocol": "tcp"
@@ -605,12 +615,15 @@
"name": "Bitcoin Knots",
"ports": [
{
"auth": "local",
"bind": "127.0.0.1",
"container": 8332,
"host": 8332,
"protocol": "tcp"
},
{
"auth": "none",
"auth_rationale": "Bitcoin p2p gossip. Peers are anonymous by design and speak the Bitcoin wire protocol, not HTTP.",
"container": 8333,
"host": 8333,
"protocol": "tcp"
@@ -671,7 +684,7 @@
]
},
"bitcoin-ui": {
"image": "146.59.87.168:3000/lfg2025/bitcoin-ui:1.7.84-alpha",
"image": "146.59.87.168:3000/lfg2025/bitcoin-ui:1.7.119-alpha",
"manifest": {
"app": {
"container": {
@@ -719,7 +732,7 @@
]
}
},
"version": "1.7.84-alpha"
"version": "1.7.119-alpha"
},
"botfights": {
"manifest": {
@@ -931,6 +944,8 @@
"name": "BTCPay Server",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 49392,
"host": 23000,
"protocol": "tcp"
@@ -1001,11 +1016,15 @@
"name": "Core Lightning (CLN)",
"ports": [
{
"auth": "none",
"auth_rationale": "Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.",
"container": 9735,
"host": 9736,
"protocol": "tcp"
},
{
"auth": "none",
"auth_rationale": "Core Lightning gRPC, authenticated by mutual TLS client certificates.",
"container": 9835,
"host": 9835,
"protocol": "tcp"
@@ -1075,6 +1094,8 @@
"name": "Web5 DID Wallet",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 8080,
"host": 8088,
"protocol": "tcp"
@@ -1219,6 +1240,8 @@
"name": "ElectrumX",
"ports": [
{
"auth": "none",
"auth_rationale": "Electrum wire protocol over TCP. Electrum wallets speak it directly and cannot hold a session cookie.",
"container": 50001,
"host": 50001,
"protocol": "tcp"
@@ -1342,6 +1365,8 @@
"protocol": "tcp"
},
{
"auth": "local",
"bind": "127.0.0.1",
"container": 8175,
"host": 8177,
"protocol": "tcp"
@@ -1416,6 +1441,8 @@
"name": "Fedimint Client",
"ports": [
{
"auth": "local",
"bind": "127.0.0.1",
"container": 8080,
"host": 8178,
"protocol": "tcp"
@@ -1601,6 +1628,8 @@
"name": "File Browser",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 80,
"host": 8083,
"protocol": "tcp"
@@ -1753,11 +1782,15 @@
},
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 3000,
"host": 3001,
"protocol": "tcp"
},
{
"auth": "none",
"auth_rationale": "Git over SSH, authenticated by the user's own SSH keypair. Not HTTP, so the gate cannot serve a login page here.",
"container": 22,
"host": 2222,
"protocol": "tcp"
@@ -1842,6 +1875,8 @@
"name": "Grafana",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 3000,
"host": 3000,
"protocol": "tcp"
@@ -1925,6 +1960,8 @@
"name": "Home Assistant",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 8123,
"host": 8123,
"protocol": "tcp"
@@ -2034,6 +2071,8 @@
"name": "Immich",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 2283,
"host": 2283,
"protocol": "tcp"
@@ -2273,6 +2312,8 @@
"name": "IndeeHub",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 7777,
"host": 7778,
"protocol": "tcp"
@@ -2765,6 +2806,8 @@
"name": "Jellyfin",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 8096,
"host": 8096,
"protocol": "tcp"
@@ -2852,11 +2895,15 @@
"name": "Lightning Stack",
"ports": [
{
"auth": "none",
"auth_rationale": "Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.",
"container": 9735,
"host": 9738,
"protocol": "tcp"
},
{
"auth": "none",
"auth_rationale": "LND gRPC, authenticated by macaroon over TLS. Remote wallets depend on reaching this directly.",
"container": 10009,
"host": 10010,
"protocol": "tcp"
@@ -2950,16 +2997,22 @@
"name": "LND",
"ports": [
{
"auth": "none",
"auth_rationale": "Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.",
"container": 9735,
"host": 9735,
"protocol": "tcp"
},
{
"auth": "none",
"auth_rationale": "LND gRPC, authenticated by macaroon over TLS. Zeus and other remote wallets depend on reaching this directly.",
"container": 10009,
"host": 10009,
"protocol": "tcp"
},
{
"auth": "none",
"auth_rationale": "LND REST, authenticated by macaroon over TLS. A browser login page would break Zeus and every non-browser wallet client.",
"container": 8080,
"host": 18080,
"protocol": "tcp"
@@ -2998,7 +3051,7 @@
"version": "v0.18.4-beta"
},
"lnd-ui": {
"image": "146.59.87.168:3000/lfg2025/lnd-ui:latest",
"image": "146.59.87.168:3000/lfg2025/lnd-ui:1.7.119-alpha",
"manifest": {
"app": {
"container": {
@@ -3025,25 +3078,19 @@
},
"id": "lnd-ui",
"name": "LND UI",
"ports": [
{
"container": 80,
"host": 18083,
"protocol": "tcp"
}
],
"ports": [],
"resources": {
"memory_limit": "64Mi"
},
"security": {
"network_policy": "bridge",
"network_policy": "host",
"readonly_root": false
},
"version": "1.0.0",
"volumes": []
}
},
"version": "latest"
"version": "1.7.119-alpha"
},
"mempool": {
"image": "146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1",
@@ -3093,6 +3140,8 @@
"name": "Mempool Explorer",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 8080,
"host": 4080,
"protocol": "tcp"
@@ -3196,6 +3245,8 @@
"name": "Mempool API",
"ports": [
{
"auth": "local",
"bind": "127.0.0.1",
"container": 8999,
"host": 8999,
"protocol": "tcp"
@@ -3255,6 +3306,8 @@
"name": "MorphOS Server",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 8080,
"host": 8089,
"protocol": "tcp"
@@ -3569,6 +3622,8 @@
"protocol": "tcp"
},
{
"auth": "none",
"auth_rationale": "STUN over UDP for NAT traversal; it must answer unauthenticated probes to do its job at all.",
"container": 3478,
"host": 3478,
"protocol": "udp"
@@ -3653,6 +3708,8 @@
"name": "Nextcloud",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 80,
"host": 8085,
"protocol": "tcp"
@@ -3731,6 +3788,8 @@
},
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 8080,
"host": 18081,
"protocol": "tcp"
@@ -3832,6 +3891,8 @@
"name": "PhotoPrism",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 2342,
"host": 2342,
"protocol": "tcp"
@@ -4066,6 +4127,8 @@
"name": "Pine Wake Word (openWakeWord)",
"ports": [
{
"auth": "none",
"auth_rationale": "Wyoming voice protocol, a binary local-only stream consumed by Home Assistant; not HTTP and not browser-reachable.",
"container": 10400,
"host": 10400,
"protocol": "tcp"
@@ -4144,6 +4207,8 @@
"name": "Pine Piper (TTS)",
"ports": [
{
"auth": "none",
"auth_rationale": "Wyoming voice protocol, a binary local-only stream consumed by Home Assistant; not HTTP and not browser-reachable.",
"container": 10200,
"host": 10200,
"protocol": "tcp"
@@ -4226,6 +4291,8 @@
"name": "Pine Whisper (STT)",
"ports": [
{
"auth": "none",
"auth_rationale": "Wyoming voice protocol, a binary local-only stream consumed by Home Assistant; not HTTP and not browser-reachable.",
"container": 10300,
"host": 10300,
"protocol": "tcp"
@@ -4298,6 +4365,8 @@
"name": "Portainer",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 9000,
"host": 9000,
"protocol": "tcp"
@@ -4394,11 +4463,15 @@
"protocol": "tcp"
},
{
"auth": "none",
"auth_rationale": "mDNS is UDP multicast service discovery; gating it would break .local name resolution for every device on the LAN.",
"container": 5353,
"host": 5353,
"protocol": "udp"
},
{
"auth": "none",
"auth_rationale": "SSDP/UPnP discovery is UDP multicast — there is no HTTP request to gate and no client that could hold a session.",
"container": 1900,
"host": 1900,
"protocol": "udp"
@@ -4478,6 +4551,8 @@
"name": "SearXNG",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 8080,
"host": 8888,
"protocol": "tcp"
@@ -4549,6 +4624,8 @@
},
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 7777,
"host": 8090,
"protocol": "tcp"
@@ -4639,6 +4716,8 @@
"name": "Uptime Kuma",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 3001,
"host": 3002,
"protocol": "tcp"
@@ -4720,6 +4799,8 @@
"name": "Vaultwarden",
"ports": [
{
"auth": "gated",
"bind": "127.0.0.1",
"container": 80,
"host": 8082,
"protocol": "tcp"
@@ -4756,7 +4837,7 @@
}
},
"schema": 1,
"signature": "1fe1b962317212c15b83c9ae8b0b2957f9663bb7dda3f4d117123aab496ddd4f94fa48f7d4abfd4be5b771510aed51f8ede870e55cb3fd21ce2453bea1d3510e",
"signature": "cc83d0be50ce6144e2b5693a7175d7743d4a19141f4ef9a46a3c88d2dadd848acda9c25063e7a8b5643cecb2ccde279762a00a9715a5d26c99a95b492bc82a05",
"signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
"updated": "2026-07-31"
"updated": "2026-08-04"
}