chore(release): stage v1.7.55-alpha

core/archipelago/src/api/rpc/container.rs

@@ -2,6 +2,10 @@ use super::package::validate_app_id;
 use super::transitional::Op;
 use super::RpcHandler;
 use anyhow::{Context, Result};
+use std::time::Duration;
+
+const PODMAN_INSPECT_TIMEOUT: Duration = Duration::from_secs(10);
+const PODMAN_PS_TIMEOUT: Duration = Duration::from_secs(10);
 
 impl RpcHandler {
     pub(super) async fn handle_container_install(
@@ -379,6 +383,10 @@ impl RpcHandler {
         // If app_id is provided, get health for that app.
         if let Some(params) = params {
             if let Some(app_id) = params.get("app_id").and_then(|v| v.as_str()) {
+                if let Some(health) = self.stack_health(app_id).await? {
+                    return Ok(serde_json::json!({ app_id: health }));
+                }
+
                 let mut last_err: Option<anyhow::Error> = None;
                 for candidate in status_app_id_candidates(app_id) {
                     match orchestrator.health(&candidate).await {
@@ -434,6 +442,78 @@ impl RpcHandler {
 
         Ok(serde_json::Value::Object(health_map))
     }
+
+    async fn stack_health(&self, app_id: &str) -> Result<Option<String>> {
+        let Some(members) = stack_health_members(app_id) else {
+            return Ok(None);
+        };
+
+        let orchestrator = self
+            .orchestrator
+            .as_ref()
+            .ok_or_else(|| anyhow::anyhow!("Container orchestrator not available"))?;
+
+        let mut saw_starting = false;
+        let mut saw_unknown = false;
+        for member in members {
+            match member_health(orchestrator.as_ref(), member)
+                .await
+                .as_deref()
+            {
+                Ok(health) if health == "healthy" => {}
+                Ok(health) if health == "starting" => saw_starting = true,
+                Ok(health) if health == "unknown" => saw_unknown = true,
+                Ok(_) => return Ok(Some("unhealthy".to_string())),
+                Err(_) => saw_unknown = true,
+            }
+        }
+
+        if saw_unknown {
+            Ok(Some("unknown".to_string()))
+        } else if saw_starting {
+            Ok(Some("starting".to_string()))
+        } else {
+            Ok(Some("healthy".to_string()))
+        }
+    }
+}
+
+async fn member_health(
+    orchestrator: &dyn crate::container::traits::ContainerOrchestrator,
+    app_id: &str,
+) -> Result<String> {
+    if let Ok(health) = orchestrator.health(app_id).await {
+        return Ok(health);
+    }
+    for name in status_container_name_candidates(app_id) {
+        if let Some(health) = inspect_container_health_value(&name).await {
+            return Ok(health);
+        }
+    }
+    Ok("unknown".to_string())
+}
+
+fn stack_health_members(app_id: &str) -> Option<&'static [&'static str]> {
+    match app_id {
+        "mempool" | "mempool-web" => {
+            Some(&["archy-mempool-db", "mempool-api", "archy-mempool-web"])
+        }
+        "btcpay-server" | "btcpayserver" | "btcpay" => {
+            Some(&["archy-btcpay-db", "archy-nbxplorer", "btcpay-server"])
+        }
+        "immich" => Some(&["immich_postgres", "immich_redis", "immich_server"]),
+        "indeedhub" => Some(&[
+            "indeedhub-postgres",
+            "indeedhub-redis",
+            "indeedhub-minio",
+            "indeedhub-relay",
+            "indeedhub-api",
+            "indeedhub-ffmpeg",
+            "indeedhub",
+        ]),
+        "fedimint" => Some(&["fedimint"]),
+        _ => None,
+    }
 }
 
 fn status_app_id_candidates(app_id: &str) -> Vec<String> {
@@ -504,15 +584,21 @@ fn status_container_name_candidates(app_id: &str) -> Vec<String> {
 }
 
 async fn inspect_container_state_value(name: &str) -> Option<serde_json::Value> {
-    let out = tokio::process::Command::new("podman")
-        .args([
-            "inspect",
-            name,
-            "--format",
-            "{{.State.Status}} {{.State.Running}}",
-        ])
-        .output()
+    if let Some(v) = ps_container_state_value(name).await {
+        return Some(v);
+    }
+
+    let mut cmd = tokio::process::Command::new("podman");
+    cmd.args([
+        "inspect",
+        name,
+        "--format",
+        "{{.State.Status}} {{.State.Running}} {{if .State.Healthcheck}}{{.State.Healthcheck.Status}}{{else}}none{{end}}",
+    ]);
+    cmd.kill_on_drop(true);
+    let out = tokio::time::timeout(PODMAN_INSPECT_TIMEOUT, cmd.output())
         .await
+        .ok()?
         .ok()?;
     if !out.status.success() {
         return None;
@@ -525,20 +611,90 @@ async fn inspect_container_state_value(name: &str) -> Option<serde_json::Value>
     let mut parts = line.split_whitespace();
     let status = parts.next().unwrap_or("unknown");
     let running = parts.next().unwrap_or("false") == "true";
+    let health = parts.next().unwrap_or("none");
     Some(serde_json::json!({
         "name": name,
         "status": status,
         "state": status,
         "running": running,
+        "health": health,
     }))
 }
 
+async fn ps_container_state_value(name: &str) -> Option<serde_json::Value> {
+    let mut cmd = tokio::process::Command::new("podman");
+    cmd.args([
+        "ps",
+        "-a",
+        "--filter",
+        &format!("name={name}"),
+        "--format",
+        "{{.Names}}|{{.Status}}",
+    ]);
+    cmd.kill_on_drop(true);
+    let out = tokio::time::timeout(PODMAN_PS_TIMEOUT, cmd.output())
+        .await
+        .ok()?
+        .ok()?;
+    if !out.status.success() {
+        return None;
+    }
+
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    for line in stdout.lines() {
+        let mut parts = line.splitn(2, '|');
+        let container_name = parts.next().unwrap_or_default();
+        if container_name != name {
+            continue;
+        }
+        let status = parts.next().unwrap_or_default();
+        let state = state_from_podman_status(status);
+        let health = parse_health_from_status(status).unwrap_or("none");
+        return Some(serde_json::json!({
+            "name": name,
+            "status": state,
+            "state": state,
+            "running": state.eq_ignore_ascii_case("running"),
+            "health": health,
+        }));
+    }
+    None
+}
+
+fn state_from_podman_status(status: &str) -> &str {
+    if status.starts_with("Up ") {
+        "running"
+    } else if status.starts_with("Exited ") {
+        "exited"
+    } else if status.starts_with("Created") {
+        "created"
+    } else if status.starts_with("Stopping") {
+        "stopping"
+    } else if status.starts_with("Removing") {
+        "removing"
+    } else {
+        "unknown"
+    }
+}
+
+fn parse_health_from_status(status: &str) -> Option<&str> {
+    let start = status.rfind('(')?;
+    let end = status.rfind(')')?;
+    (start < end).then(|| &status[start + 1..end])
+}
+
 async fn inspect_container_health_value(name: &str) -> Option<String> {
     let v = inspect_container_state_value(name).await?;
+    if let Some(health) = v.get("health").and_then(|s| s.as_str()) {
+        if health != "none" {
+            return Some(health.to_string());
+        }
+    }
     match v.get("state").and_then(|s| s.as_str()).unwrap_or("unknown") {
         "running" => Some("healthy".to_string()),
         "created" => Some("starting".to_string()),
         "paused" => Some("paused".to_string()),
+        "stopping" => Some("unhealthy".to_string()),
         "exited" | "stopped" => Some("unhealthy".to_string()),
         other => Some(format!("unknown:{other}")),
     }

core/archipelago/src/api/rpc/lnd/channels.rs

@@ -3,6 +3,8 @@ use anyhow::{Context, Result};
 use serde::{Deserialize, Serialize};
 use tracing::info;
 
+use super::LND_REST_BASE_URL;
+
 #[derive(Debug, Serialize)]
 struct ChannelInfo {
     chan_id: String,
@@ -62,7 +64,7 @@ impl RpcHandler {
         let (client, macaroon_hex) = self.lnd_client().await?;
 
         let channels_resp: LndListChannelsResponse = client
-            .get("https://127.0.0.1:8080/v1/channels")
+            .get(format!("{LND_REST_BASE_URL}/v1/channels"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .send()
             .await
@@ -72,7 +74,7 @@ impl RpcHandler {
             .context("Failed to parse LND channels response")?;
 
         let pending_resp: LndPendingChannelsResponse = match client
-            .get("https://127.0.0.1:8080/v1/channels/pending")
+            .get(format!("{LND_REST_BASE_URL}/v1/channels/pending"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .send()
             .await
@@ -211,7 +213,7 @@ impl RpcHandler {
                 "perm": true
             });
             let _ = client
-                .post("https://127.0.0.1:8080/v1/peers")
+                .post(format!("{LND_REST_BASE_URL}/v1/peers"))
                 .header("Grpc-Metadata-macaroon", &macaroon_hex)
                 .json(&connect_body)
                 .send()
@@ -224,7 +226,7 @@ impl RpcHandler {
         });
 
         let resp = client
-            .post("https://127.0.0.1:8080/v1/channels")
+            .post(format!("{LND_REST_BASE_URL}/v1/channels"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .json(&open_body)
             .send()
@@ -291,7 +293,7 @@ impl RpcHandler {
         let (client, macaroon_hex) = self.lnd_client().await?;
 
         let url = format!(
-            "https://127.0.0.1:8080/v1/channels/{}/{}?force={}",
+            "{LND_REST_BASE_URL}/v1/channels/{}/{}?force={}",
             parts[0], parts[1], force
         );
 

core/archipelago/src/api/rpc/lnd/info.rs

@@ -3,7 +3,7 @@ use anyhow::{Context, Result};
 use base64::Engine;
 use serde::{Deserialize, Serialize};
 
-use super::{read_lnd_admin_macaroon, LndAmount, LndBalanceResponse};
+use super::{read_lnd_admin_macaroon, LndAmount, LndBalanceResponse, LND_REST_BASE_URL};
 
 #[derive(Debug, Serialize)]
 struct LndInfo {
@@ -44,7 +44,7 @@ impl RpcHandler {
             .context("Failed to create HTTP client")?;
 
         let get_info: LndGetInfoResponse = client
-            .get("https://127.0.0.1:8080/v1/getinfo")
+            .get(format!("{LND_REST_BASE_URL}/v1/getinfo"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .send()
             .await
@@ -54,7 +54,7 @@ impl RpcHandler {
             .context("Failed to parse LND getinfo response")?;
 
         let channel_balance: LndChannelBalanceResponse = match client
-            .get("https://127.0.0.1:8080/v1/balance/channels")
+            .get(format!("{LND_REST_BASE_URL}/v1/balance/channels"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .send()
             .await
@@ -70,7 +70,7 @@ impl RpcHandler {
         };
 
         let wallet_balance: LndBalanceResponse = match client
-            .get("https://127.0.0.1:8080/v1/balance/blockchain")
+            .get(format!("{LND_REST_BASE_URL}/v1/balance/blockchain"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .send()
             .await
@@ -166,7 +166,7 @@ impl RpcHandler {
             "cert_base64url": cert_b64url,
             "macaroon_base64url": macaroon_b64url,
             "tor_onion": tor_onion,
-            "rest_port": 8080,
+            "rest_port": 18080,
             "grpc_port": 10009,
         }))
     }
@@ -186,7 +186,7 @@ impl RpcHandler {
             .context("Failed to build HTTP client")?;
 
         let resp = client
-            .get("https://127.0.0.1:8080/v1/channels/backup")
+            .get(format!("{LND_REST_BASE_URL}/v1/channels/backup"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .send()
             .await

core/archipelago/src/api/rpc/lnd/mod.rs

@@ -9,6 +9,7 @@ use anyhow::{anyhow, Context, Result};
 /// Canonical on-host path for LND's admin macaroon.
 pub(crate) const LND_ADMIN_MACAROON_PATH: &str =
     "/var/lib/archipelago/lnd/data/chain/bitcoin/mainnet/admin.macaroon";
+pub(in crate::api) const LND_REST_BASE_URL: &str = "https://127.0.0.1:18080";
 
 // Shared LND response types used by multiple submodules
 #[derive(Debug, serde::Deserialize)]

core/archipelago/src/api/rpc/lnd/payments.rs

@@ -2,6 +2,8 @@ use crate::api::rpc::RpcHandler;
 use anyhow::{Context, Result};
 use tracing::info;
 
+use super::LND_REST_BASE_URL;
+
 impl RpcHandler {
     /// Pay a Lightning invoice.
     pub(in crate::api::rpc) async fn handle_lnd_payinvoice(
@@ -35,7 +37,7 @@ impl RpcHandler {
         });
 
         let resp = client
-            .post("https://127.0.0.1:8080/v1/channels/transactions")
+            .post(format!("{LND_REST_BASE_URL}/v1/channels/transactions"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .json(&pay_body)
             .send()
@@ -91,7 +93,7 @@ impl RpcHandler {
         let (client, macaroon_hex) = self.lnd_client().await?;
 
         let resp = client
-            .get("https://127.0.0.1:8080/v1/transactions")
+            .get(format!("{LND_REST_BASE_URL}/v1/transactions"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .send()
             .await

core/archipelago/src/api/rpc/lnd/wallet.rs

@@ -4,13 +4,15 @@ use base64::Engine;
 use tracing::info;
 use zeroize::Zeroize;
 
+use super::LND_REST_BASE_URL;
+
 impl RpcHandler {
     /// Generate a new on-chain Bitcoin address.
     pub(in crate::api::rpc) async fn handle_lnd_newaddress(&self) -> Result<serde_json::Value> {
         let (client, macaroon_hex) = self.lnd_client().await?;
 
         let resp = client
-            .get("https://127.0.0.1:8080/v1/newaddress")
+            .get(format!("{LND_REST_BASE_URL}/v1/newaddress"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .send()
             .await
@@ -69,7 +71,7 @@ impl RpcHandler {
         });
 
         let resp = client
-            .post("https://127.0.0.1:8080/v1/transactions")
+            .post(format!("{LND_REST_BASE_URL}/v1/transactions"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .json(&send_body)
             .send()
@@ -129,7 +131,7 @@ impl RpcHandler {
         });
 
         let resp = client
-            .post("https://127.0.0.1:8080/v1/invoices")
+            .post(format!("{LND_REST_BASE_URL}/v1/invoices"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .json(&invoice_body)
             .send()
@@ -231,7 +233,7 @@ impl RpcHandler {
         });
 
         let resp = client
-            .post("https://127.0.0.1:8080/v2/wallet/psbt/fund")
+            .post(format!("{LND_REST_BASE_URL}/v2/wallet/psbt/fund"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .json(&fund_body)
             .send()
@@ -289,7 +291,7 @@ impl RpcHandler {
         });
 
         let resp = client
-            .post("https://127.0.0.1:8080/v2/wallet/psbt/finalize")
+            .post(format!("{LND_REST_BASE_URL}/v2/wallet/psbt/finalize"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .json(&finalize_body)
             .send()
@@ -322,7 +324,7 @@ impl RpcHandler {
         });
 
         let pub_resp = client
-            .post("https://127.0.0.1:8080/v2/wallet/tx")
+            .post(format!("{LND_REST_BASE_URL}/v2/wallet/tx"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .json(&publish_body)
             .send()
@@ -387,7 +389,7 @@ impl RpcHandler {
         });
 
         let resp = client
-            .post("https://127.0.0.1:8080/v2/wallet/psbt/fund")
+            .post(format!("{LND_REST_BASE_URL}/v2/wallet/psbt/fund"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .json(&fund_body)
             .send()
@@ -416,7 +418,7 @@ impl RpcHandler {
         });
 
         let resp = client
-            .post("https://127.0.0.1:8080/v2/wallet/psbt/finalize")
+            .post(format!("{LND_REST_BASE_URL}/v2/wallet/psbt/finalize"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .json(&finalize_body)
             .send()
@@ -514,7 +516,7 @@ impl RpcHandler {
         });
 
         let resp = client
-            .post("https://127.0.0.1:8080/v1/initwallet")
+            .post(format!("{LND_REST_BASE_URL}/v1/initwallet"))
             .json(&init_body)
             .send()
             .await

core/archipelago/src/api/rpc/marketplace.rs

@@ -188,7 +188,7 @@ impl RpcHandler {
 
         let (client, macaroon_hex) = self.lnd_client().await?;
 
-        let url = format!("https://127.0.0.1:8080/v1/invoice/{}", r_hash);
+        let url = format!("{}/v1/invoice/{r_hash}", super::lnd::LND_REST_BASE_URL);
         let paid = match client
             .get(&url)
             .header("Grpc-Metadata-macaroon", &macaroon_hex)

core/archipelago/src/api/rpc/middleware.rs

@@ -53,6 +53,7 @@ pub(super) fn sanitize_error_message(msg: &str) -> String {
         "Unauthorized",
         "Forbidden",
         "Not supported",
+        "Requires",
         "requires",
         "must be",
         "cannot",

core/archipelago/src/api/rpc/mod.rs

@@ -12,7 +12,7 @@ mod fips;
 mod handshake;
 mod identity;
 mod interfaces;
-mod lnd;
+pub(in crate::api) mod lnd;
 mod marketplace;
 mod mesh;
 mod middleware;

core/archipelago/src/api/rpc/package/async_lifecycle.rs

@@ -54,6 +54,7 @@ impl RpcHandler {
             .ok_or_else(|| anyhow::anyhow!("Missing package id"))?
             .to_string();
         super::validation::validate_app_id(&package_id)?;
+        super::dependencies::check_bitcoin_pruning_compatibility(&package_id).await?;
 
         // Reject if already in a transitional lifecycle (prevents double-click
         // queuing two installs on the same package).

core/archipelago/src/api/rpc/package/config.rs

@@ -1,6 +1,96 @@
 use super::validation::validate_app_id;
 use crate::port_allocator::PortAllocator;
 use anyhow::{Context, Result};
+use std::time::Duration;
+
+const PODMAN_LIST_TIMEOUT: Duration = Duration::from_secs(15);
+
+fn is_platform_managed_app(app_id: &str) -> bool {
+    matches!(
+        app_id,
+        "bitcoin"
+            | "bitcoin-core"
+            | "bitcoin-knots"
+            | "bitcoin-ui"
+            | "lnd"
+            | "lnd-ui"
+            | "electrumx"
+            | "electrs"
+            | "mempool-electrs"
+            | "electrs-ui"
+            | "mempool"
+            | "mempool-web"
+            | "mempool-api"
+            | "archy-mempool-db"
+            | "archy-mempool-web"
+            | "btcpay"
+            | "btcpay-server"
+            | "btcpayserver"
+            | "archy-btcpay-db"
+            | "archy-nbxplorer"
+            | "fedimint"
+            | "fedimint-gateway"
+            | "indeedhub"
+            | "immich"
+    )
+}
+
+fn safe_dynamic_arg(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= 512
+        && !value.chars().any(|c| matches!(c, '\0' | '\n' | '\r'))
+}
+
+async fn dynamic_app_config(
+    app_id: &str,
+) -> Option<(
+    Vec<String>,
+    Vec<String>,
+    Vec<String>,
+    Option<String>,
+    Option<Vec<String>>,
+)> {
+    if is_platform_managed_app(app_id) {
+        return None;
+    }
+    let config_path = format!("/var/lib/archipelago/app-configs/{}.json", app_id);
+    let data = tokio::fs::read_to_string(&config_path).await.ok()?;
+    let cfg = serde_json::from_str::<serde_json::Value>(&data).ok()?;
+    let string_array = |key: &str| -> Vec<String> {
+        cfg.get(key)
+            .and_then(|v| v.as_array())
+            .map(|a| {
+                a.iter()
+                    .filter_map(|v| v.as_str())
+                    .filter(|s| safe_dynamic_arg(s))
+                    .map(String::from)
+                    .collect()
+            })
+            .unwrap_or_default()
+    };
+
+    let command = cfg
+        .get("command")
+        .and_then(|v| v.as_str())
+        .filter(|s| safe_dynamic_arg(s))
+        .map(String::from);
+    let args = cfg.get("args").and_then(|v| v.as_array()).map(|a| {
+        a.iter()
+            .filter_map(|v| v.as_str())
+            .filter(|s| safe_dynamic_arg(s))
+            .map(String::from)
+            .collect::<Vec<_>>()
+    });
+
+    tracing::info!(app_id = %app_id, "loaded catalog runtime config for generic app");
+    Some((
+        string_array("ports"),
+        string_array("volumes"),
+        string_array("env"),
+        command,
+        args.filter(|a| !a.is_empty()),
+    ))
+}
 
 /// Trusted Docker registries. Only images from these sources are allowed.
 #[allow(dead_code)]
@@ -173,12 +263,12 @@ pub(super) fn get_health_check_args(app_id: &str, _rpc_pass: &str) -> Vec<String
             ("curl -sf http://localhost:49392/ || exit 1", "30s", "3")
         }
         "mempool-api" => (
-            "curl -sf http://localhost:8999/api/v1/backend-info || exit 1",
+            http_probe_cmd("http://localhost:8999/api/v1/backend-info"),
             "30s",
             "3",
         ),
         "mempool" | "mempool-web" | "archy-mempool-web" => {
-            ("curl -sf http://localhost:8080/ || exit 1", "30s", "3")
+            (http_probe_cmd("http://localhost:8080/"), "30s", "3")
         }
         "electrumx" | "mempool-electrs" | "electrs" => {
             ("curl -sf http://localhost:8000/ || exit 1", "60s", "3")
@@ -189,7 +279,7 @@ pub(super) fn get_health_check_args(app_id: &str, _rpc_pass: &str) -> Vec<String
             "3",
         ),
         "homeassistant" | "home-assistant" => {
-            ("curl -sf http://localhost:8123/api/ || exit 1", "30s", "3")
+            ("curl -sf http://localhost:8123/ || exit 1", "30s", "3")
         }
         "grafana" => (
             "test -w /var/lib/grafana && test -w /var/lib/grafana/grafana.db && curl -sf http://localhost:3000/api/health || exit 1",
@@ -209,7 +299,7 @@ pub(super) fn get_health_check_args(app_id: &str, _rpc_pass: &str) -> Vec<String
             "30s",
             "3",
         ),
-        "searxng" => ("wget -q -O /dev/null http://localhost:8080/ || exit 1", "30s", "3"),
+        "searxng" => (http_probe_cmd("http://localhost:8080/"), "30s", "3"),
         "photoprism" => (
             "curl -sf http://localhost:2342/api/v1/status || exit 1",
             "60s",
@@ -229,10 +319,8 @@ pub(super) fn get_health_check_args(app_id: &str, _rpc_pass: &str) -> Vec<String
         "ollama" => ("curl -sf http://localhost:11434/ || exit 1", "30s", "3"),
         "fedimint" => ("curl -sf http://localhost:8175/ || exit 1", "60s", "3"),
         "fedimint-gateway" => ("curl -sf http://localhost:8176/ || exit 1", "60s", "3"),
-        "nostr-rs-relay" | "nostr-relay" => {
-            ("curl -sf http://localhost:8080/ || exit 1", "30s", "3")
-        }
-        "nginx-proxy-manager" => ("curl -sf http://localhost:81/api/ || exit 1", "30s", "3"),
+        "nostr-rs-relay" | "nostr-relay" => (http_probe_cmd("http://localhost:8080/"), "30s", "3"),
+        "nginx-proxy-manager" => (http_probe_cmd("http://localhost:81/"), "30s", "3"),
         "routstr" => (
             "curl -sf http://localhost:8000/v1/models || exit 1",
             "30s",
@@ -247,10 +335,21 @@ pub(super) fn get_health_check_args(app_id: &str, _rpc_pass: &str) -> Vec<String
         format!("--health-cmd={}", cmd),
         format!("--health-interval={}", interval),
         format!("--health-retries={}", retries),
+        "--health-timeout=10s".to_string(),
         "--health-start-period=60s".to_string(),
     ]
 }
 
+fn http_probe_cmd(url: &'static str) -> &'static str {
+    match url {
+        "http://localhost:8999/api/v1/backend-info" => "if command -v wget >/dev/null 2>&1; then wget -q -T 5 -O /dev/null http://localhost:8999/api/v1/backend-info; elif command -v curl >/dev/null 2>&1; then curl -fsS -m 5 http://localhost:8999/api/v1/backend-info; else exit 0; fi",
+        "http://localhost:8080/" => "if command -v wget >/dev/null 2>&1; then wget -q -T 5 -O /dev/null http://localhost:8080/; elif command -v curl >/dev/null 2>&1; then curl -fsS -m 5 http://localhost:8080/; else exit 0; fi",
+        "http://localhost:81/api/" => "if command -v wget >/dev/null 2>&1; then wget -q -T 5 -O /dev/null http://localhost:81/api/; elif command -v curl >/dev/null 2>&1; then curl -fsS -m 5 http://localhost:81/api/; else exit 0; fi",
+        "http://localhost:81/" => "if command -v wget >/dev/null 2>&1; then wget -q -T 5 -O /dev/null http://localhost:81/; elif command -v curl >/dev/null 2>&1; then curl -fsS -m 5 http://localhost:81/; else exit 0; fi",
+        _ => "exit 0",
+    }
+}
+
 /// Get per-app memory limit.
 pub(super) fn get_memory_limit(app_id: &str) -> &'static str {
     match app_id {
@@ -259,10 +358,10 @@ pub(super) fn get_memory_limit(app_id: &str) -> &'static str {
         // memory + I/O. 4g caused OOM-cascades during IBD. 8g is the
         // floor; ideally this would be host-RAM aware (next pass).
         "bitcoin" | "bitcoin-core" | "bitcoin-knots" => "8g",
-        // ElectrumX: bumped from 1g to 2g so its CACHE_MB has somewhere
-        // to live during initial blockchain indexing. CACHE_MB=2048 in
-        // env vars below requires this much.
-        "electrumx" | "mempool-electrs" | "electrs" => "2g",
+        // ElectrumX: large cache materially speeds initial history indexing.
+        // CACHE_MB=3072 below needs container headroom for Python, rocksdb,
+        // socket buffers, and reorg/indexing spikes.
+        "electrumx" | "mempool-electrs" | "electrs" => "4g",
         "cryptpad" => "512m",
         "ollama" => "4g",
         // Medium apps
@@ -407,12 +506,14 @@ pub(super) fn all_container_names(package_id: &str) -> Vec<String> {
 
 /// Find all running/stopped containers that belong to a given app.
 /// Uses the canonical name list from all_container_names().
-pub(super) async fn get_containers_for_app(package_id: &str) -> Result<Vec<String>> {
+pub(in crate::api::rpc) async fn get_containers_for_app(package_id: &str) -> Result<Vec<String>> {
     validate_app_id(package_id)?;
-    let output = tokio::process::Command::new("podman")
-        .args(["ps", "-a", "--format", "{{.Names}}"])
-        .output()
+    let mut cmd = tokio::process::Command::new("podman");
+    cmd.args(["ps", "-a", "--format", "{{.Names}}"]);
+    cmd.kill_on_drop(true);
+    let output = tokio::time::timeout(PODMAN_LIST_TIMEOUT, cmd.output())
         .await
+        .context("podman ps timed out while listing containers")?
         .context("Failed to list containers")?;
     let stdout = String::from_utf8_lossy(&output.stdout);
     let all: Vec<&str> = stdout.lines().filter(|s| !s.is_empty()).collect();
@@ -540,6 +641,10 @@ pub(super) async fn get_app_config(
     Option<String>,
     Option<Vec<String>>,
 ) {
+    if let Some(config) = dynamic_app_config(app_id).await {
+        return config;
+    }
+
     match app_id {
         "homeassistant" | "home-assistant" => (
             vec!["8123:8123".to_string()],
@@ -600,7 +705,7 @@ pub(super) async fn get_app_config(
             vec![
                 "9735:9735".to_string(),
                 "10009:10009".to_string(),
-                "8080:8080".to_string(),
+                "18080:8080".to_string(),
             ],
             vec!["/var/lib/archipelago/lnd:/root/.lnd".to_string()],
             vec![],
@@ -676,9 +781,10 @@ pub(super) async fn get_app_config(
                     "DB_DIRECTORY=/data".to_string(),
                     "SERVICES=tcp://:50001,rpc://0.0.0.0:8000".to_string(),
                     // Sync-speed: bigger LRU/write cache during initial
-                    // history index. Default is 1200MB, container now
-                    // gets 2g (config.rs::get_memory_limit) so 2048 fits.
-                    "CACHE_MB=2048".to_string(),
+                    // history index. Default is 1200MB; the container gets
+                    // 4g (config.rs::get_memory_limit) so 3072 fits with
+                    // headroom.
+                    "CACHE_MB=3072".to_string(),
                     // Block-fetcher concurrency — defaults are conservative
                     // for shared hosts; 4 is plenty for one bitcoind backend.
                     "MAX_SEND=10000000".to_string(),
@@ -822,7 +928,7 @@ pub(super) async fn get_app_config(
             vec![
                 "81:81".to_string(),
                 "8084:80".to_string(),
-                "8443:443".to_string(),
+                "8444:443".to_string(),
             ],
             vec![
                 "/var/lib/archipelago/nginx-proxy-manager/data:/data".to_string(),
@@ -1049,31 +1155,11 @@ pub(super) async fn get_app_config(
             None,
         ),
         _ => {
-            // Unknown app: try to load config from /var/lib/archipelago/app-configs/{id}.json
-            // This allows dynamic apps from the remote catalog to be installed
-            // without hardcoding their config here.
-            let config_path = format!("/var/lib/archipelago/app-configs/{}.json", app_id);
-            if let Ok(data) = tokio::fs::read_to_string(&config_path).await {
-                if let Ok(cfg) = serde_json::from_str::<serde_json::Value>(&data) {
-                    let ports = cfg.get("ports")
-                        .and_then(|v| v.as_array())
-                        .map(|a| a.iter().filter_map(|v| v.as_str().map(String::from)).collect())
-                        .unwrap_or_default();
-                    let volumes = cfg.get("volumes")
-                        .and_then(|v| v.as_array())
-                        .map(|a| a.iter().filter_map(|v| v.as_str().map(String::from)).collect())
-                        .unwrap_or_default();
-                    let env_vars = cfg.get("env")
-                        .and_then(|v| v.as_array())
-                        .map(|a| a.iter().filter_map(|v| v.as_str().map(String::from)).collect())
-                        .unwrap_or_default();
-                    tracing::info!("Loaded dynamic config for app: {}", app_id);
-                    return (ports, volumes, env_vars, None, None);
-                }
-            }
-            // No config found — use minimal defaults (container's own EXPOSE/VOLUME)
-            tracing::warn!("No config found for app: {} — using minimal defaults", app_id);
+            // No catalog runtime metadata found; use minimal defaults
+            // (container's own EXPOSE/VOLUME). New generic apps should declare
+            // containerConfig in the registry catalog instead of adding Rust cases.
+            tracing::warn!("No catalog runtime config found for app: {} — using minimal defaults", app_id);
             (vec![], vec![], vec![], None, None)
-        },
+        }
     }
 }

core/archipelago/src/api/rpc/package/dependencies.rs

@@ -9,6 +9,7 @@ const BITCOIN_NAMES: &[&str] = &["bitcoin-knots", "bitcoin-core", "bitcoin"];
 
 /// Names of container variants that represent a running Electrum indexer
 const ELECTRUM_NAMES: &[&str] = &["electrumx", "mempool-electrs", "electrs"];
+const ARCHIVAL_BITCOIN_DISK_GB: u64 = 1000;
 
 fn requires_unpruned_bitcoin(package_id: &str) -> bool {
     matches!(
@@ -17,6 +18,12 @@ fn requires_unpruned_bitcoin(package_id: &str) -> bool {
     )
 }
 
+fn archival_bitcoin_required_message(package_id: &str) -> String {
+    format!(
+        "Requires an archival Bitcoin node while indexing: {package_id}. This node is running pruned Bitcoin because it does not have enough disk for full block history. Add enough storage for an archival node (about 1 TB or more), resync Bitcoin without pruning/with txindex, then install {package_id}."
+    )
+}
+
 /// Snapshot of which dependency services are currently running.
 pub(super) struct RunningDeps {
     pub has_bitcoin: bool,
@@ -135,27 +142,57 @@ pub(super) async fn check_bitcoin_pruning_compatibility(package_id: &str) -> Res
         .timeout(std::time::Duration::from_secs(10))
         .build()
         .context("building Bitcoin RPC client")?;
-    let resp = client
-        .post(crate::constants::BITCOIN_RPC_URL)
-        .basic_auth(rpc_user, Some(rpc_pass))
-        .header("Content-Type", "application/json")
-        .json(&body)
-        .send()
-        .await
-        .context("checking Bitcoin pruning status")?;
 
-    let status = resp.status();
-    let json: serde_json::Value = resp.json().await.context("decode Bitcoin RPC response")?;
-    if !status.is_success() {
-        anyhow::bail!(
-            "Bitcoin RPC returned {} while checking pruning status",
-            status
-        );
-    }
-    if let Some(error) = json.get("error").filter(|e| !e.is_null()) {
-        anyhow::bail!("Bitcoin RPC error while checking pruning status: {}", error);
+    let mut last_error = None;
+    for _ in 0..3 {
+        match client
+            .post(crate::constants::BITCOIN_RPC_URL)
+            .basic_auth(&rpc_user, Some(&rpc_pass))
+            .header("Content-Type", "application/json")
+            .json(&body)
+            .send()
+            .await
+        {
+            Ok(resp) => {
+                let status = resp.status();
+                match resp.json::<serde_json::Value>().await {
+                    Ok(json) if status.is_success() => {
+                        if let Some(error) = json.get("error").filter(|e| !e.is_null()) {
+                            last_error = Some(format!(
+                                "Bitcoin RPC error while checking pruning status: {error}"
+                            ));
+                        } else {
+                            return check_blockchain_info_for_pruning(package_id, &json);
+                        }
+                    }
+                    Ok(json) => {
+                        last_error = Some(format!(
+                            "Bitcoin RPC returned {status} while checking pruning status: {json}"
+                        ));
+                    }
+                    Err(e) => {
+                        last_error = Some(format!("decode Bitcoin RPC response: {e}"));
+                    }
+                }
+            }
+            Err(e) => {
+                last_error = Some(format!("checking Bitcoin pruning status: {e}"));
+            }
+        }
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
     }
 
+    if detect_disk_gb() < ARCHIVAL_BITCOIN_DISK_GB {
+        anyhow::bail!(archival_bitcoin_required_message(package_id));
+    }
+
+    anyhow::bail!(
+        "Bitcoin RPC unavailable while checking pruning status: {}",
+        last_error.unwrap_or_else(|| "unknown error".to_string())
+    );
+}
+
+fn check_blockchain_info_for_pruning(package_id: &str, json: &serde_json::Value) -> Result<()> {
     let Some(result) = json.get("result") else {
         anyhow::bail!("Bitcoin RPC response missing result while checking pruning status");
     };
@@ -164,16 +201,28 @@ pub(super) async fn check_bitcoin_pruning_compatibility(package_id: &str) -> Res
         .and_then(|v| v.as_bool())
         .unwrap_or(false)
     {
-        anyhow::bail!(
-            "{} requires an unpruned Bitcoin node while indexing. Current Bitcoin is pruned; use a full node with enough disk for txindex/full block history, then reinstall/restart {}.",
-            package_id,
-            package_id
-        );
+        anyhow::bail!(archival_bitcoin_required_message(package_id));
     }
 
     Ok(())
 }
 
+fn detect_disk_gb() -> u64 {
+    let output = std::process::Command::new("df")
+        .args(["-BG", "/var/lib/archipelago"])
+        .output();
+    let Ok(output) = output else {
+        return u64::MAX;
+    };
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    stdout
+        .lines()
+        .nth(1)
+        .and_then(|line| line.split_whitespace().nth(1))
+        .and_then(|size| size.trim_end_matches('G').parse::<u64>().ok())
+        .unwrap_or(u64::MAX)
+}
+
 /// Log informational messages about optional dependencies.
 pub(super) fn log_optional_dep_info(package_id: &str, deps: &RunningDeps) {
     if matches!(package_id, "btcpay-server" | "btcpayserver") && !deps.has_lnd {
@@ -254,17 +303,23 @@ pub(super) fn startup_order(package_id: &str) -> &'static [&'static str] {
 /// order for the given app. Unknown containers sort to the end.
 pub(super) async fn ordered_containers_for_start(package_id: &str) -> Result<Vec<String>> {
     let containers = get_containers_for_app(package_id).await?;
-    if containers.is_empty() {
-        return Ok(vec![format!("archy-{}", package_id)]);
-    }
     let order = startup_order(package_id);
-    // If no special order defined, fall back to mempool order (legacy behavior)
+    if order.is_empty() && containers.is_empty() {
+        return Ok(vec![package_id.to_string()]);
+    }
+    let mut sorted = containers;
+    for required in order {
+        if !sorted.iter().any(|name| name == required) {
+            sorted.push((*required).to_string());
+        }
+    }
+    // If no special order is defined, fall back to mempool order for legacy
+    // multi-container names that may still be returned by config lookups.
     let effective_order: &[&str] = if order.is_empty() {
         startup_order("mempool")
     } else {
         order
     };
-    let mut sorted = containers;
     sorted.sort_by_key(|c| effective_order.iter().position(|o| *o == c).unwrap_or(99));
     Ok(sorted)
 }
@@ -324,7 +379,15 @@ pub(super) fn configure_fedimint_lnd(
 
 #[cfg(test)]
 mod tests {
-    use super::requires_unpruned_bitcoin;
+    use super::{requires_unpruned_bitcoin, startup_order};
+
+    #[test]
+    fn btcpay_start_order_includes_required_stack_members() {
+        assert_eq!(
+            startup_order("btcpay-server"),
+            &["archy-btcpay-db", "archy-nbxplorer", "btcpay-server"]
+        );
+    }
 
     #[test]
     fn unpruned_bitcoin_required_for_electrum_indexers_and_mempool() {

core/archipelago/src/api/rpc/package/install.rs

@@ -14,6 +14,7 @@ use crate::data_model::InstallPhase;
 use crate::update::host_sudo;
 use anyhow::{Context, Result};
 use tokio::io::{AsyncBufReadExt, BufReader};
+use tokio::time::{timeout, Duration};
 use tracing::{debug, info, warn};
 
 const INSTALL_LOG: &str = "/var/log/archipelago/container-installs.log";
@@ -221,6 +222,12 @@ impl RpcHandler {
         self.set_install_phase(package_id, InstallPhase::Preparing)
             .await;
 
+        if matches!(package_id, "mempool" | "mempool-web") {
+            let deps = self.running_deps_for_install(package_id).await?;
+            check_install_deps(package_id, &deps)?;
+            check_bitcoin_pruning_compatibility(package_id).await?;
+        }
+
         // Multi-container stacks get their own install path
         if package_id == "immich" {
             return self.install_immich_stack().await;
@@ -239,15 +246,7 @@ impl RpcHandler {
         // congested Podman API does not turn an already-running dependency into
         // a false install failure. Fall back to a bounded direct Podman probe
         // only when the cache does not show the dependency.
-        let deps = {
-            let (data, _) = self.state_manager.get_snapshot().await;
-            let cached = detect_running_deps_from_package_data(&data.package_data);
-            if dependency_cache_satisfies(package_id, &cached) {
-                cached
-            } else {
-                detect_running_deps().await?
-            }
-        };
+        let deps = self.running_deps_for_install(package_id).await?;
         check_install_deps(package_id, &deps)?;
         check_bitcoin_pruning_compatibility(package_id).await?;
         log_optional_dep_info(package_id, &deps);
@@ -362,31 +361,65 @@ impl RpcHandler {
                     if !start_output.status.success() {
                         let stderr = String::from_utf8_lossy(&start_output.stderr);
                         install_log(&format!(
-                            "INSTALL ADOPT FAIL: {} — start failed: {}",
+                            "INSTALL ADOPT RECREATE: {} — start failed, removing wedged container: {}",
                             package_id, stderr
                         ))
                         .await;
-                        return Err(anyhow::anyhow!(
-                            "Container {} exists but failed to start: {}",
-                            package_id,
-                            stderr
-                        ));
+                        let _ = tokio::process::Command::new("podman")
+                            .args(["rm", "-f", package_id])
+                            .output()
+                            .await;
+                    } else {
+                        wait_for_adopted_container(package_id, package_id).await?;
+                        install_log(&format!(
+                            "INSTALL ADOPT OK: {} — already running",
+                            package_id
+                        ))
+                        .await;
+                        if let Err(e) = ensure_host_port_listener(package_id, package_id).await {
+                            install_log(&format!(
+                                "INSTALL ADOPT RECREATE: {} — host listener repair failed, removing wedged container: {}",
+                                package_id, e
+                            ))
+                            .await;
+                            let _ = tokio::process::Command::new("podman")
+                                .args(["rm", "-f", package_id])
+                                .output()
+                                .await;
+                        } else {
+                            return Ok(serde_json::json!({
+                                "success": true,
+                                "package_id": package_id,
+                                "message": format!("Package {} already installed and running", package_id)
+                            }));
+                        }
+                    }
+                    // Fall through to the fresh install path. Volume-backed data
+                    // remains under /var/lib/archipelago and is not deleted.
+                } else {
+                    install_log(&format!(
+                        "INSTALL ADOPT OK: {} — already running",
+                        package_id
+                    ))
+                    .await;
+                    if let Err(e) = ensure_host_port_listener(package_id, package_id).await {
+                        install_log(&format!(
+                            "INSTALL ADOPT RECREATE: {} — host listener repair failed, removing wedged container: {}",
+                            package_id, e
+                        ))
+                        .await;
+                        let _ = tokio::process::Command::new("podman")
+                            .args(["rm", "-f", package_id])
+                            .output()
+                            .await;
+                    } else {
+                        return Ok(serde_json::json!({
+                            "success": true,
+                            "package_id": package_id,
+                            "message": format!("Package {} already installed and running", package_id)
+                        }));
                     }
-
-                    wait_for_adopted_container(package_id, package_id).await?;
                 }
-
-                install_log(&format!(
-                    "INSTALL ADOPT OK: {} — already running",
-                    package_id
-                ))
-                .await;
-                ensure_host_port_listener(package_id, package_id).await?;
-                return Ok(serde_json::json!({
-                    "success": true,
-                    "package_id": package_id,
-                    "message": format!("Package {} already installed and running", package_id)
-                }));
             }
         }
 
@@ -513,7 +546,20 @@ impl RpcHandler {
         let network_alias_flag = format!("--network-alias={}", container_name);
 
         // Network mode
-        if package_id == "uptime-kuma" || package_id == "gitea" || package_id == "tailscale" {
+        if matches!(
+            package_id,
+            "uptime-kuma"
+                | "gitea"
+                | "tailscale"
+                | "vaultwarden"
+                | "homeassistant"
+                | "home-assistant"
+                | "nextcloud"
+                | "searxng"
+                | "jellyfin"
+                | "nginx-proxy-manager"
+                | "portainer"
+        ) {
             // These standalone web UIs have repeatedly lost host listeners
             // under Podman's rootless pasta backend while staying healthy internally.
             // Use slirp4netns/rootlessport for this standalone web UI.
@@ -599,6 +645,10 @@ impl RpcHandler {
             self.write_lnd_conf(&rpc_user, &rpc_pass).await?;
         }
 
+        if package_id == "portainer" {
+            ensure_user_podman_socket().await?;
+        }
+
         // Pre-install: SearXNG settings.yml (required or container exits immediately)
         if package_id == "searxng" {
             let searx_dir = "/var/lib/archipelago/searxng";
@@ -705,6 +755,10 @@ impl RpcHandler {
         if !run_output.status.success() {
             let stderr = String::from_utf8_lossy(&run_output.stderr).to_string();
             if cleanup_start_conflict(package_id, &stderr).await {
+                let _ = tokio::process::Command::new("podman")
+                    .args(["rm", "-f", container_name])
+                    .output()
+                    .await;
                 run_output = cmd.output().await.context("Failed to rerun container")?;
             }
         }
@@ -750,11 +804,14 @@ impl RpcHandler {
                     .await;
             }
             tokio::time::sleep(std::time::Duration::from_secs(5)).await;
-            let status = tokio::process::Command::new("podman")
-                .args(["inspect", container_name, "--format", "{{.State.Status}}"])
-                .output()
-                .await;
-            if let Ok(o) = status {
+            let status = timeout(
+                Duration::from_secs(10),
+                tokio::process::Command::new("podman")
+                    .args(["inspect", container_name, "--format", "{{.State.Status}}"])
+                    .output(),
+            )
+            .await;
+            if let Ok(Ok(o)) = status {
                 let state = String::from_utf8_lossy(&o.stdout).trim().to_string();
                 if state == "running" {
                     container_running = true;
@@ -787,6 +844,8 @@ impl RpcHandler {
                         log_output.chars().take(500).collect::<String>()
                     ));
                 }
+            } else {
+                warn!("podman inspect {} timed out during install", container_name);
             }
             if i == 11 {
                 warn!(
@@ -838,6 +897,16 @@ impl RpcHandler {
         }))
     }
 
+    async fn running_deps_for_install(&self, package_id: &str) -> Result<RunningDeps> {
+        let (data, _) = self.state_manager.get_snapshot().await;
+        let cached = detect_running_deps_from_package_data(&data.package_data);
+        if dependency_cache_satisfies(package_id, &cached) {
+            Ok(cached)
+        } else {
+            detect_running_deps().await
+        }
+    }
+
     // -- Private helpers for install --
 
     /// Pull the image from a registry or verify a local image exists.
@@ -1788,6 +1857,7 @@ autopilot.active=false\n",
 async fn cleanup_stale_package_ports(package_id: &str) {
     match package_id {
         "grafana" => cleanup_stale_pasta_port("3000").await,
+        "homeassistant" | "home-assistant" => cleanup_stale_pasta_port("8123").await,
         "searxng" => cleanup_stale_pasta_port("8888").await,
         "uptime-kuma" => cleanup_stale_pasta_port("3002").await,
         "gitea" => {
@@ -1795,11 +1865,21 @@ async fn cleanup_stale_package_ports(package_id: &str) {
             cleanup_stale_pasta_port("2222").await;
             cleanup_stale_pasta_port("3000").await;
         }
+        "nginx-proxy-manager" => {
+            cleanup_stale_pasta_port("81").await;
+            cleanup_stale_pasta_port("8084").await;
+            cleanup_stale_pasta_port("8444").await;
+        }
+        "nextcloud" => cleanup_stale_pasta_port("8085").await,
         _ => {}
     }
 }
 
 async fn cleanup_start_conflict(package_id: &str, stderr: &str) -> bool {
+    if stderr.contains("name is already in use") || stderr.contains("name \"") {
+        return true;
+    }
+
     match package_id {
         "grafana"
             if stderr.contains("pasta failed") || stderr.contains("address already in use") =>
@@ -1807,6 +1887,12 @@ async fn cleanup_start_conflict(package_id: &str, stderr: &str) -> bool {
             cleanup_stale_pasta_port("3000").await;
             true
         }
+        "homeassistant" | "home-assistant"
+            if stderr.contains("pasta failed") || stderr.contains("address already in use") =>
+        {
+            cleanup_stale_pasta_port("8123").await;
+            true
+        }
         "searxng"
             if stderr.contains("pasta failed") || stderr.contains("address already in use") =>
         {
@@ -1825,6 +1911,20 @@ async fn cleanup_start_conflict(package_id: &str, stderr: &str) -> bool {
             cleanup_stale_pasta_port("3000").await;
             true
         }
+        "nginx-proxy-manager"
+            if stderr.contains("pasta failed") || stderr.contains("address already in use") =>
+        {
+            cleanup_stale_pasta_port("81").await;
+            cleanup_stale_pasta_port("8084").await;
+            cleanup_stale_pasta_port("8444").await;
+            true
+        }
+        "nextcloud"
+            if stderr.contains("pasta failed") || stderr.contains("address already in use") =>
+        {
+            cleanup_stale_pasta_port("8085").await;
+            true
+        }
         _ => false,
     }
 }
@@ -1839,6 +1939,11 @@ async fn cleanup_stale_pasta_port(port: &str) {
         .output()
         .await;
 
+    let _ = tokio::process::Command::new("sudo")
+        .args(["fuser", "-k", &format!("{}/tcp", port)])
+        .output()
+        .await;
+
     let pattern = format!("pasta.*{}", port);
     let _ = tokio::process::Command::new("pkill")
         .args(["-f", &pattern])
@@ -1910,12 +2015,40 @@ async fn ensure_host_port_listener(package_id: &str, container_name: &str) -> Re
     ))
 }
 
+async fn ensure_user_podman_socket() -> Result<()> {
+    let socket_path = "/run/user/1000/podman/podman.sock";
+    if tokio::fs::try_exists(socket_path).await.unwrap_or(false) {
+        return Ok(());
+    }
+
+    let status = tokio::process::Command::new("systemctl")
+        .args(["--user", "restart", "podman.socket"])
+        .status()
+        .await
+        .context("spawn systemctl --user restart podman.socket")?;
+    if !status.success() {
+        anyhow::bail!("systemctl --user restart podman.socket exited {status}");
+    }
+
+    for _ in 0..20 {
+        if tokio::fs::try_exists(socket_path).await.unwrap_or(false) {
+            return Ok(());
+        }
+        tokio::time::sleep(Duration::from_millis(250)).await;
+    }
+
+    anyhow::bail!("podman socket {socket_path} did not appear after restart")
+}
+
 fn required_host_port(package_id: &str) -> Option<u16> {
     match package_id {
         "grafana" => Some(3000),
+        "homeassistant" | "home-assistant" => Some(8123),
         "searxng" => Some(8888),
         "uptime-kuma" => Some(3002),
         "gitea" => Some(3001),
+        "nextcloud" => Some(8085),
+        "nginx-proxy-manager" => Some(81),
         _ => None,
     }
 }

core/archipelago/src/api/rpc/package/runtime.rs

@@ -5,9 +5,14 @@ use super::validation::validate_app_id;
 use crate::api::rpc::RpcHandler;
 use crate::data_model::PackageState;
 use anyhow::{Context, Result};
+use std::process::Output;
 use std::sync::Arc;
+use std::time::Duration;
 use tracing::warn;
 
+const PODMAN_CONTROL_TIMEOUT: Duration = Duration::from_secs(30);
+const PODMAN_LOG_TIMEOUT: Duration = Duration::from_secs(15);
+
 /// Per-container graceful shutdown timeout in seconds.
 /// Bitcoin Core needs 600s to flush UTXO set, LND 330s for channel state,
 /// indexers 300s for index flush, databases 120s for WAL/transaction commit.
@@ -292,10 +297,7 @@ impl RpcHandler {
             )
             .await;
             tracing::info!("Uninstall {}: stopping container {}", package_id, name);
-            let stop_out = tokio::process::Command::new("podman")
-                .args(["stop", "-t", stop_timeout_secs(name), name])
-                .output()
-                .await;
+            let stop_out = podman_control(&["stop", "-t", stop_timeout_secs(name), name]).await;
             match stop_out {
                 Ok(o) if o.status.success() => stopped += 1,
                 Ok(o) => {
@@ -314,10 +316,7 @@ impl RpcHandler {
 
             // Remove container (without -f to respect graceful shutdown above)
             tracing::info!("Uninstall {}: removing container {}", package_id, name);
-            let rm_out = tokio::process::Command::new("podman")
-                .args(["rm", name])
-                .output()
-                .await;
+            let rm_out = podman_control(&["rm", name]).await;
             match rm_out {
                 Ok(o) if o.status.success() => removed += 1,
                 Ok(o) => {
@@ -329,10 +328,7 @@ impl RpcHandler {
                         name,
                         stderr.trim()
                     );
-                    let force_rm = tokio::process::Command::new("podman")
-                        .args(["rm", "-f", name])
-                        .output()
-                        .await;
+                    let force_rm = podman_control(&["rm", "-f", name]).await;
                     match force_rm {
                         Ok(o2) if o2.status.success() => removed += 1,
                         _ => {
@@ -353,10 +349,7 @@ impl RpcHandler {
         self.set_uninstall_stage(package_id, "Cleaning up volumes")
             .await;
         // Clean up dangling volumes associated with removed containers
-        let _ = tokio::process::Command::new("podman")
-            .args(["volume", "prune", "-f"])
-            .output()
-            .await;
+        let _ = podman_control(&["volume", "prune", "-f"]).await;
 
         // Clean up app-specific networks (only if no other containers use them)
         let app_networks: Vec<&str> = match package_id {
@@ -366,10 +359,7 @@ impl RpcHandler {
             _ => vec![],
         };
         for net in &app_networks {
-            let _ = tokio::process::Command::new("podman")
-                .args(["network", "rm", net])
-                .output()
-                .await;
+            let _ = podman_control(&["network", "rm", net]).await;
         }
 
         // Release port allocation
@@ -485,18 +475,16 @@ impl RpcHandler {
             .and_then(|v| v.as_array())
             .ok_or_else(|| anyhow::anyhow!("Missing volumes"))?;
 
-        let check_output = tokio::process::Command::new("podman")
-            .args([
-                "ps",
-                "-a",
-                "--format",
-                "{{.Names}}",
-                "--filter",
-                &format!("name={}", app_id),
-            ])
-            .output()
-            .await
-            .context("Failed to check container")?;
+        let check_output = podman_control(&[
+            "ps",
+            "-a",
+            "--format",
+            "{{.Names}}",
+            "--filter",
+            &format!("name={}", app_id),
+        ])
+        .await
+        .context("Failed to check container")?;
 
         let existing = String::from_utf8_lossy(&check_output.stdout);
 
@@ -541,16 +529,14 @@ impl RpcHandler {
 
             cmd.arg(image);
 
-            let output = cmd.output().await.context("Failed to create container")?;
+            let output = command_with_timeout(cmd, PODMAN_CONTROL_TIMEOUT, "podman run").await?;
 
             if !output.status.success() {
                 let stderr = String::from_utf8_lossy(&output.stderr);
                 return Err(anyhow::anyhow!("Failed to create container: {}", stderr));
             }
         } else {
-            let output = tokio::process::Command::new("podman")
-                .args(["start", app_id])
-                .output()
+            let output = podman_control(&["start", app_id])
                 .await
                 .context("Failed to start container")?;
 
@@ -575,9 +561,7 @@ impl RpcHandler {
             .ok_or_else(|| anyhow::anyhow!("Missing app_id"))?;
         validate_app_id(app_id)?;
 
-        let output = tokio::process::Command::new("podman")
-            .args(["stop", "-t", stop_timeout_secs(app_id), app_id])
-            .output()
+        let output = podman_control(&["stop", "-t", stop_timeout_secs(app_id), app_id])
             .await
             .context("Failed to stop container")?;
 
@@ -611,9 +595,7 @@ async fn do_package_start(to_start: &[String]) -> Result<()> {
         }
         repair_before_package_start(name).await;
         tracing::info!("Starting container: {}", name);
-        let out = tokio::process::Command::new("podman")
-            .args(["start", name])
-            .output()
+        let out = podman_control(&["start", name])
             .await
             .context(format!("Failed to exec podman start {}", name))?;
         if !out.status.success() {
@@ -632,17 +614,12 @@ async fn do_package_start(to_start: &[String]) -> Result<()> {
     // container exits immediately after).
     tokio::time::sleep(std::time::Duration::from_secs(3)).await;
     for name in to_start {
-        let status = tokio::process::Command::new("podman")
-            .args(["inspect", name, "--format", "{{.State.Status}}"])
-            .output()
-            .await;
+        let status = podman_control(&["inspect", name, "--format", "{{.State.Status}}"]).await;
         if let Ok(o) = status {
             let state = String::from_utf8_lossy(&o.stdout).trim().to_string();
             if state == "exited" {
-                let logs = tokio::process::Command::new("podman")
-                    .args(["logs", "--tail", "5", name])
-                    .output()
-                    .await;
+                let logs =
+                    podman_with_timeout(&["logs", "--tail", "5", name], PODMAN_LOG_TIMEOUT).await;
                 let log_text = logs
                     .map(|o| {
                         let combined = format!(
@@ -714,6 +691,39 @@ async fn wait_after_orchestrator_start(name: &str) {
     }
 }
 
+async fn podman_control(args: &[&str]) -> Result<Output> {
+    podman_with_timeout(args, podman_control_timeout(args)).await
+}
+
+fn podman_control_timeout(args: &[&str]) -> Duration {
+    args.windows(2)
+        .find_map(|pair| {
+            (pair[0] == "-t")
+                .then(|| pair[1].parse::<u64>().ok())
+                .flatten()
+        })
+        .map(|secs| Duration::from_secs(secs.saturating_add(30)))
+        .unwrap_or(PODMAN_CONTROL_TIMEOUT)
+}
+
+async fn podman_with_timeout(args: &[&str], timeout: Duration) -> Result<Output> {
+    let mut cmd = tokio::process::Command::new("podman");
+    cmd.args(args);
+    command_with_timeout(cmd, timeout, &format!("podman {}", args.join(" "))).await
+}
+
+async fn command_with_timeout(
+    mut cmd: tokio::process::Command,
+    timeout: Duration,
+    description: &str,
+) -> Result<Output> {
+    cmd.kill_on_drop(true);
+    tokio::time::timeout(timeout, cmd.output())
+        .await
+        .with_context(|| format!("{} timed out after {}s", description, timeout.as_secs()))?
+        .with_context(|| format!("Failed to exec {}", description))
+}
+
 async fn do_orchestrator_package_stop(
     orchestrator: &dyn crate::container::traits::ContainerOrchestrator,
     containers: &[String],
@@ -757,9 +767,7 @@ async fn do_package_stop(containers: &[String]) -> Result<()> {
             name,
             stop_timeout_secs(name)
         );
-        let out = tokio::process::Command::new("podman")
-            .args(["stop", "-t", stop_timeout_secs(name), name])
-            .output()
+        let out = podman_control(&["stop", "-t", stop_timeout_secs(name), name])
             .await
             .context(format!("Failed to exec podman stop {}", name))?;
         if !out.status.success() {
@@ -785,9 +793,7 @@ async fn do_package_restart(containers: &[String]) -> Result<()> {
     for name in containers {
         tracing::info!("Restarting container: {}", name);
         repair_before_package_start(name).await;
-        let out = tokio::process::Command::new("podman")
-            .args(["restart", "-t", stop_timeout_secs(name), name])
-            .output()
+        let out = podman_control(&["restart", "-t", stop_timeout_secs(name), name])
             .await
             .context(format!("Failed to exec podman restart {}", name))?;
 
@@ -803,13 +809,8 @@ async fn do_package_restart(containers: &[String]) -> Result<()> {
                 stderr
             );
             // Fallback: stop then start
-            let _ = tokio::process::Command::new("podman")
-                .args(["stop", "-t", stop_timeout_secs(name), name])
-                .output()
-                .await;
-            let start_out = tokio::process::Command::new("podman")
-                .args(["start", name])
-                .output()
+            let _ = podman_control(&["stop", "-t", stop_timeout_secs(name), name]).await;
+            let start_out = podman_control(&["start", name])
                 .await
                 .context(format!("Failed to exec podman start {}", name))?;
             if !start_out.status.success() {
@@ -852,6 +853,12 @@ async fn repair_before_package_start(container_name: &str) {
             repair_grafana_dirs().await;
             cleanup_stale_pasta_port("3000").await;
         }
+        "vaultwarden" => cleanup_stale_pasta_port("8082").await,
+        "homeassistant" | "home-assistant" => cleanup_stale_pasta_port("8123").await,
+        "nextcloud" => {
+            repair_nextcloud_dirs().await;
+            cleanup_stale_pasta_port("8085").await;
+        }
         "gitea" => cleanup_gitea_stale_ports().await,
         _ => {}
     }
@@ -871,9 +878,7 @@ async fn ensure_runtime_host_port_listener(container_name: &str) -> Result<()> {
         container_name, port
     ))
     .await;
-    let output = tokio::process::Command::new("podman")
-        .args(["restart", container_name])
-        .output()
+    let output = podman_control(&["restart", container_name])
         .await
         .context("failed to restart container after missing host port")?;
     if !output.status.success() {
@@ -905,9 +910,13 @@ async fn ensure_runtime_host_port_listener(container_name: &str) -> Result<()> {
 fn runtime_required_host_port(container_name: &str) -> Option<u16> {
     match container_name {
         "grafana" => Some(3000),
+        "homeassistant" | "home-assistant" => Some(8123),
         "searxng" => Some(8888),
         "uptime-kuma" => Some(3002),
+        "vaultwarden" => Some(8082),
         "gitea" => Some(3001),
+        "nextcloud" => Some(8085),
+        "nginx-proxy-manager" => Some(81),
         _ => None,
     }
 }
@@ -957,16 +966,14 @@ async fn repair_grafana_dirs() {
         .args(["mkdir", "-p", "/var/lib/archipelago/grafana"])
         .output()
         .await;
-    let podman_chown = tokio::process::Command::new("podman")
-        .args([
-            "unshare",
-            "chown",
-            "-R",
-            "472:472",
-            "/var/lib/archipelago/grafana",
-        ])
-        .output()
-        .await;
+    let podman_chown = podman_control(&[
+        "unshare",
+        "chown",
+        "-R",
+        "472:472",
+        "/var/lib/archipelago/grafana",
+    ])
+    .await;
     if !podman_chown.as_ref().is_ok_and(|o| o.status.success()) {
         let _ = tokio::process::Command::new("sudo")
             .args([
@@ -980,6 +987,32 @@ async fn repair_grafana_dirs() {
     }
 }
 
+async fn repair_nextcloud_dirs() {
+    let _ = tokio::process::Command::new("sudo")
+        .args(["mkdir", "-p", "/var/lib/archipelago/nextcloud"])
+        .output()
+        .await;
+    let podman_chown = podman_control(&[
+        "unshare",
+        "chown",
+        "-R",
+        "33:33",
+        "/var/lib/archipelago/nextcloud",
+    ])
+    .await;
+    if !podman_chown.as_ref().is_ok_and(|o| o.status.success()) {
+        let _ = tokio::process::Command::new("sudo")
+            .args([
+                "chown",
+                "-R",
+                "100032:100032",
+                "/var/lib/archipelago/nextcloud",
+            ])
+            .output()
+            .await;
+    }
+}
+
 async fn repair_btcpay_database_password() {
     let Ok(db_pass) =
         tokio::fs::read_to_string("/var/lib/archipelago/secrets/btcpay-db-password").await
@@ -991,39 +1024,32 @@ async fn repair_btcpay_database_password() {
         return;
     }
 
-    let _ = tokio::process::Command::new("podman")
-        .args(["start", "archy-btcpay-db"])
-        .output()
-        .await;
+    let _ = podman_control(&["start", "archy-btcpay-db"]).await;
     tokio::time::sleep(std::time::Duration::from_secs(2)).await;
 
     let escaped = db_pass.replace('\'', "''");
     let sql = format!("ALTER USER btcpay WITH PASSWORD '{}';", escaped);
-    let _ = tokio::process::Command::new("podman")
-        .args([
-            "exec",
-            "archy-btcpay-db",
-            "psql",
-            "-U",
-            "btcpay",
-            "-d",
-            "btcpay",
-            "-c",
-            &sql,
-        ])
-        .output()
-        .await;
-    let _ = tokio::process::Command::new("podman")
-        .args([
-            "exec",
-            "archy-btcpay-db",
-            "createdb",
-            "-U",
-            "btcpay",
-            "nbxplorer",
-        ])
-        .output()
-        .await;
+    let _ = podman_control(&[
+        "exec",
+        "archy-btcpay-db",
+        "psql",
+        "-U",
+        "btcpay",
+        "-d",
+        "btcpay",
+        "-c",
+        &sql,
+    ])
+    .await;
+    let _ = podman_control(&[
+        "exec",
+        "archy-btcpay-db",
+        "createdb",
+        "-U",
+        "btcpay",
+        "nbxplorer",
+    ])
+    .await;
 }
 
 async fn repair_indeedhub_network() {
@@ -1040,11 +1066,18 @@ async fn cleanup_start_conflict(container_name: &str, stderr: &str) {
         return;
     }
 
-    if container_name != "grafana" {
-        return;
+    match container_name {
+        "grafana" => cleanup_stale_pasta_port("3000").await,
+        "homeassistant" | "home-assistant" => cleanup_stale_pasta_port("8123").await,
+        "vaultwarden" => cleanup_stale_pasta_port("8082").await,
+        "nextcloud" => cleanup_stale_pasta_port("8085").await,
+        "nginx-proxy-manager" => {
+            cleanup_stale_pasta_port("81").await;
+            cleanup_stale_pasta_port("8084").await;
+            cleanup_stale_pasta_port("8444").await;
+        }
+        _ => {}
     }
-
-    cleanup_stale_pasta_port("3000").await;
 }
 
 async fn cleanup_stale_pasta_port(port: &str) {

core/archipelago/src/api/rpc/package/stacks.rs

@@ -775,6 +775,8 @@ impl RpcHandler {
 
     /// Install Mempool stack (mariadb + mempool-api + mempool-web).
     pub(super) async fn install_mempool_stack(&self) -> Result<serde_json::Value> {
+        super::dependencies::check_bitcoin_pruning_compatibility("mempool").await?;
+
         if let Some(adopted) = adopt_stack_if_exists(
             "mempool",
             "mempool",