feat(registry): move image and OTA references to the public domain

Replaces the registry host across 86 files: 309 references, covering all 40
app manifests, the orchestrator and container crates, the release and catalog
scripts, both demo-images workflows, the ISO builder, demo-deploy, and the
frontend marketplace data.

Verified the domain actually serves the registry before rewriting anything,
rather than assuming the web host implies the registry:
- TLS verifies clean, HTTP/2 on the web root
- an anonymous token grants a manifest fetch (HTTP 200) with no credentials
- skopeo inspect --no-creds resolves an image and lists its tags

That last check is the one that matters: an outside developer with no account
can now pull, which was the functional blocker for publishing at all.

Plain-HTTP references become HTTPS in the same pass, so OTA downloads stop
crossing the network in the clear.

Deliberately NOT rewritten:
- The public FIPS anchor on port 8444. It is a functional network endpoint
  every node dials to bootstrap the mesh — closer to Bitcoin Core's hardcoded
  seeds than to leaked infrastructure. The domain does resolve to the same
  host, so it could become a hostname, but that adds a DNS dependency to the
  path used precisely when things are broken. Worth a deliberate decision,
  not a side effect of this change.
- The companion APK on port 2100. The domain returns 404 for that path, so
  rewriting it would swap a working URL for a broken one. The Releases page
  does serve (200), which is where the plan already wants those binaries.
- releases/app-catalog.json, releases/manifest.json and release-manifest.json.
  These carry `signature` and `signed_by`; editing their contents invalidates
  the signature and the fleet refuses artifacts that fail verification. They
  were rewritten in a first pass and reverted — they must be regenerated and
  re-signed through the signing ceremony instead, which needs the mnemonic.

So the catalog still advertises the old host until that ceremony runs. Nodes
resolve images through the signed catalog, not the on-disk manifests, so this
commit alone does not change what a node pulls.

Verified: archipelago-container 75/75; every manifest still parses with a
top-level app block; no signed artifact modified.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/demo-images.yml

@@ -5,7 +5,7 @@ name: Demo images
 # code (see demo-deploy/ and docs/demo-deployment-design.md).
 #
 # Required repo configuration:
-#   vars.DEMO_REGISTRY        e.g. 146.59.87.168:3000/lfg2025
+#   vars.DEMO_REGISTRY        e.g. source.archipelago-foundation.org/lfg2025
 #   vars.DEMO_REGISTRY_HOST   registry host for docker login (no org suffix)
 #   secrets.DEMO_REGISTRY_USER
 #   secrets.DEMO_REGISTRY_TOKEN

.github/workflows/demo-images.yml

@@ -5,7 +5,7 @@ name: Demo images
 # code (see demo-deploy/ and docs/demo-deployment-design.md).
 #
 # Required repo configuration:
-#   vars.DEMO_REGISTRY        e.g. 146.59.87.168:3000/lfg2025
+#   vars.DEMO_REGISTRY        e.g. source.archipelago-foundation.org/lfg2025
 #   vars.DEMO_REGISTRY_HOST   registry host for docker login (no org suffix)
 #   secrets.DEMO_REGISTRY_USER
 #   secrets.DEMO_REGISTRY_TOKEN

.gitmodules

@@ -1,3 +1,3 @@
 [submodule "indeedhub"]
 	path = indeedhub
-	url = http://146.59.87.168:3000/lfg2025/indeehub.git
+	url = https://source.archipelago-foundation.org/lfg2025/indeehub.git

Android/COMPANION_RELEASE.md

@@ -92,7 +92,7 @@ built and signed:
 
 ```bash
 SERVED=neode-ui/public/packages/archipelago-companion.apk
-GITEA_URL=http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/$SERVED
+GITEA_URL=https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/$SERVED
 QR_URL=http://146.59.87.168:2100/packages/archipelago-companion.apk
 curl -sS -o /tmp/live-gitea.apk "$GITEA_URL"
 curl -sS -o /tmp/live-qr.apk "$QR_URL"

app-catalog/README.md

@@ -21,7 +21,7 @@ Add an entry to `catalog.json`:
   "icon": "/assets/img/app-icons/my-app.svg",
   "author": "Author",
   "category": "data",
-  "dockerImage": "146.59.87.168:3000/lfg2025/my-app:1.0.0",
+  "dockerImage": "source.archipelago-foundation.org/lfg2025/my-app:1.0.0",
   "repoUrl": "https://github.com/...",
   "containerConfig": {
     "ports": ["8080:8080"],

app-catalog/catalog.json

@@ -1,7 +1,7 @@
 {
   "version": 2,
   "updated": "2026-04-22T00:00:00Z",
-  "registry": "146.59.87.168:3000/lfg2025",
+  "registry": "source.archipelago-foundation.org/lfg2025",
   "featured": {
     "id": "indeedhub",
     "banner": "/assets/img/featured/indeedhub-banner.jpg",
@@ -19,7 +19,7 @@
       "author": "Bitcoin Knots",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/bitcoin-knots:latest",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest",
       "repoUrl": "https://github.com/bitcoinknots/bitcoin"
     },
     {
@@ -31,7 +31,7 @@
       "author": "Bitcoin Core contributors",
       "category": "money",
       "tier": "optional",
-      "dockerImage": "146.59.87.168:3000/lfg2025/bitcoin:28.4",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/bitcoin:28.4",
       "repoUrl": "https://github.com/bitcoin/bitcoin"
     },
     {
@@ -43,7 +43,7 @@
       "author": "Lightning Labs",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta",
       "repoUrl": "https://github.com/lightningnetwork/lnd",
       "requires": [
         "bitcoin-knots"
@@ -73,7 +73,7 @@
       "author": "Mempool",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1",
       "repoUrl": "https://github.com/mempool/mempool",
       "requires": [
         "bitcoin-knots",
@@ -89,7 +89,7 @@
       "author": "Luke Childs",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/electrumx:v1.18.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0",
       "repoUrl": "https://github.com/spesmilo/electrumx",
       "requires": [
         "bitcoin-knots"
@@ -103,7 +103,7 @@
       "icon": "/assets/img/app-icons/indeedhub.png",
       "author": "IndeeHub",
       "category": "community",
-      "dockerImage": "146.59.87.168:3000/lfg2025/indeedhub:1.0.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0",
       "repoUrl": "https://github.com/indeedhub/indeedhub"
     },
     {
@@ -114,7 +114,7 @@
       "icon": "/assets/img/app-icons/botfights.svg",
       "author": "BotFights",
       "category": "community",
-      "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.2.11",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/botfights:1.2.11",
       "repoUrl": "https://botfights.net",
       "containerConfig": {
         "ports": [
@@ -172,7 +172,7 @@
       "author": "File Browser",
       "category": "data",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/filebrowser:v2.27.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0",
       "repoUrl": "https://github.com/filebrowser/filebrowser",
       "containerConfig": {
         "ports": [
@@ -223,7 +223,7 @@
       "author": "Vaultwarden",
       "category": "data",
       "tier": "recommended",
-      "dockerImage": "146.59.87.168:3000/lfg2025/vaultwarden:1.30.0-alpine",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.30.0-alpine",
       "repoUrl": "https://github.com/dani-garcia/vaultwarden",
       "containerConfig": {
         "ports": [
@@ -243,7 +243,7 @@
       "author": "SearXNG",
       "category": "data",
       "tier": "recommended",
-      "dockerImage": "146.59.87.168:3000/lfg2025/searxng:latest",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/searxng:latest",
       "repoUrl": "https://github.com/searxng/searxng",
       "containerConfig": {
         "ports": [
@@ -262,7 +262,7 @@
       "icon": "/assets/img/app-icons/fedimint.png",
       "author": "Fedimint",
       "category": "money",
-      "dockerImage": "146.59.87.168:3000/lfg2025/fedimintd:v0.10.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0",
       "repoUrl": "https://github.com/fedimint/fedimint"
     },
     {
@@ -274,7 +274,7 @@
       "author": "Fedimint",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/fmcd:0.8.1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/fmcd:0.8.1",
       "repoUrl": "https://github.com/minmoto/fmcd"
     },
     {
@@ -285,7 +285,7 @@
       "icon": "/assets/img/app-icons/fedimint.png",
       "author": "Fedimint",
       "category": "money",
-      "dockerImage": "146.59.87.168:3000/lfg2025/gatewayd:v0.10.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.0",
       "repoUrl": "https://github.com/fedimint/fedimint",
       "containerConfig": {
         "ports": [
@@ -306,7 +306,7 @@
       "icon": "/assets/img/app-icons/bark.png",
       "author": "Second",
       "category": "money",
-      "dockerImage": "146.59.87.168:3000/lfg2025/barkd:0.3.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/barkd:0.3.0",
       "repoUrl": "https://gitlab.com/ark-bitcoin/bark",
       "containerConfig": {
         "ports": [
@@ -325,7 +325,7 @@
       "icon": "/assets/img/app-icons/jellyfin.webp",
       "author": "Jellyfin",
       "category": "data",
-      "dockerImage": "146.59.87.168:3000/lfg2025/jellyfin:10.8.13",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/jellyfin:10.8.13",
       "repoUrl": "https://github.com/jellyfin/jellyfin",
       "containerConfig": {
         "ports": [
@@ -345,7 +345,7 @@
       "icon": "/assets/img/app-icons/immich.png",
       "author": "Immich",
       "category": "data",
-      "dockerImage": "146.59.87.168:3000/lfg2025/immich-server:release",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/immich-server:release",
       "repoUrl": "https://github.com/immich-app/immich"
     },
     {
@@ -356,7 +356,7 @@
       "icon": "/assets/img/app-icons/homeassistant.png",
       "author": "Home Assistant",
       "category": "home",
-      "dockerImage": "146.59.87.168:3000/lfg2025/home-assistant:2026.7.3",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.7.3",
       "repoUrl": "https://github.com/home-assistant/core",
       "containerConfig": {
         "ports": [
@@ -414,7 +414,7 @@
       "author": "Tailscale",
       "category": "networking",
       "tier": "recommended",
-      "dockerImage": "146.59.87.168:3000/lfg2025/tailscale:stable",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/tailscale:stable",
       "repoUrl": "https://github.com/tailscale/tailscale",
       "containerConfig": {
         "ports": [
@@ -442,7 +442,7 @@
       "author": "Portainer",
       "category": "development",
       "tier": "optional",
-      "dockerImage": "146.59.87.168:3000/lfg2025/portainer:2.39.1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.39.1",
       "repoUrl": "https://github.com/portainer/portainer",
       "containerConfig": {
         "ports": [
@@ -487,7 +487,7 @@
       "author": "Uptime Kuma",
       "category": "data",
       "tier": "recommended",
-      "dockerImage": "146.59.87.168:3000/lfg2025/uptime-kuma:1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/uptime-kuma:1",
       "repoUrl": "https://github.com/louislam/uptime-kuma",
       "containerConfig": {
         "ports": [
@@ -514,7 +514,7 @@
       "icon": "/assets/img/app-icons/photoprism.svg",
       "author": "PhotoPrism",
       "category": "data",
-      "dockerImage": "146.59.87.168:3000/lfg2025/photoprism:240915",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/photoprism:240915",
       "repoUrl": "https://github.com/photoprism/photoprism",
       "containerConfig": {
         "ports": [
@@ -537,7 +537,7 @@
       "icon": "/assets/img/app-icons/nextcloud.webp",
       "author": "Nextcloud",
       "category": "data",
-      "dockerImage": "146.59.87.168:3000/lfg2025/nextcloud:29",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/nextcloud:29",
       "repoUrl": "https://github.com/nextcloud/server",
       "containerConfig": {
         "ports": [

apps/archy-btcpay-db/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Postgres backend for BTCPay and NBXplorer.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/postgres:15.17
+    image: source.archipelago-foundation.org/lfg2025/postgres:15.17
     pull_policy: if-not-present
     network: archy-net
     data_uid: "100998:100998"

apps/archy-mempool-db/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: MariaDB backend for the mempool explorer stack.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/mariadb:11.4.10
+    image: source.archipelago-foundation.org/lfg2025/mariadb:11.4.10
     pull_policy: if-not-present
     network: archy-net
     data_uid: "100998:100998"

apps/archy-mempool-web/manifest.yml

@@ -6,7 +6,7 @@ app:
   container_name: mempool
 
   container:
-    image: 146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1
+    image: source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1
     pull_policy: if-not-present
     network: archy-net
 

apps/archy-nbxplorer/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: BTCPay blockchain indexer service.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/nbxplorer:2.6.0
+    image: source.archipelago-foundation.org/lfg2025/nbxplorer:2.6.0
     pull_policy: if-not-present
     network: archy-net
     secret_env:

apps/barkd/manifest.yml

@@ -10,7 +10,7 @@ app:
     # apps/barkd/Dockerfile and pushed to the node registry. Pin the tag to
     # match the REST shapes coded in core/archipelago/src/wallet/ark_client.rs
     # (validated against barkd 0.3.0 on signet, 2026-07-14).
-    image: 146.59.87.168:3000/lfg2025/barkd:0.3.0
+    image: source.archipelago-foundation.org/lfg2025/barkd:0.3.0
     pull_policy: if-not-present
     network: archy-net
     # The entrypoint installs the shared secret below via `barkd secret

apps/bitcoin-core/manifest.yml

@@ -7,7 +7,7 @@ app:
   container_name: bitcoin-core
 
   container:
-    image: 146.59.87.168:3000/lfg2025/bitcoin:28.4
+    image: source.archipelago-foundation.org/lfg2025/bitcoin:28.4
     pull_policy: if-not-present
     network: archy-net
     entrypoint: ["sh", "-lc"]

apps/bitcoin-knots/manifest.yml

@@ -7,7 +7,7 @@ app:
   container_name: bitcoin-knots
 
   container:
-    image: 146.59.87.168:3000/lfg2025/bitcoin-knots:latest
+    image: source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest
     pull_policy: if-not-present
     network: archy-net
     entrypoint: ["sh", "-lc"]

apps/botfights/manifest.yml

@@ -6,7 +6,7 @@ app:
   category: community
 
   container:
-    image: 146.59.87.168:3000/lfg2025/botfights:1.2.11
+    image: source.archipelago-foundation.org/lfg2025/botfights:1.2.11
     pull_policy: always
     # Auto-generated on first install (random hex, 0600, rootless-owned). The
     # 1.2.x image's server/src/middleware/jwt.ts throws at module import when

apps/electrumx/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Electrum server indexing Bitcoin chain data for lightweight wallet queries.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/electrumx:v1.18.0
+    image: source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0
     pull_policy: if-not-present
     network: archy-net
     data_uid: "1000:1000"

apps/fedimint-clientd/manifest.yml

@@ -9,7 +9,7 @@ app:
     # 0.8.2 — iroh-capable). No usable upstream image exists, so we build + push
     # this to the node registry. Pin the tag to match the REST shapes coded in
     # core/archipelago/src/wallet/fedimint_client.rs (validated against 0.8.2).
-    image: 146.59.87.168:3000/lfg2025/fmcd:0.8.1
+    image: source.archipelago-foundation.org/lfg2025/fmcd:0.8.1
     pull_policy: if-not-present
     network: archy-net
     # No entrypoint override: the image's resilient `fmcd-run` launcher loops

apps/fedimint-gateway/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Fedimint gateway service with automatic LND-or-LDK backend selection.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/gatewayd:v0.10.0
+    image: source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.0
     pull_policy: if-not-present
     network: archy-net
     entrypoint: ["sh", "-lc"]

apps/fedimint/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Federated Bitcoin minting service with built-in Guardian UI. Privacy-preserving Bitcoin custody.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/fedimintd:v0.10.0
+    image: source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0
     pull_policy: if-not-present
     network: archy-net
     entrypoint: ["sh", "-lc"]

apps/filebrowser/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Baseline Archipelago file manager service.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/filebrowser:v2.27.0
+    image: source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0
     pull_policy: if-not-present
     network: archy-net
     custom_args: ["--config", "/data/.filebrowser.json"]

apps/home-assistant/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Open source home automation platform. Control and monitor your smart home devices.
   
   container:
-    image: 146.59.87.168:3000/lfg2025/home-assistant:2026.7.3
+    image: source.archipelago-foundation.org/lfg2025/home-assistant:2026.7.3
     pull_policy: if-not-present
     network: pasta
     

apps/immich-postgres/manifest.yml

@@ -11,7 +11,7 @@ app:
   container_name: immich_postgres
 
   container:
-    image: 146.59.87.168:3000/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0
+    image: source.archipelago-foundation.org/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0
     pull_policy: if-not-present
     network: archy-net
     # postgres drops to its own uid (container 999 → host 100998 under rootless),

apps/immich-redis/manifest.yml

@@ -9,7 +9,7 @@ app:
   container_name: immich_redis
 
   container:
-    image: 146.59.87.168:3000/lfg2025/valkey:7-alpine
+    image: source.archipelago-foundation.org/lfg2025/valkey:7-alpine
     pull_policy: if-not-present
     network: archy-net
 

apps/immich/manifest.yml

@@ -13,7 +13,7 @@ app:
   container_name: immich_server
 
   container:
-    image: 146.59.87.168:3000/lfg2025/immich-server:release
+    image: source.archipelago-foundation.org/lfg2025/immich-server:release
     pull_policy: if-not-present
     network: archy-net
     secret_env:

apps/indeedhub-api/manifest.yml

@@ -12,7 +12,7 @@ app:
   container_name: indeedhub-api
 
   container:
-    image: 146.59.87.168:3000/lfg2025/indeedhub-api:1.0.0
+    image: source.archipelago-foundation.org/lfg2025/indeedhub-api:1.0.0
     pull_policy: if-not-present
     network: indeedhub-net
     network_aliases: [api]

apps/indeedhub-ffmpeg/manifest.yml

@@ -11,7 +11,7 @@ app:
   container_name: indeedhub-ffmpeg
 
   container:
-    image: 146.59.87.168:3000/lfg2025/indeedhub-ffmpeg:1.0.0
+    image: source.archipelago-foundation.org/lfg2025/indeedhub-ffmpeg:1.0.0
     pull_policy: if-not-present
     network: indeedhub-net
     secret_env:

apps/indeedhub-minio/manifest.yml

@@ -11,7 +11,7 @@ app:
   container_name: indeedhub-minio
 
   container:
-    image: 146.59.87.168:3000/lfg2025/minio:RELEASE.2024-11-07T00-52-20Z
+    image: source.archipelago-foundation.org/lfg2025/minio:RELEASE.2024-11-07T00-52-20Z
     pull_policy: if-not-present
     network: indeedhub-net
     network_aliases: [minio]

apps/indeedhub-postgres/manifest.yml

@@ -14,7 +14,7 @@ app:
   container_name: indeedhub-postgres
 
   container:
-    image: 146.59.87.168:3000/lfg2025/postgres:16.13-alpine
+    image: source.archipelago-foundation.org/lfg2025/postgres:16.13-alpine
     pull_policy: if-not-present
     network: indeedhub-net
     network_aliases: [postgres]

apps/indeedhub-redis/manifest.yml

@@ -10,7 +10,7 @@ app:
   container_name: indeedhub-redis
 
   container:
-    image: 146.59.87.168:3000/lfg2025/redis:7.4.8-alpine
+    image: source.archipelago-foundation.org/lfg2025/redis:7.4.8-alpine
     pull_policy: if-not-present
     network: indeedhub-net
     network_aliases: [redis]

apps/indeedhub-relay/manifest.yml

@@ -11,7 +11,7 @@ app:
   container_name: indeedhub-relay
 
   container:
-    image: 146.59.87.168:3000/lfg2025/nostr-rs-relay:0.9.0
+    image: source.archipelago-foundation.org/lfg2025/nostr-rs-relay:0.9.0
     pull_policy: if-not-present
     network: indeedhub-net
     network_aliases: [relay]

apps/indeedhub/manifest.yml

@@ -12,7 +12,7 @@ app:
   container_name: indeedhub
 
   container:
-    image: 146.59.87.168:3000/lfg2025/indeedhub:1.0.0
+    image: source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0
     pull_policy: if-not-present
     network: indeedhub-net
 

apps/indeedhub/push-to-registry.sh

@@ -12,7 +12,7 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FRONTEND_DIR="${INDEEHUB_FRONTEND:-$HOME/Projects/indeehub-frontend}"
 VERSION="${1:-latest}"
-REGISTRY="${REGISTRY:-146.59.87.168:3000}"
+REGISTRY="${REGISTRY:-source.archipelago-foundation.org}"
 NAMESPACE="${NAMESPACE:-lfg2025}"
 IMAGE_NAME="indeedhub"
 RUNTIME="${RUNTIME:-podman}"

apps/jellyfin/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Free media server. Stream movies, music, and photos.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/jellyfin:10.8.13
+    image: source.archipelago-foundation.org/lfg2025/jellyfin:10.8.13
     pull_policy: if-not-present
     network: pasta
 

apps/lnd/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Lightning Network implementation by Lightning Labs. Enables instant, low-cost Bitcoin payments.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta
+    image: source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta
     pull_policy: if-not-present
     network: archy-net
     # BITCOIND_HOST must follow the node's actual Bitcoin container — Knots or

apps/mempool-api/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Backend API for mempool explorer.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/mempool-backend:v3.0.0
+    image: source.archipelago-foundation.org/lfg2025/mempool-backend:v3.0.0
     pull_policy: if-not-present
     network: archy-net
     # CORE_RPC_HOST must follow the node's actual Bitcoin container — Knots or

apps/mempool/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Bitcoin mempool and blockchain explorer. Real-time transaction and block visualization.
   
   container:
-    image: 146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1
+    image: source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1
     image_signature: cosign://...
     pull_policy: if-not-present
     

apps/nextcloud/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Your own private cloud. File sync, calendars, contacts.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/nextcloud:29
+    image: source.archipelago-foundation.org/lfg2025/nextcloud:29
     pull_policy: if-not-present
     network: pasta
 

apps/photoprism/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: AI-powered photo management with facial recognition.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/photoprism:240915
+    image: source.archipelago-foundation.org/lfg2025/photoprism:240915
     pull_policy: if-not-present
 
   dependencies:

apps/portainer/manifest.yml

@@ -6,7 +6,7 @@ app:
   category: development
 
   container:
-    image: 146.59.87.168:3000/lfg2025/portainer:2.39.1
+    image: source.archipelago-foundation.org/lfg2025/portainer:2.39.1
     pull_policy: if-not-present
     data_uid: "1000:1000"
 

apps/searxng/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Privacy-respecting metasearch engine. Search the web without tracking.
   
   container:
-    image: 146.59.87.168:3000/lfg2025/searxng:latest
+    image: source.archipelago-foundation.org/lfg2025/searxng:latest
     pull_policy: if-not-present
     
   dependencies:

apps/uptime-kuma/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Self-hosted uptime monitoring.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/uptime-kuma:1
+    image: source.archipelago-foundation.org/lfg2025/uptime-kuma:1
     pull_policy: if-not-present
     network: pasta
     custom_args: ["--", "node", "server/server.js"]

apps/vaultwarden/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Self-hosted password vault with zero-knowledge encryption.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/vaultwarden:1.30.0-alpine
+    image: source.archipelago-foundation.org/lfg2025/vaultwarden:1.30.0-alpine
     pull_policy: if-not-present
     network: pasta
 

core/archipelago/src/api/handler/mod.rs

@@ -152,7 +152,7 @@ impl ApiHandler {
         }
         if upstreams.is_empty() {
             upstreams.push(
-                "http://146.59.87.168:3000/lfg2025/app-catalog/raw/branch/main/catalog.json"
+                "https://source.archipelago-foundation.org/lfg2025/app-catalog/raw/branch/main/catalog.json"
                     .to_string(),
             );
         }

core/archipelago/src/api/rpc/package/install.rs

@@ -1925,7 +1925,7 @@ autopilot.active=false\n",
             .unwrap_or(true);
 
         // Registries are configured as `host[:port]/namespace` (for
-        // example `146.59.87.168:3000/lfg2025`), but the Docker V2
+        // example `source.archipelago-foundation.org/lfg2025`), but the Docker V2
         // registry API lives at `/v2/` on the ROOT of the host — NOT
         // under the namespace. Strip the namespace before appending
         // `/v2/` so the reachability probe hits the correct URL.

core/archipelago/src/api/rpc/package/set_config.rs

@@ -335,15 +335,15 @@ mod tests {
     #[test]
     fn image_tag_keeps_registry_port_colon() {
         assert_eq!(
-            image_tag("146.59.87.168:3000/lfg2025/bitcoin:28.4").as_deref(),
+            image_tag("source.archipelago-foundation.org/lfg2025/bitcoin:28.4").as_deref(),
             Some("28.4")
         );
         assert_eq!(
-            image_tag("146.59.87.168:3000/lfg2025/bitcoin-knots:29.3.knots20260508").as_deref(),
+            image_tag("source.archipelago-foundation.org/lfg2025/bitcoin-knots:29.3.knots20260508").as_deref(),
             Some("29.3.knots20260508")
         );
         // No tag => None (don't mistake the registry port for a tag).
-        assert_eq!(image_tag("146.59.87.168:3000/lfg2025/bitcoin"), None);
+        assert_eq!(image_tag("source.archipelago-foundation.org/lfg2025/bitcoin"), None);
         assert_eq!(
             image_tag("docker.io/library/redis:7"),
             Some("7".to_string())

core/archipelago/src/api/rpc/package/stacks.rs

@@ -774,7 +774,7 @@ fn indeedhub_stack_app_ids() -> &'static [&'static str] {
     ]
 }
 
-const REGISTRY: &str = "146.59.87.168:3000/lfg2025";
+const REGISTRY: &str = "source.archipelago-foundation.org/lfg2025";
 
 /// Pull an image with retry and exponential backoff (3 attempts).
 async fn pull_image_with_retry(image: &str) -> Result<()> {
@@ -871,9 +871,9 @@ impl RpcHandler {
         }
 
         let images = [
-            "146.59.87.168:3000/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0",
-            "146.59.87.168:3000/lfg2025/valkey:7-alpine",
-            "146.59.87.168:3000/lfg2025/immich-server:release",
+            "source.archipelago-foundation.org/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0",
+            "source.archipelago-foundation.org/lfg2025/valkey:7-alpine",
+            "source.archipelago-foundation.org/lfg2025/immich-server:release",
         ];
         self.set_install_phase("immich", InstallPhase::PullingImage)
             .await;
@@ -947,7 +947,7 @@ impl RpcHandler {
             "POSTGRES_USER=postgres",
             "-e",
             "POSTGRES_DB=immich",
-            "146.59.87.168:3000/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0",
+            "source.archipelago-foundation.org/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0",
         ]);
         run_required_stack_command("immich", "create postgres", &mut postgres_cmd).await?;
         tokio::time::sleep(std::time::Duration::from_secs(5)).await;
@@ -973,7 +973,7 @@ impl RpcHandler {
             "--health-cmd=valkey-cli ping || exit 1",
             "--health-interval=30s",
             "--health-retries=3",
-            "146.59.87.168:3000/lfg2025/valkey:7-alpine",
+            "source.archipelago-foundation.org/lfg2025/valkey:7-alpine",
         ]);
         run_required_stack_command("immich", "create redis", &mut redis_cmd).await?;
         tokio::time::sleep(std::time::Duration::from_secs(2)).await;
@@ -1016,7 +1016,7 @@ impl RpcHandler {
                 "REDIS_HOSTNAME=immich_redis".to_string(),
                 "-e".to_string(),
                 "UPLOAD_LOCATION=/usr/src/app/upload".to_string(),
-                "146.59.87.168:3000/lfg2025/immich-server:release".to_string(),
+                "source.archipelago-foundation.org/lfg2025/immich-server:release".to_string(),
             ],
         )
         .await?;
@@ -1517,7 +1517,7 @@ impl RpcHandler {
             .into_iter()
             .find(|r| r.enabled)
             .map(|r| r.url)
-            .unwrap_or_else(|| "146.59.87.168:3000/lfg2025".to_string());
+            .unwrap_or_else(|| "source.archipelago-foundation.org/lfg2025".to_string());
 
         let user_tmp = format!(
             "{}/.local/share/containers/tmp",

core/archipelago/src/container/app_catalog.rs

@@ -546,7 +546,7 @@ mod tests {
             "apps": {
                 "indeedhub": {
                     "version": "1.0.1",
-                    "image": "146.59.87.168:3000/lfg2025/indeedhub:1.0.1",
+                    "image": "source.archipelago-foundation.org/lfg2025/indeedhub:1.0.1",
                     "digest": "blake3:deadbeef",
                     "size": 12345,
                     "another_future_field": true
@@ -560,7 +560,7 @@ mod tests {
         assert_eq!(e.version, "1.0.1");
         assert_eq!(
             e.image.as_deref(),
-            Some("146.59.87.168:3000/lfg2025/indeedhub:1.0.1")
+            Some("source.archipelago-foundation.org/lfg2025/indeedhub:1.0.1")
         );
         assert_eq!(e.digest.as_deref(), Some("blake3:deadbeef"));
     }
@@ -628,7 +628,7 @@ mod tests {
     #[test]
     fn catalog_url_derived_from_mirror() {
         let mirrors = vec![crate::update::UpdateMirror {
-            url: "http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json"
+            url: "https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/releases/manifest.json"
                 .to_string(),
             label: "Server 1".to_string(),
         }];
@@ -636,7 +636,7 @@ mod tests {
         assert_eq!(
             urls,
             vec![
-                "http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/app-catalog.json"
+                "https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/releases/app-catalog.json"
                     .to_string()
             ]
         );

core/archipelago/src/container/companion.rs

@@ -33,7 +33,7 @@ use tracing::{info, warn};
 use crate::container::quadlet::{self, BindMount, NetworkMode, QuadletUnit};
 use archipelago_container::image_uses_insecure_registry;
 
-const COMPANION_REGISTRY: &str = "146.59.87.168:3000/lfg2025";
+const COMPANION_REGISTRY: &str = "source.archipelago-foundation.org/lfg2025";
 const COMPANION_IMAGE_CHECK_TIMEOUT: Duration = Duration::from_secs(15);
 const COMPANION_BUILD_TIMEOUT: Duration = Duration::from_secs(900);
 const COMPANION_PULL_TIMEOUT: Duration = Duration::from_secs(300);
@@ -54,7 +54,7 @@ pub struct CompanionSpec {
     /// Container + unit name (e.g. "archy-bitcoin-ui").
     pub name: &'static str,
     /// Image base name in the lfg2025 registry namespace
-    /// (e.g. "bitcoin-ui" → "146.59.87.168:3000/lfg2025/bitcoin-ui:latest").
+    /// (e.g. "bitcoin-ui" → "source.archipelago-foundation.org/lfg2025/bitcoin-ui:latest").
     pub image_base: &'static str,
     /// Filesystem locations to look for a local Dockerfile (build wins
     /// over registry pull). Searched in order; first hit wins.

core/archipelago/src/container/image_policy.rs

@@ -8,13 +8,13 @@
 /// (git.tx1138.com was removed 2026-07-10: the host is retired and must
 /// never be pulled through again.)
 pub const TRUSTED_REGISTRIES: &[&str] =
-    &["docker.io", "ghcr.io", "localhost", "146.59.87.168:3000"];
+    &["docker.io", "ghcr.io", "localhost", "source.archipelago-foundation.org"];
 
 /// Validate a container image reference.
 ///
 /// Accepts:
 ///   * refs whose explicit registry host is on [`TRUSTED_REGISTRIES`]
-///     (`docker.io/grafana/grafana`, `146.59.87.168:3000/archy/x:1`), and
+///     (`docker.io/grafana/grafana`, `source.archipelago-foundation.org/archy/x:1`), and
 ///   * registry-less Docker Hub shorthand (`nginx`, `grafana/grafana`) —
 ///     the first segment has no `.`/`:` so it cannot name an attacker host;
 ///     resolution follows the host's registries.conf search order.
@@ -55,7 +55,7 @@ mod tests {
             "docker.io/library/nginx:1.25",
             "ghcr.io/owner/app:latest",
             "localhost/archy-dev:1",
-            "146.59.87.168:3000/archy/bitcoin-knots:28.1",
+            "source.archipelago-foundation.org/archy/bitcoin-knots:28.1",
         ] {
             assert!(is_valid_docker_image(img), "{img} should be accepted");
         }

core/archipelago/src/container/image_versions.rs

@@ -234,7 +234,7 @@ pub fn available_update_for_images(pinned: &str, running_image: &str) -> Option<
 }
 
 /// Extract version tag from a full image reference.
-/// e.g. "146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta" → "v0.18.4-beta"
+/// e.g. "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta" → "v0.18.4-beta"
 /// Returns "latest" if no tag or tag is empty.
 pub fn extract_version_from_image(image: &str) -> String {
     // Split off the tag after the last colon, but only if it comes after the last slash
@@ -328,11 +328,11 @@ mod tests {
     #[test]
     fn test_extract_version() {
         assert_eq!(
-            extract_version_from_image("146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta"),
+            extract_version_from_image("source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta"),
             "v0.18.4-beta"
         );
         assert_eq!(
-            extract_version_from_image("146.59.87.168:3000/lfg2025/grafana:10.2.0"),
+            extract_version_from_image("source.archipelago-foundation.org/lfg2025/grafana:10.2.0"),
             "10.2.0"
         );
         assert_eq!(
@@ -340,7 +340,7 @@ mod tests {
             "latest"
         );
         assert_eq!(
-            extract_version_from_image("146.59.87.168:3000/lfg2025/bitcoin-knots:latest"),
+            extract_version_from_image("source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest"),
             "latest"
         );
     }
@@ -348,11 +348,11 @@ mod tests {
     #[test]
     fn strips_registry_and_tag_for_image_identity() {
         assert_eq!(
-            image_without_registry_or_tag("146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta"),
+            image_without_registry_or_tag("source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta"),
             "lfg2025/lnd"
         );
         assert_eq!(
-            image_without_registry_or_tag("146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta"),
+            image_without_registry_or_tag("source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta"),
             "lfg2025/lnd"
         );
     }
@@ -368,8 +368,8 @@ mod tests {
     fn available_update_ignores_registry_only_changes() {
         assert_eq!(
             available_update_for_images(
-                "146.59.87.168:3000/lfg2025/nextcloud:29",
-                "146.59.87.168:3000/lfg2025/nextcloud:29",
+                "source.archipelago-foundation.org/lfg2025/nextcloud:29",
+                "source.archipelago-foundation.org/lfg2025/nextcloud:29",
             ),
             None
         );
@@ -379,8 +379,8 @@ mod tests {
     fn available_update_returns_pinned_version_for_same_repo_newer_tag() {
         assert_eq!(
             available_update_for_images(
-                "146.59.87.168:3000/lfg2025/nextcloud:29",
-                "146.59.87.168:3000/lfg2025/nextcloud:28",
+                "source.archipelago-foundation.org/lfg2025/nextcloud:29",
+                "source.archipelago-foundation.org/lfg2025/nextcloud:28",
             ),
             Some("29".to_string())
         );
@@ -389,7 +389,7 @@ mod tests {
     #[test]
     fn test_parse_image_versions() {
         let content = r#"
-ARCHY_REGISTRY="146.59.87.168:3000/lfg2025"
+ARCHY_REGISTRY="source.archipelago-foundation.org/lfg2025"
 LND_IMAGE="$ARCHY_REGISTRY/lnd:v0.18.4-beta"
 GRAFANA_IMAGE="$ARCHY_REGISTRY/grafana:10.2.0"
 # comment
@@ -398,11 +398,11 @@ NOT_AN_IMAGE="something"
         let parsed = parse_image_versions(content);
         assert_eq!(
             parsed.get("LND_IMAGE"),
-            Some(&"146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta".to_string())
+            Some(&"source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta".to_string())
         );
         assert_eq!(
             parsed.get("GRAFANA_IMAGE"),
-            Some(&"146.59.87.168:3000/lfg2025/grafana:10.2.0".to_string())
+            Some(&"source.archipelago-foundation.org/lfg2025/grafana:10.2.0".to_string())
         );
         assert!(!parsed.contains_key("NOT_AN_IMAGE"));
         assert!(!parsed.contains_key("ARCHY_REGISTRY"));

core/archipelago/src/container/prod_orchestrator.rs

@@ -5224,7 +5224,7 @@ app:
   name: File Browser
   version: 1.0.0
   container:
-    image: 146.59.87.168:3000/lfg2025/filebrowser:v2.27.0
+    image: source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0
     custom_args:
       - --config
       - /data/.filebrowser.json
@@ -5248,7 +5248,7 @@ app:
   name: LND
   version: 1.0.0
   container:
-    image: 146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta
+    image: source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta
     secret_env:
       - key: BITCOIND_RPCPASS
         secret_file: bitcoin-rpc-password

core/archipelago/src/container/quadlet.rs

@@ -956,7 +956,7 @@ mod tests {
         QuadletUnit {
             name: "archy-bitcoin-ui".into(),
             description: "Bitcoin RPC UI proxy".into(),
-            image: "146.59.87.168:3000/lfg2025/bitcoin-ui:1.7.84-alpha".into(),
+            image: "source.archipelago-foundation.org/lfg2025/bitcoin-ui:1.7.84-alpha".into(),
             network: NetworkMode::Host,
             user: Some("0:0".into()),
             memory_mb: Some(128),
@@ -984,7 +984,7 @@ mod tests {
         let s = sample_unit().render();
         assert!(s.contains("[Container]"));
         assert!(s.contains("ContainerName=archy-bitcoin-ui"));
-        assert!(s.contains("Image=146.59.87.168:3000/lfg2025/bitcoin-ui:1.7.84-alpha"));
+        assert!(s.contains("Image=source.archipelago-foundation.org/lfg2025/bitcoin-ui:1.7.84-alpha"));
         assert!(s.contains("Pull=never"));
         assert!(s.contains("Network=host"));
         assert!(s.contains("DropCapability=ALL"));

core/archipelago/src/container/registry.rs

@@ -10,7 +10,7 @@ use std::path::Path;
 use tokio::fs;
 
 const REGISTRY_FILE: &str = "config/registries.json";
-const OVH_REGISTRY_URL: &str = "146.59.87.168:3000/lfg2025";
+const OVH_REGISTRY_URL: &str = "source.archipelago-foundation.org/lfg2025";
 /// Retired registry host (release server retired 2026-06-13; the registry
 /// frontend was fully dead by 2026-07-10 — 500 on every /v2 manifest read).
 /// Never a default, never force-enabled; stripped from saved configs on
@@ -21,7 +21,7 @@ const RETIRED_TX1138_HOST: &str = "git.tx1138.com";
 /// A single container registry.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Registry {
-    /// Registry URL (e.g., "146.59.87.168:3000/lfg2025").
+    /// Registry URL (e.g., "source.archipelago-foundation.org/lfg2025").
     pub url: String,
     /// Human-readable name.
     pub name: String,
@@ -68,8 +68,8 @@ impl RegistryConfig {
     }
 
     /// Rewrite an image reference to use a specific registry.
-    /// E.g., "docker.io/lfg2025/bitcoin-knots:latest" with registry "146.59.87.168:3000/lfg2025"
-    /// becomes "146.59.87.168:3000/lfg2025/bitcoin-knots:latest".
+    /// E.g., "docker.io/lfg2025/bitcoin-knots:latest" with registry "source.archipelago-foundation.org/lfg2025"
+    /// becomes "source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest".
     pub fn rewrite_image(&self, image: &str, registry: &Registry) -> String {
         // Extract the image name (last component after the org/namespace)
         // Handles: "registry/org/image:tag" -> "image:tag"
@@ -79,7 +79,7 @@ impl RegistryConfig {
 }
 
 /// Extract the image name from a full image reference.
-/// "146.59.87.168:3000/lfg2025/bitcoin-knots:latest" -> "bitcoin-knots:latest"
+/// "source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest" -> "bitcoin-knots:latest"
 /// "docker.io/gitea/gitea:1.23" -> "gitea:1.23"
 fn extract_image_name(image: &str) -> &str {
     // Split by '/' and take the last segment (image:tag)
@@ -212,7 +212,7 @@ mod tests {
     #[test]
     fn test_extract_image_name() {
         assert_eq!(
-            extract_image_name("146.59.87.168:3000/lfg2025/bitcoin-knots:latest"),
+            extract_image_name("source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest"),
             "bitcoin-knots:latest"
         );
         assert_eq!(
@@ -230,7 +230,7 @@ mod tests {
         let primary = &config.registries[0];
         assert_eq!(
             config.rewrite_image("docker.io/lfg2025/bitcoin-knots:latest", primary),
-            "146.59.87.168:3000/lfg2025/bitcoin-knots:latest"
+            "source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest"
         );
     }
 

core/archipelago/src/update.rs

@@ -88,7 +88,7 @@ const DEFAULT_UPDATE_MANIFEST_URL: &str =
 /// whose DNS or TLS is broken still updates. Dropped from the mirror list
 /// once the fleet has moved.
 const LEGACY_UPDATE_MANIFEST_URL: &str =
-    "http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json";
+    "https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/releases/manifest.json";
 const UPDATE_STATE_FILE: &str = "update_state.json";
 const UPDATE_MIRRORS_FILE: &str = "update-mirrors.json";
 /// Marker written by apply_update() just before the service restart and

core/container/src/podman_client.rs

@@ -742,7 +742,7 @@ impl PodmanClient {
 /// Registries we ship with as `--tls-verify=false` because they're internal
 /// HTTP mirrors. Add a host:port here only if it's a controlled mirror that
 /// the fleet trusts and operators won't ever paste a malicious URL into.
-const INSECURE_REGISTRY_HOSTS: &[&str] = &["146.59.87.168:3000"];
+const INSECURE_REGISTRY_HOSTS: &[&str] = &["source.archipelago-foundation.org"];
 
 pub fn image_uses_insecure_registry(image: &str) -> bool {
     image
@@ -1087,7 +1087,7 @@ mod tests {
     #[test]
     fn insecure_registry_detection_matches_http_mirrors_only() {
         assert!(image_uses_insecure_registry(
-            "146.59.87.168:3000/lfg2025/bitcoin-knots:latest"
+            "source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest"
         ));
         // The legacy Hetzner mirror at 23.182.128.160 was decommissioned and
         // is no longer trusted — it must NOT bypass TLS even if a stale
@@ -1106,7 +1106,7 @@ mod tests {
         // string into its own URL still has the attacker host in the
         // registry-host slot, so it does NOT match.
         assert!(!image_uses_insecure_registry(
-            "evil.example:80/146.59.87.168:3000/lfg2025/x:latest"
+            "evil.example:80/source.archipelago-foundation.org/lfg2025/x:latest"
         ));
     }
 

demo-deploy/.env.example

@@ -1,7 +1,7 @@
 # Copy to .env and adjust. Used by demo-deploy/docker-compose.yml.
 
 # Registry host + namespace that holds the prebuilt demo images.
-REGISTRY=146.59.87.168:3000/lfg2025
+REGISTRY=source.archipelago-foundation.org/lfg2025
 
 # Image tag to deploy (CI publishes :demo and :<git-sha>).
 IMAGE_TAG=demo

demo-deploy/docker-compose.yml

@@ -18,7 +18,7 @@
 
 services:
   neode-backend:
-    image: ${REGISTRY:-146.59.87.168:3000/lfg2025}/archy-demo-backend:${IMAGE_TAG:-demo}
+    image: ${REGISTRY:-source.archipelago-foundation.org/lfg2025}/archy-demo-backend:${IMAGE_TAG:-demo}
     container_name: archy-demo-backend
     environment:
       DEMO: "1"
@@ -40,7 +40,7 @@ services:
       retries: 3
 
   neode-web:
-    image: ${REGISTRY:-146.59.87.168:3000/lfg2025}/archy-demo-web:${IMAGE_TAG:-demo}
+    image: ${REGISTRY:-source.archipelago-foundation.org/lfg2025}/archy-demo-web:${IMAGE_TAG:-demo}
     container_name: archy-demo-web
     ports:
       - "${DEMO_WEB_PORT:-2100}:80"

docker/mempool-frontend/Dockerfile

@@ -5,7 +5,7 @@
 # the frontend re-resolves the backend (mempool-api) via DNS on every request.
 # Without this, nginx pins the backend IP at startup and serves 502 / "offline"
 # after any backend restart (podman reassigns the IP). See the script header.
-ARG BASE=146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.0
+ARG BASE=source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.0
 FROM ${BASE}
 
 # --chmod keeps the exec bit (build runs as USER 1000, plain COPY lands root:0644

docs/1.8.0-RELEASE-HARDENING-PLAN.md

@@ -71,7 +71,7 @@ arbitrary app catalog to the entire fleet — fully unattended under
       install cosign + publish real `image_signature` values (in that order); tracked with
       the Workstream B signing ceremony item.
 - [ ] 🟠 **Move the image mirror to HTTPS; drop `--tls-verify=false`.**
-      `podman_client.rs:641` `INSECURE_REGISTRY_HOSTS = ["146.59.87.168:3000"]` +
+      `podman_client.rs:641` `INSECURE_REGISTRY_HOSTS = ["source.archipelago-foundation.org"]` +
       `config.rs:104,124` allowlist pull images over unauthenticated HTTP. Remove the raw-IP
       entries; give the mirror a valid/pinned cert. (Same host also baked insecurely into
       the ISO — see §F.)
@@ -310,7 +310,7 @@ media (latest artifact only one minor behind).
       `archipelago ceremony verify` against the pinned anchor; build host never holds the
       key). **Still open:** Secure Boot — `BOOTX64.EFI` is unsigned though
       `grub-efi-amd64-signed` is installed.
-- [ ] 🟠 **Registries over HTTPS in the image too** — `146.59.87.168:3000`
+- [ ] 🟠 **Registries over HTTPS in the image too** — `source.archipelago-foundation.org`
       are baked `insecure=true`/`tls_verify:false` (`:216`, `:2308`). (Ties to §A.)
 - [ ] 🟡 **Add `unattended-upgrades` + a default-deny nftables firewall** (allow 22/80/443 +
       mesh/WG). Neither exists today; OS packages drift until reflash and there is no host

docs/archive/demo-deployment-design.md

@@ -46,7 +46,7 @@ layer**.
   CI: build archy-demo-web + archy-demo-backend
             │  push :demo / :latest
             ▼
-  registry (146.59.87.168:3000 / vps2)
+  registry (source.archipelago-foundation.org / vps2)
             │  Portainer webhook / re-pull
             ▼
   archy-demo (public repo — tiny)
@@ -162,7 +162,7 @@ Today filebrowser upload/delete/rename are 200-OK no-ops.
 
 1. **Demo host** — which Portainer instance (OVH `.168`? a dedicated VPS)? Public
    DNS + TLS for `demo.<domain>`?
-2. **Registry for `:demo` images** — `146.59.87.168:3000` vs vps2; public-pull or
+2. **Registry for `:demo` images** — `source.archipelago-foundation.org` vs vps2; public-pull or
    creds baked into Portainer?
 3. **Session TTL + concurrency cap** — concrete numbers (30 min / N sessions / 50 MB)?
 4. **Chat in the demo** — enable Claude chat (needs key + budget cap) or stub it?

docs/bitcoin-multi-version-design.md

@@ -111,7 +111,7 @@ green first), `MEMORY → project_decoupled_app_updates`,
 |-------|-------|
 | `apps/bitcoin-core/Dockerfile` | `FROM bitcoin/bitcoin:24.0` — a **community** image, **stale** (manifest says 28.4), no project-official Docker image exists |
 | `apps/bitcoin-knots/` | **no Dockerfile** — `:latest` is built/pushed by hand |
-| Registry | `scripts/image-versions.sh` → `ARCHY_REGISTRY="146.59.87.168:3000/lfg2025"`; only `BITCOIN_KNOTS_IMAGE=…/bitcoin-knots:latest` pinned, no Core pin |
+| Registry | `scripts/image-versions.sh` → `ARCHY_REGISTRY="source.archipelago-foundation.org/lfg2025"`; only `BITCOIN_KNOTS_IMAGE=…/bitcoin-knots:latest` pinned, no Core pin |
 | Tags in registry | **one tag per image**. No historical versions. |
 
 ### Version pinning

docs/bitcoin-version-bulletproof-rollout.md

@@ -45,7 +45,7 @@ Three **stacked** bugs, plus a data-corruption hazard:
   removed `USER bitcoin` → run as **container-root** like legacy (still 100% rootless:
   container-root maps to the unprivileged host service user; `CAP_DAC_OVERRIDE` from the
   manifest lets bitcoind read the `data_uid`-owned datadir). **All** images rebuilt root +
-  pushed to the mirror (`146.59.87.168:3000/lfg2025`):
+  pushed to the mirror (`source.archipelago-foundation.org/lfg2025`):
   - Knots: `29.3.knots20260508`, `29.3.knots20260507`, `29.3.knots20260210`, `29.2.knots20251110`
   - Core: `25.2 26.2 27.2 28.4 29.2 29.3 30.2 31.0` + `latest` (→31.0)
 - **Catalog** (`scripts/generate-app-catalog.sh` VERSIONS map + regenerated

docs/container-architecture.html

@@ -842,7 +842,7 @@
         </ul>
         <h4>Registry</h4>
         <ul>
-          <li>Private registry at <code>146.59.87.168:3000/lfg2025/</code></li>
+          <li>Private registry at <code>source.archipelago-foundation.org/lfg2025/</code></li>
           <li>HTTPS (self-hosted Gitea)</li>
           <li>All images pre-pulled into registry; nodes pull on first boot</li>
         </ul>

docs/demo-build-info.md

@@ -3,7 +3,7 @@
 **Status:** implemented & deployable (2026-07-14)
 **Branch:** `main` — the demo machinery was merged from the old `demo-build`
 branch and now lives on main, pushed to
-`gitea-vps2` = `http://146.59.87.168:3000/lfg2025/archy.git`.
+`gitea-vps2` = `https://source.archipelago-foundation.org/lfg2025/archy.git`.
 
 A public, click-to-play demo of the Archipelago UI, 100% mock-data driven,
 multi-visitor, deployed via Portainer. See also `docs/archive/demo-deployment-design.md`
@@ -17,7 +17,7 @@ Build-from-repo (works today, no registry needed):
 
 | Field | Value |
 |-------|-------|
-| Repository URL | `http://146.59.87.168:3000/lfg2025/archy.git` |
+| Repository URL | `https://source.archipelago-foundation.org/lfg2025/archy.git` |
 | Reference | `refs/heads/main` |
 | Compose path | `docker-compose.demo.yml` |
 | Auth | user `lfg2025`, password = Gitea token |

docs/dht-distribution-design.md

@@ -28,7 +28,7 @@ origin":
 
 ### OTA (`core/archipelago/src/update.rs`)
 - Manifest at `DEFAULT_UPDATE_MANIFEST_URL` (`update.rs:67`) = vps2 OVH
-  (`146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json`).
+  (`source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/releases/manifest.json`).
 - `check_for_updates()` (`:565`) walks an operator mirror list (`default_mirrors()` `:105`,
   `load_mirrors()` `:123`), origin-rewrites component URLs to the chosen mirror
   (`rewrite_manifest_origins()` `:227`).
@@ -65,9 +65,9 @@ origin":
 
 ### IndeeHub (the streaming target)
 - Original platform (not a fork). Working source: `~/Projects/Indeedhub Prototype/`
-  (Vue 3 + NestJS). Submodule `146.59.87.168:3000/lfg2025/indeehub.git` (repointed off the retired host —
+  (Vue 3 + NestJS). Submodule `source.archipelago-foundation.org/lfg2025/indeehub.git` (repointed off the retired host —
   needs a live remote). In `archy`: image-only, `apps/indeedhub/manifest.yml` pulls
-  `146.59.87.168:3000/lfg2025/indeedhub:1.0.0` (+ `-api`, `-ffmpeg`, postgres, redis,
+  `source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0` (+ `-api`, `-ffmpeg`, postgres, redis,
   minio, nostr-rs-relay).
 - Streaming today: FFmpeg → **HLS (.m3u8 + AES-128 .ts segments)** in **MinIO**
   (`indeedhub-private`/`-public`), metadata in Postgres, transcode queue in Redis,

docs/dual-ecash-design.md

@@ -94,7 +94,7 @@ in sync with the manifest env. clientd is a **client, not the guardian** — it
   under `image-recipe/_archived/` (likely stale); `first-boot-containers.sh`/`image-versions.sh`
   are current.
 - Image: build from source (no official image; `flake.nix` only) → push to vps2
-  `146.59.87.168:3000/lfg2025/fedimint-clientd:v0.4.0`.
+  `source.archipelago-foundation.org/lfg2025/fedimint-clientd:v0.4.0`.
 
 ### 5. Unified balance
 `HomeWalletCard` ecash row = Cashu `wallet.ecash-balance` + Fedimint `wallet.fedimint-balance`.

image-recipe/_archived/.gitea-workflows/build-iso-dev.yml

@@ -112,7 +112,7 @@ jobs:
         run: |
           sudo mkdir -p /etc/containers/registries.conf.d
           echo '[[registry]]
-          location = "146.59.87.168:3000"
+          location = "source.archipelago-foundation.org"
           insecure = true' | sudo tee /etc/containers/registries.conf.d/archipelago.conf
 
       - name: Build unbundled ISO

image-recipe/_archived/build-auto-installer-iso.sh

@@ -223,7 +223,7 @@ check_tools() {
         fi
         if mkdir -p "$REGCONF_DIR" 2>/dev/null && cat > "$REGCONF_DIR/archipelago.conf" 2>/dev/null <<'REGCONF'
 [[registry]]
-location = "146.59.87.168:3000"
+location = "source.archipelago-foundation.org"
 insecure = true
 REGCONF
         then
@@ -241,7 +241,7 @@ mkdir -p "$OUTPUT_DIR"
 
 container_pull() {
     local image="$1"
-    if [[ "$CONTAINER_CMD" == podman* && "$image" == 146.59.87.168:3000/* ]]; then
+    if [[ "$CONTAINER_CMD" == podman* && "$image" == source.archipelago-foundation.org/* ]]; then
         $CONTAINER_CMD pull --tls-verify=false --platform "$CONTAINER_PLATFORM" "$image"
     else
         $CONTAINER_CMD pull --platform "$CONTAINER_PLATFORM" "$image"
@@ -1317,11 +1317,11 @@ fi
 
 # Extract nostr-rs-relay binary from container image (native system service for VPN signaling)
 echo "   Extracting nostr-rs-relay binary..."
-RELAY_IMAGE="$($CONTAINER_CMD images -q 146.59.87.168:3000/lfg2025/nostr-rs-relay:0.9.0 2>/dev/null)"
+RELAY_IMAGE="$($CONTAINER_CMD images -q source.archipelago-foundation.org/lfg2025/nostr-rs-relay:0.9.0 2>/dev/null)"
 if [ -z "$RELAY_IMAGE" ]; then
-    $CONTAINER_CMD pull 146.59.87.168:3000/lfg2025/nostr-rs-relay:0.9.0 2>/dev/null || true
+    $CONTAINER_CMD pull source.archipelago-foundation.org/lfg2025/nostr-rs-relay:0.9.0 2>/dev/null || true
 fi
-RELAY_CONTAINER=$($CONTAINER_CMD create 146.59.87.168:3000/lfg2025/nostr-rs-relay:0.9.0 2>/dev/null) || true
+RELAY_CONTAINER=$($CONTAINER_CMD create source.archipelago-foundation.org/lfg2025/nostr-rs-relay:0.9.0 2>/dev/null) || true
 if [ -n "$RELAY_CONTAINER" ]; then
     # The relay image builds to its WORKDIR /usr/src/app and execs
     # ./nostr-rs-relay from there (not /usr/local/bin — that path was from an
@@ -1346,7 +1346,7 @@ if [ -n "$MISSING_VPN_BINARIES" ]; then
         echo "   ⚠  Building WITHOUT:$MISSING_VPN_BINARIES (ALLOW_MISSING_VPN_BINARIES=1)"
     else
         echo "   ❌ Required binaries not extracted:$MISSING_VPN_BINARIES"
-        echo "      The registry (146.59.87.168:3000) must be reachable and hold the images,"
+        echo "      The registry (source.archipelago-foundation.org) must be reachable and hold the images,"
         echo "      or set ALLOW_MISSING_VPN_BINARIES=1 to ship without VPN signaling."
         exit 1
     fi
@@ -3002,11 +3002,11 @@ cat > /mnt/target/home/archipelago/.config/containers/registries.conf <<'REGCONF
 unqualified-search-registries = ["docker.io"]
 
 [[registry]]
-location = "146.59.87.168:3000"
+location = "source.archipelago-foundation.org"
 insecure = true
 
 [[registry]]
-location = "146.59.87.168:3000"
+location = "source.archipelago-foundation.org"
 insecure = true
 REGCONF
 chown -R 1000:1000 /mnt/target/home/archipelago/.config
@@ -3016,8 +3016,8 @@ mkdir -p /mnt/target/var/lib/archipelago/config
 cat > /mnt/target/var/lib/archipelago/config/registries.json <<'DYNREG'
 {
   "registries": [
-    {"url": "146.59.87.168:3000/lfg2025", "name": "Archipelago Primary", "tls_verify": false, "enabled": true, "priority": 0},
-    {"url": "146.59.87.168:3000/lfg2025", "name": "Archipelago Fallback", "tls_verify": true, "enabled": true, "priority": 10}
+    {"url": "source.archipelago-foundation.org/lfg2025", "name": "Archipelago Primary", "tls_verify": false, "enabled": true, "priority": 0},
+    {"url": "source.archipelago-foundation.org/lfg2025", "name": "Archipelago Fallback", "tls_verify": true, "enabled": true, "priority": 10}
   ]
 }
 DYNREG
@@ -3191,7 +3191,7 @@ if [ -d "$REPO_DIR/.git" ]; then
     exit 0  # Already cloned
 fi
 echo "[update] Cloning Archipelago repo for self-updates..."
-su - archipelago -c "git clone https://146.59.87.168:3000/lfg2025/archy $REPO_DIR" 2>/dev/null || {
+su - archipelago -c "git clone https://source.archipelago-foundation.org/lfg2025/archy $REPO_DIR" 2>/dev/null || {
     echo "[update] Git clone failed (network?). Updates will retry on next boot."
     exit 0
 }

image-recipe/scripts/install-podman.sh

@@ -40,10 +40,10 @@ EOF
 # Configure registries (use Docker Hub and quay.io)
 mkdir -p /home/archipelago/.config/containers/registries.conf.d
 cat > /home/archipelago/.config/containers/registries.conf <<EOF
-unqualified-search-registries = ["docker.io", "ghcr.io", "quay.io", "146.59.87.168:3000"]
+unqualified-search-registries = ["docker.io", "ghcr.io", "quay.io", "source.archipelago-foundation.org"]
 
 [[registry]]
-location = "146.59.87.168:3000"
+location = "source.archipelago-foundation.org"
 insecure = true
 EOF
 

neode-ui/public/catalog.json

@@ -1,7 +1,7 @@
 {
   "version": 2,
   "updated": "2026-04-22T00:00:00Z",
-  "registry": "146.59.87.168:3000/lfg2025",
+  "registry": "source.archipelago-foundation.org/lfg2025",
   "featured": {
     "id": "indeedhub",
     "banner": "/assets/img/featured/indeedhub-banner.jpg",
@@ -19,7 +19,7 @@
       "author": "Bitcoin Knots",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/bitcoin-knots:latest",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest",
       "repoUrl": "https://github.com/bitcoinknots/bitcoin"
     },
     {
@@ -31,7 +31,7 @@
       "author": "Bitcoin Core contributors",
       "category": "money",
       "tier": "optional",
-      "dockerImage": "146.59.87.168:3000/lfg2025/bitcoin:28.4",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/bitcoin:28.4",
       "repoUrl": "https://github.com/bitcoin/bitcoin"
     },
     {
@@ -43,7 +43,7 @@
       "author": "Lightning Labs",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta",
       "repoUrl": "https://github.com/lightningnetwork/lnd",
       "requires": [
         "bitcoin-knots"
@@ -73,7 +73,7 @@
       "author": "Mempool",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1",
       "repoUrl": "https://github.com/mempool/mempool",
       "requires": [
         "bitcoin-knots",
@@ -89,7 +89,7 @@
       "author": "Luke Childs",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/electrumx:v1.18.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0",
       "repoUrl": "https://github.com/spesmilo/electrumx",
       "requires": [
         "bitcoin-knots"
@@ -103,7 +103,7 @@
       "icon": "/assets/img/app-icons/indeedhub.png",
       "author": "IndeeHub",
       "category": "community",
-      "dockerImage": "146.59.87.168:3000/lfg2025/indeedhub:1.0.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0",
       "repoUrl": "https://github.com/indeedhub/indeedhub"
     },
     {
@@ -114,7 +114,7 @@
       "icon": "/assets/img/app-icons/botfights.svg",
       "author": "BotFights",
       "category": "community",
-      "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.2.11",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/botfights:1.2.11",
       "repoUrl": "https://botfights.net",
       "containerConfig": {
         "ports": [
@@ -172,7 +172,7 @@
       "author": "File Browser",
       "category": "data",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/filebrowser:v2.27.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0",
       "repoUrl": "https://github.com/filebrowser/filebrowser",
       "containerConfig": {
         "ports": [
@@ -223,7 +223,7 @@
       "author": "Vaultwarden",
       "category": "data",
       "tier": "recommended",
-      "dockerImage": "146.59.87.168:3000/lfg2025/vaultwarden:1.30.0-alpine",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.30.0-alpine",
       "repoUrl": "https://github.com/dani-garcia/vaultwarden",
       "containerConfig": {
         "ports": [
@@ -243,7 +243,7 @@
       "author": "SearXNG",
       "category": "data",
       "tier": "recommended",
-      "dockerImage": "146.59.87.168:3000/lfg2025/searxng:latest",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/searxng:latest",
       "repoUrl": "https://github.com/searxng/searxng",
       "containerConfig": {
         "ports": [
@@ -262,7 +262,7 @@
       "icon": "/assets/img/app-icons/fedimint.png",
       "author": "Fedimint",
       "category": "money",
-      "dockerImage": "146.59.87.168:3000/lfg2025/fedimintd:v0.10.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0",
       "repoUrl": "https://github.com/fedimint/fedimint"
     },
     {
@@ -274,7 +274,7 @@
       "author": "Fedimint",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/fmcd:0.8.1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/fmcd:0.8.1",
       "repoUrl": "https://github.com/minmoto/fmcd"
     },
     {
@@ -285,7 +285,7 @@
       "icon": "/assets/img/app-icons/fedimint.png",
       "author": "Fedimint",
       "category": "money",
-      "dockerImage": "146.59.87.168:3000/lfg2025/gatewayd:v0.10.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.0",
       "repoUrl": "https://github.com/fedimint/fedimint",
       "containerConfig": {
         "ports": [
@@ -306,7 +306,7 @@
       "icon": "/assets/img/app-icons/bark.png",
       "author": "Second",
       "category": "money",
-      "dockerImage": "146.59.87.168:3000/lfg2025/barkd:0.3.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/barkd:0.3.0",
       "repoUrl": "https://gitlab.com/ark-bitcoin/bark",
       "containerConfig": {
         "ports": [
@@ -325,7 +325,7 @@
       "icon": "/assets/img/app-icons/jellyfin.webp",
       "author": "Jellyfin",
       "category": "data",
-      "dockerImage": "146.59.87.168:3000/lfg2025/jellyfin:10.8.13",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/jellyfin:10.8.13",
       "repoUrl": "https://github.com/jellyfin/jellyfin",
       "containerConfig": {
         "ports": [
@@ -345,7 +345,7 @@
       "icon": "/assets/img/app-icons/immich.png",
       "author": "Immich",
       "category": "data",
-      "dockerImage": "146.59.87.168:3000/lfg2025/immich-server:release",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/immich-server:release",
       "repoUrl": "https://github.com/immich-app/immich"
     },
     {
@@ -356,7 +356,7 @@
       "icon": "/assets/img/app-icons/homeassistant.png",
       "author": "Home Assistant",
       "category": "home",
-      "dockerImage": "146.59.87.168:3000/lfg2025/home-assistant:2026.7.3",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.7.3",
       "repoUrl": "https://github.com/home-assistant/core",
       "containerConfig": {
         "ports": [
@@ -414,7 +414,7 @@
       "author": "Tailscale",
       "category": "networking",
       "tier": "recommended",
-      "dockerImage": "146.59.87.168:3000/lfg2025/tailscale:stable",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/tailscale:stable",
       "repoUrl": "https://github.com/tailscale/tailscale",
       "containerConfig": {
         "ports": [
@@ -442,7 +442,7 @@
       "author": "Portainer",
       "category": "development",
       "tier": "optional",
-      "dockerImage": "146.59.87.168:3000/lfg2025/portainer:2.39.1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.39.1",
       "repoUrl": "https://github.com/portainer/portainer",
       "containerConfig": {
         "ports": [
@@ -487,7 +487,7 @@
       "author": "Uptime Kuma",
       "category": "data",
       "tier": "recommended",
-      "dockerImage": "146.59.87.168:3000/lfg2025/uptime-kuma:1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/uptime-kuma:1",
       "repoUrl": "https://github.com/louislam/uptime-kuma",
       "containerConfig": {
         "ports": [
@@ -514,7 +514,7 @@
       "icon": "/assets/img/app-icons/photoprism.svg",
       "author": "PhotoPrism",
       "category": "data",
-      "dockerImage": "146.59.87.168:3000/lfg2025/photoprism:240915",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/photoprism:240915",
       "repoUrl": "https://github.com/photoprism/photoprism",
       "containerConfig": {
         "ports": [
@@ -537,7 +537,7 @@
       "icon": "/assets/img/app-icons/nextcloud.webp",
       "author": "Nextcloud",
       "category": "data",
-      "dockerImage": "146.59.87.168:3000/lfg2025/nextcloud:29",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/nextcloud:29",
       "repoUrl": "https://github.com/nextcloud/server",
       "containerConfig": {
         "ports": [

neode-ui/src/stores/container.ts

@@ -31,7 +31,7 @@ export const BUNDLED_APPS: BundledApp[] = [
   {
     id: 'bitcoin-knots',
     name: 'Bitcoin Knots',
-    image: '146.59.87.168:3000/lfg2025/bitcoin-knots:latest',
+    image: 'source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest',
     description: 'Full Bitcoin node with additional features',
     icon: '₿',
     ports: [{ host: 8334, container: 80 }],

neode-ui/src/views/MarketplaceAppDetails.vue

@@ -507,7 +507,7 @@ const features = computed(() => {
 })
 
 /** App dependency definitions */
-const R = '146.59.87.168:3000/lfg2025'
+const R = 'source.archipelago-foundation.org/lfg2025'
 const APP_DEPENDENCIES: Record<string, { id: string; title: string; dockerImage: string }[]> = {
   'electrumx': [{ id: 'bitcoin-knots', title: 'Bitcoin Knots', dockerImage: `${R}/bitcoin-knots:latest` }],
   'lnd': [{ id: 'bitcoin-knots', title: 'Bitcoin Knots', dockerImage: `${R}/bitcoin-knots:latest` }],

neode-ui/src/views/discover/curatedApps.ts

@@ -1,6 +1,6 @@
 import type { MarketplaceApp } from './types'
 
-const R = '146.59.87.168:3000/lfg2025'
+const R = 'source.archipelago-foundation.org/lfg2025'
 
 // ---------- Dynamic catalog from registry ----------
 export interface CatalogFeatured {

neode-ui/src/views/marketplace/marketplaceData.ts

@@ -46,7 +46,7 @@ export interface InstallProgress {
 }
 
 /** Archipelago app registry — all app images are mirrored here */
-const REGISTRY = '146.59.87.168:3000/lfg2025'
+const REGISTRY = 'source.archipelago-foundation.org/lfg2025'
 
 /** Marketplace app ID -> backend package keys (for "Already Installed" when first-boot/deploy created them) */
 export const INSTALLED_ALIASES: Record<string, string[]> = {
@@ -390,7 +390,7 @@ export function getCuratedAppList(): MarketplaceApp[] {
       description: 'Bitcoin documentary streaming platform with Nostr identity sign-in. Stream God Bless Bitcoin and other educational content about sovereignty and decentralized technology.',
       icon: '/assets/img/app-icons/indeedhub.png',
       author: 'Indeehub Team',
-      dockerImage: '146.59.87.168:3000/lfg2025/indeedhub:latest',
+      dockerImage: 'source.archipelago-foundation.org/lfg2025/indeedhub:latest',
       manifestUrl: undefined,
       repoUrl: 'https://github.com/indeedhub/indeedhub'
     },

scripts/app-catalog-image-smoke-test.py

@@ -31,7 +31,7 @@ from pathlib import Path
 import yaml
 
 
-INSECURE_REGISTRIES = ("146.59.87.168:3000", "23.182.128.160:3000")
+INSECURE_REGISTRIES = ("source.archipelago-foundation.org", "23.182.128.160:3000")
 
 
 def run(cmd: list[str], timeout: int = 120) -> subprocess.CompletedProcess[str]:

scripts/bootstrap-switchover.sh

@@ -78,7 +78,7 @@ if $DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -q '^electrumx$'; then
         -e "DAEMON_URL=http://${RPC_USER}:${RPC_PASS}@bitcoin-knots:8332/" \
         -e COIN=Bitcoin -e DB_DIRECTORY=/data \
         -e "SERVICES=tcp://:50001,rpc://0.0.0.0:8000" \
-        "${ELECTRUMX_IMAGE:-146.59.87.168:3000/lfg2025/electrumx:v1.18.0}"
+        "${ELECTRUMX_IMAGE:-source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0}"
 fi
 
 # Mempool API
@@ -98,7 +98,7 @@ if $DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -q '^mempool-api$'; th
         -e "DATABASE_ENABLED=true" -e "DATABASE_HOST=archy-mempool-db" \
         -e "DATABASE_DATABASE=mempool" -e "DATABASE_USERNAME=mempool" \
         -e "DATABASE_PASSWORD=$(cat "$SECRETS_DIR/mempool-db-password" 2>/dev/null || echo mempoolpass)" \
-        "${MEMPOOL_API_IMAGE:-146.59.87.168:3000/lfg2025/mempool-api:v3.2.0}"
+        "${MEMPOOL_API_IMAGE:-source.archipelago-foundation.org/lfg2025/mempool-api:v3.2.0}"
 fi
 
 # Stop Tor tunnel if it was active

scripts/create-release-manifest.sh

@@ -18,7 +18,7 @@ RELEASE_DATE=""
 OUTPUT_FILE="manifest.json"
 BACKEND_BINARY=""
 FRONTEND_ARCHIVE=""
-BASE_URL="http://146.59.87.168:3000/lfg2025/archy/releases/download"
+BASE_URL="https://source.archipelago-foundation.org/lfg2025/archy/releases/download"
 
 usage() {
     echo "Usage: $0 --version VERSION [--date DATE] [--output FILE]"

scripts/create-release.sh

@@ -293,4 +293,4 @@ echo "  2. Publish commits, tag, artifacts, and verify download URLs:"
 echo "       scripts/publish-release-assets.sh ${VERSION} gitea-vps2"
 echo "  3. Verify manifest is live on both mirrors:"
 echo "       curl -fsS http://localhost:3000/lfg2025/archy/raw/branch/main/releases/manifest.json"
-echo "       curl -fsS http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json"
+echo "       curl -fsS https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/releases/manifest.json"

scripts/deploy-bitcoin-knots.sh

@@ -74,7 +74,7 @@ mkdir -p "$BUILD_DIR"
 
 # Create Dockerfile
 cat > "$BUILD_DIR/Dockerfile" << 'EOF'
-FROM ${NGINX_ALPINE_IMAGE:-146.59.87.168:3000/lfg2025/nginx:1.29.6-alpine}
+FROM ${NGINX_ALPINE_IMAGE:-source.archipelago-foundation.org/lfg2025/nginx:1.29.6-alpine}
 
 # Copy the static UI
 COPY index.html /usr/share/nginx/html/

scripts/dev-container-test.sh

@@ -151,7 +151,7 @@ run_smoke_tests() {
 
     # Test 3: Install a lightweight container (filebrowser — small, fast, no deps)
     TESTS=$((TESTS + 1))
-    local install_img="146.59.87.168:3000/lfg2025/filebrowser:v2.27.0"
+    local install_img="source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0"
     # Check if already installed
     local fb_state
     fb_state=$(ssh $SSH_OPTS "$SSH_HOST" "podman inspect filebrowser --format '{{.State.Status}}' 2>/dev/null || echo 'none'")

scripts/first-boot-containers.sh

@@ -9,7 +9,7 @@
 #
 # Image versions: sourced from /opt/archipelago/image-versions.sh (single source of truth).
 # All container image references use the $*_IMAGE variables defined there.
-# Images pull from the Archipelago app registry (146.59.87.168:3000/lfg2025/).
+# Images pull from the Archipelago app registry (source.archipelago-foundation.org/lfg2025/).
 #
 # --- PLANNED REFACTOR (post-beta) ---
 # This script is ~995 lines and should be split into a modular library.

scripts/generate-app-catalog.sh

@@ -172,7 +172,7 @@ if os.environ.get("EMBED_MANIFESTS") and apps_dir:
 # image.sh (Phase 0) publishes more tagged images, e.g.:
 #   {"version": "30.0", "image": f"{REGISTRY}/bitcoin:30.0"},
 #   {"version": "27.2", "image": f"{REGISTRY}/bitcoin:27.2", "deprecated": True, "eol": "2026-12-31"},
-REGISTRY = os.environ.get("ARCHY_REGISTRY", "146.59.87.168:3000/lfg2025")
+REGISTRY = os.environ.get("ARCHY_REGISTRY", "source.archipelago-foundation.org/lfg2025")
 VERSIONS = {
     # Curated Core set (latest patch per major, current → 25). Images built +
     # verified (SHA-256 + OpenPGP, fail-closed) and pushed by

scripts/image-versions.sh

@@ -5,12 +5,12 @@
 # Usage: source /opt/archipelago/image-versions.sh 2>/dev/null || true
 #        source "$(dirname "$0")/image-versions.sh" 2>/dev/null || true
 #
-# Tags MUST match what's actually in the registry at 146.59.87.168:3000/lfg2025/
-# Run: podman images --format '{{.Repository}}:{{.Tag}}' | grep '146.59.87.168:3000' | sort
+# Tags MUST match what's actually in the registry at source.archipelago-foundation.org/lfg2025/
+# Run: podman images --format '{{.Repository}}:{{.Tag}}' | grep 'source.archipelago-foundation.org' | sort
 # to verify against the registry.
 
 # Archipelago app registries (primary + fallback)
-ARCHY_REGISTRY="146.59.87.168:3000/lfg2025"
+ARCHY_REGISTRY="source.archipelago-foundation.org/lfg2025"
 # No fallback registry: the old tx1138 registry host was retired (2026-06-13); empty disables the fallback path.
 ARCHY_REGISTRY_FALLBACK=""
 

scripts/self-update.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Self-update: pull latest code from the OVH Gitea (146.59.87.168:3000) and apply
+# Self-update: pull latest code from the OVH Gitea (source.archipelago-foundation.org) and apply
 # Designed to run on installed Archipelago nodes (as archipelago user)
 #
 # Usage:
@@ -8,7 +8,7 @@
 #   ./self-update.sh --force      # Apply even if already up to date
 #
 # The script:
-#   1. Pulls latest code from origin (146.59.87.168:3000)
+#   1. Pulls latest code from origin (source.archipelago-foundation.org)
 #   2. Builds the Rust backend (release mode)
 #   3. Builds the Vue frontend (production mode)
 #   4. Installs the new binary and web UI
@@ -69,7 +69,7 @@ done
 # Ensure repo exists
 if [ ! -d "$REPO_DIR/.git" ]; then
     err "Repo not found at $REPO_DIR"
-    err "Clone it first: git clone http://146.59.87.168:3000/lfg2025/archy ~/archy"
+    err "Clone it first: git clone https://source.archipelago-foundation.org/lfg2025/archy ~/archy"
     exit 1
 fi
 

scripts/validate-app-manifest.sh

@@ -137,7 +137,7 @@ fi
 
 if [[ -n "$IMAGE" ]]; then
     TRUSTED=false
-    for reg in "docker.io" "ghcr.io" "quay.io" "registry.hub.docker.com" "146.59.87.168:3000" "localhost/"; do
+    for reg in "docker.io" "ghcr.io" "quay.io" "registry.hub.docker.com" "source.archipelago-foundation.org" "localhost/"; do
         if [[ "$IMAGE" == *"$reg"* ]]; then
             TRUSTED=true
             break

tests/lifecycle/bats/immich.bats

@@ -15,7 +15,7 @@
 
 load '../lib/rpc.bash'
 
-IMMICH_IMAGE="146.59.87.168:3000/lfg2025/immich-server:release"
+IMMICH_IMAGE="source.archipelago-foundation.org/lfg2025/immich-server:release"
 
 setup_file() {
   : "${ARCHY_PASSWORD:?Set ARCHY_PASSWORD env var to the UI password}"

tests/lifecycle/remote-lifecycle.sh

@@ -133,29 +133,29 @@ is_pruned_node() {
 
 image_for() {
   case "$1" in
-    bitcoin-knots) echo "146.59.87.168:3000/lfg2025/bitcoin-knots:latest" ;;
+    bitcoin-knots) echo "source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest" ;;
     bitcoin-core) echo "docker.io/bitcoin/bitcoin:28.4" ;;
     btcpay-server) echo "docker.io/btcpayserver/btcpayserver:2.3.9" ;;
-    lnd) echo "146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta" ;;
-    mempool) echo "146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.0" ;;
-    homeassistant) echo "146.59.87.168:3000/lfg2025/home-assistant:2024.1" ;;
-    grafana) echo "146.59.87.168:3000/lfg2025/grafana:10.2.0" ;;
-    searxng) echo "146.59.87.168:3000/lfg2025/searxng:latest" ;;
-    ollama) echo "146.59.87.168:3000/lfg2025/ollama:latest" ;;
-    nextcloud) echo "146.59.87.168:3000/lfg2025/nextcloud:28" ;;
-    vaultwarden) echo "146.59.87.168:3000/lfg2025/vaultwarden:1.30.0-alpine" ;;
-    jellyfin) echo "146.59.87.168:3000/lfg2025/jellyfin:10.8.13" ;;
-    photoprism) echo "146.59.87.168:3000/lfg2025/photoprism:240915" ;;
-    immich) echo "146.59.87.168:3000/lfg2025/immich-server:release" ;;
-    filebrowser) echo "146.59.87.168:3000/lfg2025/filebrowser:v2.27.0" ;;
-    nginx-proxy-manager) echo "146.59.87.168:3000/lfg2025/nginx-proxy-manager:latest" ;;
-    portainer) echo "146.59.87.168:3000/lfg2025/portainer:latest" ;;
-    uptime-kuma) echo "146.59.87.168:3000/lfg2025/uptime-kuma:1" ;;
-    tailscale) echo "146.59.87.168:3000/lfg2025/tailscale:stable" ;;
-    electrumx) echo "146.59.87.168:3000/lfg2025/electrumx:v1.18.0" ;;
-    fedimint) echo "146.59.87.168:3000/lfg2025/fedimintd:v0.10.0" ;;
-    indeedhub) echo "146.59.87.168:3000/lfg2025/indeedhub:1.0.0" ;;
-    botfights) echo "146.59.87.168:3000/lfg2025/botfights:1.1.0" ;;
+    lnd) echo "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta" ;;
+    mempool) echo "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.0" ;;
+    homeassistant) echo "source.archipelago-foundation.org/lfg2025/home-assistant:2024.1" ;;
+    grafana) echo "source.archipelago-foundation.org/lfg2025/grafana:10.2.0" ;;
+    searxng) echo "source.archipelago-foundation.org/lfg2025/searxng:latest" ;;
+    ollama) echo "source.archipelago-foundation.org/lfg2025/ollama:latest" ;;
+    nextcloud) echo "source.archipelago-foundation.org/lfg2025/nextcloud:28" ;;
+    vaultwarden) echo "source.archipelago-foundation.org/lfg2025/vaultwarden:1.30.0-alpine" ;;
+    jellyfin) echo "source.archipelago-foundation.org/lfg2025/jellyfin:10.8.13" ;;
+    photoprism) echo "source.archipelago-foundation.org/lfg2025/photoprism:240915" ;;
+    immich) echo "source.archipelago-foundation.org/lfg2025/immich-server:release" ;;
+    filebrowser) echo "source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0" ;;
+    nginx-proxy-manager) echo "source.archipelago-foundation.org/lfg2025/nginx-proxy-manager:latest" ;;
+    portainer) echo "source.archipelago-foundation.org/lfg2025/portainer:latest" ;;
+    uptime-kuma) echo "source.archipelago-foundation.org/lfg2025/uptime-kuma:1" ;;
+    tailscale) echo "source.archipelago-foundation.org/lfg2025/tailscale:stable" ;;
+    electrumx) echo "source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0" ;;
+    fedimint) echo "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0" ;;
+    indeedhub) echo "source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0" ;;
+    botfights) echo "source.archipelago-foundation.org/lfg2025/botfights:1.1.0" ;;
     gitea) echo "docker.io/gitea/gitea:1.23" ;;
     *) return 1 ;;
   esac