diff --git a/releases/app-catalog.json b/releases/app-catalog.json index bb2eb1ff..11feb497 100644 --- a/releases/app-catalog.json +++ b/releases/app-catalog.json @@ -25,6 +25,7 @@ "name": "AI Assistant", "ports": [ { + "auth": "local", "bind": "127.0.0.1", "container": 80, "host": 5180, @@ -228,6 +229,8 @@ "name": "Mempool Web", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 8080, "host": 4080, "protocol": "tcp" @@ -302,6 +305,8 @@ "name": "NBXplorer", "ports": [ { + "auth": "local", + "bind": "127.0.0.1", "container": 32838, "host": 32838, "protocol": "tcp" @@ -374,6 +379,8 @@ "name": "Ark Wallet", "ports": [ { + "auth": "local", + "bind": "127.0.0.1", "container": 3535, "host": 3535, "protocol": "tcp" @@ -462,12 +469,15 @@ "name": "Bitcoin Core", "ports": [ { + "auth": "local", "bind": "127.0.0.1", "container": 8332, "host": 8332, "protocol": "tcp" }, { + "auth": "none", + "auth_rationale": "Bitcoin p2p gossip. Peers are anonymous by design and speak the Bitcoin wire protocol, not HTTP.", "container": 8333, "host": 8333, "protocol": "tcp" @@ -605,12 +615,15 @@ "name": "Bitcoin Knots", "ports": [ { + "auth": "local", "bind": "127.0.0.1", "container": 8332, "host": 8332, "protocol": "tcp" }, { + "auth": "none", + "auth_rationale": "Bitcoin p2p gossip. Peers are anonymous by design and speak the Bitcoin wire protocol, not HTTP.", "container": 8333, "host": 8333, "protocol": "tcp" @@ -671,7 +684,7 @@ ] }, "bitcoin-ui": { - "image": "146.59.87.168:3000/lfg2025/bitcoin-ui:1.7.84-alpha", + "image": "146.59.87.168:3000/lfg2025/bitcoin-ui:1.7.119-alpha", "manifest": { "app": { "container": { @@ -719,7 +732,7 @@ ] } }, - "version": "1.7.84-alpha" + "version": "1.7.119-alpha" }, "botfights": { "manifest": { @@ -931,6 +944,8 @@ "name": "BTCPay Server", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 49392, "host": 23000, "protocol": "tcp" @@ -1001,11 +1016,15 @@ "name": "Core Lightning (CLN)", "ports": [ { + "auth": "none", + "auth_rationale": "Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.", "container": 9735, "host": 9736, "protocol": "tcp" }, { + "auth": "none", + "auth_rationale": "Core Lightning gRPC, authenticated by mutual TLS client certificates.", "container": 9835, "host": 9835, "protocol": "tcp" @@ -1075,6 +1094,8 @@ "name": "Web5 DID Wallet", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 8080, "host": 8088, "protocol": "tcp" @@ -1219,6 +1240,8 @@ "name": "ElectrumX", "ports": [ { + "auth": "none", + "auth_rationale": "Electrum wire protocol over TCP. Electrum wallets speak it directly and cannot hold a session cookie.", "container": 50001, "host": 50001, "protocol": "tcp" @@ -1342,6 +1365,8 @@ "protocol": "tcp" }, { + "auth": "local", + "bind": "127.0.0.1", "container": 8175, "host": 8177, "protocol": "tcp" @@ -1416,6 +1441,8 @@ "name": "Fedimint Client", "ports": [ { + "auth": "local", + "bind": "127.0.0.1", "container": 8080, "host": 8178, "protocol": "tcp" @@ -1601,6 +1628,8 @@ "name": "File Browser", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 80, "host": 8083, "protocol": "tcp" @@ -1753,11 +1782,15 @@ }, "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 3000, "host": 3001, "protocol": "tcp" }, { + "auth": "none", + "auth_rationale": "Git over SSH, authenticated by the user's own SSH keypair. Not HTTP, so the gate cannot serve a login page here.", "container": 22, "host": 2222, "protocol": "tcp" @@ -1842,6 +1875,8 @@ "name": "Grafana", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 3000, "host": 3000, "protocol": "tcp" @@ -1925,6 +1960,8 @@ "name": "Home Assistant", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 8123, "host": 8123, "protocol": "tcp" @@ -2034,6 +2071,8 @@ "name": "Immich", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 2283, "host": 2283, "protocol": "tcp" @@ -2273,6 +2312,8 @@ "name": "IndeeHub", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 7777, "host": 7778, "protocol": "tcp" @@ -2765,6 +2806,8 @@ "name": "Jellyfin", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 8096, "host": 8096, "protocol": "tcp" @@ -2852,11 +2895,15 @@ "name": "Lightning Stack", "ports": [ { + "auth": "none", + "auth_rationale": "Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.", "container": 9735, "host": 9738, "protocol": "tcp" }, { + "auth": "none", + "auth_rationale": "LND gRPC, authenticated by macaroon over TLS. Remote wallets depend on reaching this directly.", "container": 10009, "host": 10010, "protocol": "tcp" @@ -2950,16 +2997,22 @@ "name": "LND", "ports": [ { + "auth": "none", + "auth_rationale": "Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.", "container": 9735, "host": 9735, "protocol": "tcp" }, { + "auth": "none", + "auth_rationale": "LND gRPC, authenticated by macaroon over TLS. Zeus and other remote wallets depend on reaching this directly.", "container": 10009, "host": 10009, "protocol": "tcp" }, { + "auth": "none", + "auth_rationale": "LND REST, authenticated by macaroon over TLS. A browser login page would break Zeus and every non-browser wallet client.", "container": 8080, "host": 18080, "protocol": "tcp" @@ -2998,7 +3051,7 @@ "version": "v0.18.4-beta" }, "lnd-ui": { - "image": "146.59.87.168:3000/lfg2025/lnd-ui:latest", + "image": "146.59.87.168:3000/lfg2025/lnd-ui:1.7.119-alpha", "manifest": { "app": { "container": { @@ -3025,25 +3078,19 @@ }, "id": "lnd-ui", "name": "LND UI", - "ports": [ - { - "container": 80, - "host": 18083, - "protocol": "tcp" - } - ], + "ports": [], "resources": { "memory_limit": "64Mi" }, "security": { - "network_policy": "bridge", + "network_policy": "host", "readonly_root": false }, "version": "1.0.0", "volumes": [] } }, - "version": "latest" + "version": "1.7.119-alpha" }, "mempool": { "image": "146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1", @@ -3093,6 +3140,8 @@ "name": "Mempool Explorer", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 8080, "host": 4080, "protocol": "tcp" @@ -3196,6 +3245,8 @@ "name": "Mempool API", "ports": [ { + "auth": "local", + "bind": "127.0.0.1", "container": 8999, "host": 8999, "protocol": "tcp" @@ -3255,6 +3306,8 @@ "name": "MorphOS Server", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 8080, "host": 8089, "protocol": "tcp" @@ -3569,6 +3622,8 @@ "protocol": "tcp" }, { + "auth": "none", + "auth_rationale": "STUN over UDP for NAT traversal; it must answer unauthenticated probes to do its job at all.", "container": 3478, "host": 3478, "protocol": "udp" @@ -3653,6 +3708,8 @@ "name": "Nextcloud", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 80, "host": 8085, "protocol": "tcp" @@ -3731,6 +3788,8 @@ }, "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 8080, "host": 18081, "protocol": "tcp" @@ -3832,6 +3891,8 @@ "name": "PhotoPrism", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 2342, "host": 2342, "protocol": "tcp" @@ -4066,6 +4127,8 @@ "name": "Pine Wake Word (openWakeWord)", "ports": [ { + "auth": "none", + "auth_rationale": "Wyoming voice protocol, a binary local-only stream consumed by Home Assistant; not HTTP and not browser-reachable.", "container": 10400, "host": 10400, "protocol": "tcp" @@ -4144,6 +4207,8 @@ "name": "Pine Piper (TTS)", "ports": [ { + "auth": "none", + "auth_rationale": "Wyoming voice protocol, a binary local-only stream consumed by Home Assistant; not HTTP and not browser-reachable.", "container": 10200, "host": 10200, "protocol": "tcp" @@ -4226,6 +4291,8 @@ "name": "Pine Whisper (STT)", "ports": [ { + "auth": "none", + "auth_rationale": "Wyoming voice protocol, a binary local-only stream consumed by Home Assistant; not HTTP and not browser-reachable.", "container": 10300, "host": 10300, "protocol": "tcp" @@ -4298,6 +4365,8 @@ "name": "Portainer", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 9000, "host": 9000, "protocol": "tcp" @@ -4394,11 +4463,15 @@ "protocol": "tcp" }, { + "auth": "none", + "auth_rationale": "mDNS is UDP multicast service discovery; gating it would break .local name resolution for every device on the LAN.", "container": 5353, "host": 5353, "protocol": "udp" }, { + "auth": "none", + "auth_rationale": "SSDP/UPnP discovery is UDP multicast — there is no HTTP request to gate and no client that could hold a session.", "container": 1900, "host": 1900, "protocol": "udp" @@ -4478,6 +4551,8 @@ "name": "SearXNG", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 8080, "host": 8888, "protocol": "tcp" @@ -4549,6 +4624,8 @@ }, "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 7777, "host": 8090, "protocol": "tcp" @@ -4639,6 +4716,8 @@ "name": "Uptime Kuma", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 3001, "host": 3002, "protocol": "tcp" @@ -4720,6 +4799,8 @@ "name": "Vaultwarden", "ports": [ { + "auth": "gated", + "bind": "127.0.0.1", "container": 80, "host": 8082, "protocol": "tcp" @@ -4756,7 +4837,7 @@ } }, "schema": 1, - "signature": "1fe1b962317212c15b83c9ae8b0b2957f9663bb7dda3f4d117123aab496ddd4f94fa48f7d4abfd4be5b771510aed51f8ede870e55cb3fd21ce2453bea1d3510e", + "signature": "cc83d0be50ce6144e2b5693a7175d7743d4a19141f4ef9a46a3c88d2dadd848acda9c25063e7a8b5643cecb2ccde279762a00a9715a5d26c99a95b492bc82a05", "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur", - "updated": "2026-07-31" + "updated": "2026-08-04" }