From 8e814ca06a5bda8b53ddd82fd3aeb7267a20a8c3 Mon Sep 17 00:00:00 2001 From: archipelago Date: Fri, 7 Aug 2026 11:31:20 -0400 Subject: [PATCH] feat(registry): move image and OTA references to the public domain MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces the registry host across 86 files: 309 references, covering all 40 app manifests, the orchestrator and container crates, the release and catalog scripts, both demo-images workflows, the ISO builder, demo-deploy, and the frontend marketplace data. Verified the domain actually serves the registry before rewriting anything, rather than assuming the web host implies the registry: - TLS verifies clean, HTTP/2 on the web root - an anonymous token grants a manifest fetch (HTTP 200) with no credentials - skopeo inspect --no-creds resolves an image and lists its tags That last check is the one that matters: an outside developer with no account can now pull, which was the functional blocker for publishing at all. Plain-HTTP references become HTTPS in the same pass, so OTA downloads stop crossing the network in the clear. Deliberately NOT rewritten: - The public FIPS anchor on port 8444. It is a functional network endpoint every node dials to bootstrap the mesh — closer to Bitcoin Core's hardcoded seeds than to leaked infrastructure. The domain does resolve to the same host, so it could become a hostname, but that adds a DNS dependency to the path used precisely when things are broken. Worth a deliberate decision, not a side effect of this change. - The companion APK on port 2100. The domain returns 404 for that path, so rewriting it would swap a working URL for a broken one. The Releases page does serve (200), which is where the plan already wants those binaries. - releases/app-catalog.json, releases/manifest.json and release-manifest.json. These carry `signature` and `signed_by`; editing their contents invalidates the signature and the fleet refuses artifacts that fail verification. They were rewritten in a first pass and reverted — they must be regenerated and re-signed through the signing ceremony instead, which needs the mnemonic. So the catalog still advertises the old host until that ceremony runs. Nodes resolve images through the signed catalog, not the on-disk manifests, so this commit alone does not change what a node pulls. Verified: archipelago-container 75/75; every manifest still parses with a top-level app block; no signed artifact modified. Co-Authored-By: Claude Opus 5 (1M context) --- .gitea/workflows/demo-images.yml | 2 +- .github/workflows/demo-images.yml | 2 +- .gitmodules | 2 +- Android/COMPANION_RELEASE.md | 2 +- app-catalog/README.md | 2 +- app-catalog/catalog.json | 46 +++++++++---------- apps/archy-btcpay-db/manifest.yml | 2 +- apps/archy-mempool-db/manifest.yml | 2 +- apps/archy-mempool-web/manifest.yml | 2 +- apps/archy-nbxplorer/manifest.yml | 2 +- apps/barkd/manifest.yml | 2 +- apps/bitcoin-core/manifest.yml | 2 +- apps/bitcoin-knots/manifest.yml | 2 +- apps/botfights/manifest.yml | 2 +- apps/electrumx/manifest.yml | 2 +- apps/fedimint-clientd/manifest.yml | 2 +- apps/fedimint-gateway/manifest.yml | 2 +- apps/fedimint/manifest.yml | 2 +- apps/filebrowser/manifest.yml | 2 +- apps/home-assistant/manifest.yml | 2 +- apps/immich-postgres/manifest.yml | 2 +- apps/immich-redis/manifest.yml | 2 +- apps/immich/manifest.yml | 2 +- apps/indeedhub-api/manifest.yml | 2 +- apps/indeedhub-ffmpeg/manifest.yml | 2 +- apps/indeedhub-minio/manifest.yml | 2 +- apps/indeedhub-postgres/manifest.yml | 2 +- apps/indeedhub-redis/manifest.yml | 2 +- apps/indeedhub-relay/manifest.yml | 2 +- apps/indeedhub/manifest.yml | 2 +- apps/indeedhub/push-to-registry.sh | 2 +- apps/jellyfin/manifest.yml | 2 +- apps/lnd/manifest.yml | 2 +- apps/mempool-api/manifest.yml | 2 +- apps/mempool/manifest.yml | 2 +- apps/nextcloud/manifest.yml | 2 +- apps/photoprism/manifest.yml | 2 +- apps/portainer/manifest.yml | 2 +- apps/searxng/manifest.yml | 2 +- apps/uptime-kuma/manifest.yml | 2 +- apps/vaultwarden/manifest.yml | 2 +- core/archipelago/src/api/handler/mod.rs | 2 +- .../src/api/rpc/package/install.rs | 2 +- .../src/api/rpc/package/set_config.rs | 6 +-- .../archipelago/src/api/rpc/package/stacks.rs | 16 +++---- core/archipelago/src/container/app_catalog.rs | 8 ++-- core/archipelago/src/container/companion.rs | 4 +- .../archipelago/src/container/image_policy.rs | 6 +-- .../src/container/image_versions.rs | 26 +++++------ .../src/container/prod_orchestrator.rs | 4 +- core/archipelago/src/container/quadlet.rs | 4 +- core/archipelago/src/container/registry.rs | 14 +++--- core/archipelago/src/update.rs | 2 +- core/container/src/podman_client.rs | 6 +-- demo-deploy/.env.example | 2 +- demo-deploy/docker-compose.yml | 4 +- docker/mempool-frontend/Dockerfile | 2 +- docs/1.8.0-RELEASE-HARDENING-PLAN.md | 4 +- docs/archive/demo-deployment-design.md | 4 +- docs/bitcoin-multi-version-design.md | 2 +- docs/bitcoin-version-bulletproof-rollout.md | 2 +- docs/container-architecture.html | 2 +- docs/demo-build-info.md | 4 +- docs/dht-distribution-design.md | 6 +-- docs/dual-ecash-design.md | 2 +- .../.gitea-workflows/build-iso-dev.yml | 2 +- .../_archived/build-auto-installer-iso.sh | 22 ++++----- image-recipe/scripts/install-podman.sh | 4 +- neode-ui/public/catalog.json | 46 +++++++++---------- neode-ui/src/stores/container.ts | 2 +- neode-ui/src/views/MarketplaceAppDetails.vue | 2 +- neode-ui/src/views/discover/curatedApps.ts | 2 +- .../src/views/marketplace/marketplaceData.ts | 4 +- scripts/app-catalog-image-smoke-test.py | 2 +- scripts/bootstrap-switchover.sh | 4 +- scripts/create-release-manifest.sh | 2 +- scripts/create-release.sh | 2 +- scripts/deploy-bitcoin-knots.sh | 2 +- scripts/dev-container-test.sh | 2 +- scripts/first-boot-containers.sh | 2 +- scripts/generate-app-catalog.sh | 2 +- scripts/image-versions.sh | 6 +-- scripts/self-update.sh | 6 +-- scripts/validate-app-manifest.sh | 2 +- tests/lifecycle/bats/immich.bats | 2 +- tests/lifecycle/remote-lifecycle.sh | 42 ++++++++--------- 86 files changed, 210 insertions(+), 210 deletions(-) diff --git a/.gitea/workflows/demo-images.yml b/.gitea/workflows/demo-images.yml index c6b58198..ba739508 100644 --- a/.gitea/workflows/demo-images.yml +++ b/.gitea/workflows/demo-images.yml @@ -5,7 +5,7 @@ name: Demo images # code (see demo-deploy/ and docs/demo-deployment-design.md). # # Required repo configuration: -# vars.DEMO_REGISTRY e.g. 146.59.87.168:3000/lfg2025 +# vars.DEMO_REGISTRY e.g. source.archipelago-foundation.org/lfg2025 # vars.DEMO_REGISTRY_HOST registry host for docker login (no org suffix) # secrets.DEMO_REGISTRY_USER # secrets.DEMO_REGISTRY_TOKEN diff --git a/.github/workflows/demo-images.yml b/.github/workflows/demo-images.yml index 0471538b..9e0f1733 100644 --- a/.github/workflows/demo-images.yml +++ b/.github/workflows/demo-images.yml @@ -5,7 +5,7 @@ name: Demo images # code (see demo-deploy/ and docs/demo-deployment-design.md). # # Required repo configuration: -# vars.DEMO_REGISTRY e.g. 146.59.87.168:3000/lfg2025 +# vars.DEMO_REGISTRY e.g. source.archipelago-foundation.org/lfg2025 # vars.DEMO_REGISTRY_HOST registry host for docker login (no org suffix) # secrets.DEMO_REGISTRY_USER # secrets.DEMO_REGISTRY_TOKEN diff --git a/.gitmodules b/.gitmodules index b79b5f6c..8a97eca6 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,3 +1,3 @@ [submodule "indeedhub"] path = indeedhub - url = http://146.59.87.168:3000/lfg2025/indeehub.git + url = https://source.archipelago-foundation.org/lfg2025/indeehub.git diff --git a/Android/COMPANION_RELEASE.md b/Android/COMPANION_RELEASE.md index e508c580..b5e7c5c4 100644 --- a/Android/COMPANION_RELEASE.md +++ b/Android/COMPANION_RELEASE.md @@ -92,7 +92,7 @@ built and signed: ```bash SERVED=neode-ui/public/packages/archipelago-companion.apk -GITEA_URL=http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/$SERVED +GITEA_URL=https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/$SERVED QR_URL=http://146.59.87.168:2100/packages/archipelago-companion.apk curl -sS -o /tmp/live-gitea.apk "$GITEA_URL" curl -sS -o /tmp/live-qr.apk "$QR_URL" diff --git a/app-catalog/README.md b/app-catalog/README.md index e3367209..de74380a 100644 --- a/app-catalog/README.md +++ b/app-catalog/README.md @@ -21,7 +21,7 @@ Add an entry to `catalog.json`: "icon": "/assets/img/app-icons/my-app.svg", "author": "Author", "category": "data", - "dockerImage": "146.59.87.168:3000/lfg2025/my-app:1.0.0", + "dockerImage": "source.archipelago-foundation.org/lfg2025/my-app:1.0.0", "repoUrl": "https://github.com/...", "containerConfig": { "ports": ["8080:8080"], diff --git a/app-catalog/catalog.json b/app-catalog/catalog.json index b6020cc1..0f67436b 100644 --- a/app-catalog/catalog.json +++ b/app-catalog/catalog.json @@ -1,7 +1,7 @@ { "version": 2, "updated": "2026-04-22T00:00:00Z", - "registry": "146.59.87.168:3000/lfg2025", + "registry": "source.archipelago-foundation.org/lfg2025", "featured": { "id": "indeedhub", "banner": "/assets/img/featured/indeedhub-banner.jpg", @@ -19,7 +19,7 @@ "author": "Bitcoin Knots", "category": "money", "tier": "core", - "dockerImage": "146.59.87.168:3000/lfg2025/bitcoin-knots:latest", + "dockerImage": "source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest", "repoUrl": "https://github.com/bitcoinknots/bitcoin" }, { @@ -31,7 +31,7 @@ "author": "Bitcoin Core contributors", "category": "money", "tier": "optional", - "dockerImage": "146.59.87.168:3000/lfg2025/bitcoin:28.4", + "dockerImage": "source.archipelago-foundation.org/lfg2025/bitcoin:28.4", "repoUrl": "https://github.com/bitcoin/bitcoin" }, { @@ -43,7 +43,7 @@ "author": "Lightning Labs", "category": "money", "tier": "core", - "dockerImage": "146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta", + "dockerImage": "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta", "repoUrl": "https://github.com/lightningnetwork/lnd", "requires": [ "bitcoin-knots" @@ -73,7 +73,7 @@ "author": "Mempool", "category": "money", "tier": "core", - "dockerImage": "146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1", + "dockerImage": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1", "repoUrl": "https://github.com/mempool/mempool", "requires": [ "bitcoin-knots", @@ -89,7 +89,7 @@ "author": "Luke Childs", "category": "money", "tier": "core", - "dockerImage": "146.59.87.168:3000/lfg2025/electrumx:v1.18.0", + "dockerImage": "source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0", "repoUrl": "https://github.com/spesmilo/electrumx", "requires": [ "bitcoin-knots" @@ -103,7 +103,7 @@ "icon": "/assets/img/app-icons/indeedhub.png", "author": "IndeeHub", "category": "community", - "dockerImage": "146.59.87.168:3000/lfg2025/indeedhub:1.0.0", + "dockerImage": "source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0", "repoUrl": "https://github.com/indeedhub/indeedhub" }, { @@ -114,7 +114,7 @@ "icon": "/assets/img/app-icons/botfights.svg", "author": "BotFights", "category": "community", - "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.2.11", + "dockerImage": "source.archipelago-foundation.org/lfg2025/botfights:1.2.11", "repoUrl": "https://botfights.net", "containerConfig": { "ports": [ @@ -172,7 +172,7 @@ "author": "File Browser", "category": "data", "tier": "core", - "dockerImage": "146.59.87.168:3000/lfg2025/filebrowser:v2.27.0", + "dockerImage": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0", "repoUrl": "https://github.com/filebrowser/filebrowser", "containerConfig": { "ports": [ @@ -223,7 +223,7 @@ "author": "Vaultwarden", "category": "data", "tier": "recommended", - "dockerImage": "146.59.87.168:3000/lfg2025/vaultwarden:1.30.0-alpine", + "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.30.0-alpine", "repoUrl": "https://github.com/dani-garcia/vaultwarden", "containerConfig": { "ports": [ @@ -243,7 +243,7 @@ "author": "SearXNG", "category": "data", "tier": "recommended", - "dockerImage": "146.59.87.168:3000/lfg2025/searxng:latest", + "dockerImage": "source.archipelago-foundation.org/lfg2025/searxng:latest", "repoUrl": "https://github.com/searxng/searxng", "containerConfig": { "ports": [ @@ -262,7 +262,7 @@ "icon": "/assets/img/app-icons/fedimint.png", "author": "Fedimint", "category": "money", - "dockerImage": "146.59.87.168:3000/lfg2025/fedimintd:v0.10.0", + "dockerImage": "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0", "repoUrl": "https://github.com/fedimint/fedimint" }, { @@ -274,7 +274,7 @@ "author": "Fedimint", "category": "money", "tier": "core", - "dockerImage": "146.59.87.168:3000/lfg2025/fmcd:0.8.1", + "dockerImage": "source.archipelago-foundation.org/lfg2025/fmcd:0.8.1", "repoUrl": "https://github.com/minmoto/fmcd" }, { @@ -285,7 +285,7 @@ "icon": "/assets/img/app-icons/fedimint.png", "author": "Fedimint", "category": "money", - "dockerImage": "146.59.87.168:3000/lfg2025/gatewayd:v0.10.0", + "dockerImage": "source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.0", "repoUrl": "https://github.com/fedimint/fedimint", "containerConfig": { "ports": [ @@ -306,7 +306,7 @@ "icon": "/assets/img/app-icons/bark.png", "author": "Second", "category": "money", - "dockerImage": "146.59.87.168:3000/lfg2025/barkd:0.3.0", + "dockerImage": "source.archipelago-foundation.org/lfg2025/barkd:0.3.0", "repoUrl": "https://gitlab.com/ark-bitcoin/bark", "containerConfig": { "ports": [ @@ -325,7 +325,7 @@ "icon": "/assets/img/app-icons/jellyfin.webp", "author": "Jellyfin", "category": "data", - "dockerImage": "146.59.87.168:3000/lfg2025/jellyfin:10.8.13", + "dockerImage": "source.archipelago-foundation.org/lfg2025/jellyfin:10.8.13", "repoUrl": "https://github.com/jellyfin/jellyfin", "containerConfig": { "ports": [ @@ -345,7 +345,7 @@ "icon": "/assets/img/app-icons/immich.png", "author": "Immich", "category": "data", - "dockerImage": "146.59.87.168:3000/lfg2025/immich-server:release", + "dockerImage": "source.archipelago-foundation.org/lfg2025/immich-server:release", "repoUrl": "https://github.com/immich-app/immich" }, { @@ -356,7 +356,7 @@ "icon": "/assets/img/app-icons/homeassistant.png", "author": "Home Assistant", "category": "home", - "dockerImage": "146.59.87.168:3000/lfg2025/home-assistant:2026.7.3", + "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.7.3", "repoUrl": "https://github.com/home-assistant/core", "containerConfig": { "ports": [ @@ -414,7 +414,7 @@ "author": "Tailscale", "category": "networking", "tier": "recommended", - "dockerImage": "146.59.87.168:3000/lfg2025/tailscale:stable", + "dockerImage": "source.archipelago-foundation.org/lfg2025/tailscale:stable", "repoUrl": "https://github.com/tailscale/tailscale", "containerConfig": { "ports": [ @@ -442,7 +442,7 @@ "author": "Portainer", "category": "development", "tier": "optional", - "dockerImage": "146.59.87.168:3000/lfg2025/portainer:2.39.1", + "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.39.1", "repoUrl": "https://github.com/portainer/portainer", "containerConfig": { "ports": [ @@ -487,7 +487,7 @@ "author": "Uptime Kuma", "category": "data", "tier": "recommended", - "dockerImage": "146.59.87.168:3000/lfg2025/uptime-kuma:1", + "dockerImage": "source.archipelago-foundation.org/lfg2025/uptime-kuma:1", "repoUrl": "https://github.com/louislam/uptime-kuma", "containerConfig": { "ports": [ @@ -514,7 +514,7 @@ "icon": "/assets/img/app-icons/photoprism.svg", "author": "PhotoPrism", "category": "data", - "dockerImage": "146.59.87.168:3000/lfg2025/photoprism:240915", + "dockerImage": "source.archipelago-foundation.org/lfg2025/photoprism:240915", "repoUrl": "https://github.com/photoprism/photoprism", "containerConfig": { "ports": [ @@ -537,7 +537,7 @@ "icon": "/assets/img/app-icons/nextcloud.webp", "author": "Nextcloud", "category": "data", - "dockerImage": "146.59.87.168:3000/lfg2025/nextcloud:29", + "dockerImage": "source.archipelago-foundation.org/lfg2025/nextcloud:29", "repoUrl": "https://github.com/nextcloud/server", "containerConfig": { "ports": [ diff --git a/apps/archy-btcpay-db/manifest.yml b/apps/archy-btcpay-db/manifest.yml index 77f3867c..5c1e7d25 100644 --- a/apps/archy-btcpay-db/manifest.yml +++ b/apps/archy-btcpay-db/manifest.yml @@ -5,7 +5,7 @@ app: description: Postgres backend for BTCPay and NBXplorer. container: - image: 146.59.87.168:3000/lfg2025/postgres:15.17 + image: source.archipelago-foundation.org/lfg2025/postgres:15.17 pull_policy: if-not-present network: archy-net data_uid: "100998:100998" diff --git a/apps/archy-mempool-db/manifest.yml b/apps/archy-mempool-db/manifest.yml index 3597f5c6..49bc9c33 100644 --- a/apps/archy-mempool-db/manifest.yml +++ b/apps/archy-mempool-db/manifest.yml @@ -5,7 +5,7 @@ app: description: MariaDB backend for the mempool explorer stack. container: - image: 146.59.87.168:3000/lfg2025/mariadb:11.4.10 + image: source.archipelago-foundation.org/lfg2025/mariadb:11.4.10 pull_policy: if-not-present network: archy-net data_uid: "100998:100998" diff --git a/apps/archy-mempool-web/manifest.yml b/apps/archy-mempool-web/manifest.yml index d18acc76..9179c917 100644 --- a/apps/archy-mempool-web/manifest.yml +++ b/apps/archy-mempool-web/manifest.yml @@ -6,7 +6,7 @@ app: container_name: mempool container: - image: 146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1 + image: source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1 pull_policy: if-not-present network: archy-net diff --git a/apps/archy-nbxplorer/manifest.yml b/apps/archy-nbxplorer/manifest.yml index a13c1bb7..4bd91f64 100644 --- a/apps/archy-nbxplorer/manifest.yml +++ b/apps/archy-nbxplorer/manifest.yml @@ -5,7 +5,7 @@ app: description: BTCPay blockchain indexer service. container: - image: 146.59.87.168:3000/lfg2025/nbxplorer:2.6.0 + image: source.archipelago-foundation.org/lfg2025/nbxplorer:2.6.0 pull_policy: if-not-present network: archy-net secret_env: diff --git a/apps/barkd/manifest.yml b/apps/barkd/manifest.yml index 171ed869..7830e9e0 100644 --- a/apps/barkd/manifest.yml +++ b/apps/barkd/manifest.yml @@ -10,7 +10,7 @@ app: # apps/barkd/Dockerfile and pushed to the node registry. Pin the tag to # match the REST shapes coded in core/archipelago/src/wallet/ark_client.rs # (validated against barkd 0.3.0 on signet, 2026-07-14). - image: 146.59.87.168:3000/lfg2025/barkd:0.3.0 + image: source.archipelago-foundation.org/lfg2025/barkd:0.3.0 pull_policy: if-not-present network: archy-net # The entrypoint installs the shared secret below via `barkd secret diff --git a/apps/bitcoin-core/manifest.yml b/apps/bitcoin-core/manifest.yml index 5e9db91a..29d21777 100644 --- a/apps/bitcoin-core/manifest.yml +++ b/apps/bitcoin-core/manifest.yml @@ -7,7 +7,7 @@ app: container_name: bitcoin-core container: - image: 146.59.87.168:3000/lfg2025/bitcoin:28.4 + image: source.archipelago-foundation.org/lfg2025/bitcoin:28.4 pull_policy: if-not-present network: archy-net entrypoint: ["sh", "-lc"] diff --git a/apps/bitcoin-knots/manifest.yml b/apps/bitcoin-knots/manifest.yml index f74c6052..5a305b1a 100644 --- a/apps/bitcoin-knots/manifest.yml +++ b/apps/bitcoin-knots/manifest.yml @@ -7,7 +7,7 @@ app: container_name: bitcoin-knots container: - image: 146.59.87.168:3000/lfg2025/bitcoin-knots:latest + image: source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest pull_policy: if-not-present network: archy-net entrypoint: ["sh", "-lc"] diff --git a/apps/botfights/manifest.yml b/apps/botfights/manifest.yml index 1cddd9a7..a1f040a9 100644 --- a/apps/botfights/manifest.yml +++ b/apps/botfights/manifest.yml @@ -6,7 +6,7 @@ app: category: community container: - image: 146.59.87.168:3000/lfg2025/botfights:1.2.11 + image: source.archipelago-foundation.org/lfg2025/botfights:1.2.11 pull_policy: always # Auto-generated on first install (random hex, 0600, rootless-owned). The # 1.2.x image's server/src/middleware/jwt.ts throws at module import when diff --git a/apps/electrumx/manifest.yml b/apps/electrumx/manifest.yml index ffa929db..8427a398 100644 --- a/apps/electrumx/manifest.yml +++ b/apps/electrumx/manifest.yml @@ -5,7 +5,7 @@ app: description: Electrum server indexing Bitcoin chain data for lightweight wallet queries. container: - image: 146.59.87.168:3000/lfg2025/electrumx:v1.18.0 + image: source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0 pull_policy: if-not-present network: archy-net data_uid: "1000:1000" diff --git a/apps/fedimint-clientd/manifest.yml b/apps/fedimint-clientd/manifest.yml index 898b31be..85cf4bf3 100644 --- a/apps/fedimint-clientd/manifest.yml +++ b/apps/fedimint-clientd/manifest.yml @@ -9,7 +9,7 @@ app: # 0.8.2 — iroh-capable). No usable upstream image exists, so we build + push # this to the node registry. Pin the tag to match the REST shapes coded in # core/archipelago/src/wallet/fedimint_client.rs (validated against 0.8.2). - image: 146.59.87.168:3000/lfg2025/fmcd:0.8.1 + image: source.archipelago-foundation.org/lfg2025/fmcd:0.8.1 pull_policy: if-not-present network: archy-net # No entrypoint override: the image's resilient `fmcd-run` launcher loops diff --git a/apps/fedimint-gateway/manifest.yml b/apps/fedimint-gateway/manifest.yml index 42ed8239..75c6b447 100644 --- a/apps/fedimint-gateway/manifest.yml +++ b/apps/fedimint-gateway/manifest.yml @@ -5,7 +5,7 @@ app: description: Fedimint gateway service with automatic LND-or-LDK backend selection. container: - image: 146.59.87.168:3000/lfg2025/gatewayd:v0.10.0 + image: source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.0 pull_policy: if-not-present network: archy-net entrypoint: ["sh", "-lc"] diff --git a/apps/fedimint/manifest.yml b/apps/fedimint/manifest.yml index f69a7ddc..f7a1cfbb 100644 --- a/apps/fedimint/manifest.yml +++ b/apps/fedimint/manifest.yml @@ -5,7 +5,7 @@ app: description: Federated Bitcoin minting service with built-in Guardian UI. Privacy-preserving Bitcoin custody. container: - image: 146.59.87.168:3000/lfg2025/fedimintd:v0.10.0 + image: source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0 pull_policy: if-not-present network: archy-net entrypoint: ["sh", "-lc"] diff --git a/apps/filebrowser/manifest.yml b/apps/filebrowser/manifest.yml index a47b9431..3b0502e4 100644 --- a/apps/filebrowser/manifest.yml +++ b/apps/filebrowser/manifest.yml @@ -5,7 +5,7 @@ app: description: Baseline Archipelago file manager service. container: - image: 146.59.87.168:3000/lfg2025/filebrowser:v2.27.0 + image: source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0 pull_policy: if-not-present network: archy-net custom_args: ["--config", "/data/.filebrowser.json"] diff --git a/apps/home-assistant/manifest.yml b/apps/home-assistant/manifest.yml index 7a4c3a2f..fc0b03b5 100644 --- a/apps/home-assistant/manifest.yml +++ b/apps/home-assistant/manifest.yml @@ -5,7 +5,7 @@ app: description: Open source home automation platform. Control and monitor your smart home devices. container: - image: 146.59.87.168:3000/lfg2025/home-assistant:2026.7.3 + image: source.archipelago-foundation.org/lfg2025/home-assistant:2026.7.3 pull_policy: if-not-present network: pasta diff --git a/apps/immich-postgres/manifest.yml b/apps/immich-postgres/manifest.yml index 88f42506..dd9d8fcf 100644 --- a/apps/immich-postgres/manifest.yml +++ b/apps/immich-postgres/manifest.yml @@ -11,7 +11,7 @@ app: container_name: immich_postgres container: - image: 146.59.87.168:3000/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0 + image: source.archipelago-foundation.org/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0 pull_policy: if-not-present network: archy-net # postgres drops to its own uid (container 999 → host 100998 under rootless), diff --git a/apps/immich-redis/manifest.yml b/apps/immich-redis/manifest.yml index 2450a615..4e59578f 100644 --- a/apps/immich-redis/manifest.yml +++ b/apps/immich-redis/manifest.yml @@ -9,7 +9,7 @@ app: container_name: immich_redis container: - image: 146.59.87.168:3000/lfg2025/valkey:7-alpine + image: source.archipelago-foundation.org/lfg2025/valkey:7-alpine pull_policy: if-not-present network: archy-net diff --git a/apps/immich/manifest.yml b/apps/immich/manifest.yml index a09b23dd..377bd86d 100644 --- a/apps/immich/manifest.yml +++ b/apps/immich/manifest.yml @@ -13,7 +13,7 @@ app: container_name: immich_server container: - image: 146.59.87.168:3000/lfg2025/immich-server:release + image: source.archipelago-foundation.org/lfg2025/immich-server:release pull_policy: if-not-present network: archy-net secret_env: diff --git a/apps/indeedhub-api/manifest.yml b/apps/indeedhub-api/manifest.yml index fb557280..fdb8db67 100644 --- a/apps/indeedhub-api/manifest.yml +++ b/apps/indeedhub-api/manifest.yml @@ -12,7 +12,7 @@ app: container_name: indeedhub-api container: - image: 146.59.87.168:3000/lfg2025/indeedhub-api:1.0.0 + image: source.archipelago-foundation.org/lfg2025/indeedhub-api:1.0.0 pull_policy: if-not-present network: indeedhub-net network_aliases: [api] diff --git a/apps/indeedhub-ffmpeg/manifest.yml b/apps/indeedhub-ffmpeg/manifest.yml index 2f93f148..f7624668 100644 --- a/apps/indeedhub-ffmpeg/manifest.yml +++ b/apps/indeedhub-ffmpeg/manifest.yml @@ -11,7 +11,7 @@ app: container_name: indeedhub-ffmpeg container: - image: 146.59.87.168:3000/lfg2025/indeedhub-ffmpeg:1.0.0 + image: source.archipelago-foundation.org/lfg2025/indeedhub-ffmpeg:1.0.0 pull_policy: if-not-present network: indeedhub-net secret_env: diff --git a/apps/indeedhub-minio/manifest.yml b/apps/indeedhub-minio/manifest.yml index 79e0d267..c507c3d2 100644 --- a/apps/indeedhub-minio/manifest.yml +++ b/apps/indeedhub-minio/manifest.yml @@ -11,7 +11,7 @@ app: container_name: indeedhub-minio container: - image: 146.59.87.168:3000/lfg2025/minio:RELEASE.2024-11-07T00-52-20Z + image: source.archipelago-foundation.org/lfg2025/minio:RELEASE.2024-11-07T00-52-20Z pull_policy: if-not-present network: indeedhub-net network_aliases: [minio] diff --git a/apps/indeedhub-postgres/manifest.yml b/apps/indeedhub-postgres/manifest.yml index 8d09211f..900d79e3 100644 --- a/apps/indeedhub-postgres/manifest.yml +++ b/apps/indeedhub-postgres/manifest.yml @@ -14,7 +14,7 @@ app: container_name: indeedhub-postgres container: - image: 146.59.87.168:3000/lfg2025/postgres:16.13-alpine + image: source.archipelago-foundation.org/lfg2025/postgres:16.13-alpine pull_policy: if-not-present network: indeedhub-net network_aliases: [postgres] diff --git a/apps/indeedhub-redis/manifest.yml b/apps/indeedhub-redis/manifest.yml index 97bda9ef..6fdce711 100644 --- a/apps/indeedhub-redis/manifest.yml +++ b/apps/indeedhub-redis/manifest.yml @@ -10,7 +10,7 @@ app: container_name: indeedhub-redis container: - image: 146.59.87.168:3000/lfg2025/redis:7.4.8-alpine + image: source.archipelago-foundation.org/lfg2025/redis:7.4.8-alpine pull_policy: if-not-present network: indeedhub-net network_aliases: [redis] diff --git a/apps/indeedhub-relay/manifest.yml b/apps/indeedhub-relay/manifest.yml index 842fe0c4..3a2594f0 100644 --- a/apps/indeedhub-relay/manifest.yml +++ b/apps/indeedhub-relay/manifest.yml @@ -11,7 +11,7 @@ app: container_name: indeedhub-relay container: - image: 146.59.87.168:3000/lfg2025/nostr-rs-relay:0.9.0 + image: source.archipelago-foundation.org/lfg2025/nostr-rs-relay:0.9.0 pull_policy: if-not-present network: indeedhub-net network_aliases: [relay] diff --git a/apps/indeedhub/manifest.yml b/apps/indeedhub/manifest.yml index a71f6777..02ed0e87 100644 --- a/apps/indeedhub/manifest.yml +++ b/apps/indeedhub/manifest.yml @@ -12,7 +12,7 @@ app: container_name: indeedhub container: - image: 146.59.87.168:3000/lfg2025/indeedhub:1.0.0 + image: source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0 pull_policy: if-not-present network: indeedhub-net diff --git a/apps/indeedhub/push-to-registry.sh b/apps/indeedhub/push-to-registry.sh index 5818bc0f..7b3ca2c8 100755 --- a/apps/indeedhub/push-to-registry.sh +++ b/apps/indeedhub/push-to-registry.sh @@ -12,7 +12,7 @@ set -e SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" FRONTEND_DIR="${INDEEHUB_FRONTEND:-$HOME/Projects/indeehub-frontend}" VERSION="${1:-latest}" -REGISTRY="${REGISTRY:-146.59.87.168:3000}" +REGISTRY="${REGISTRY:-source.archipelago-foundation.org}" NAMESPACE="${NAMESPACE:-lfg2025}" IMAGE_NAME="indeedhub" RUNTIME="${RUNTIME:-podman}" diff --git a/apps/jellyfin/manifest.yml b/apps/jellyfin/manifest.yml index 94ab1424..171932a3 100644 --- a/apps/jellyfin/manifest.yml +++ b/apps/jellyfin/manifest.yml @@ -5,7 +5,7 @@ app: description: Free media server. Stream movies, music, and photos. container: - image: 146.59.87.168:3000/lfg2025/jellyfin:10.8.13 + image: source.archipelago-foundation.org/lfg2025/jellyfin:10.8.13 pull_policy: if-not-present network: pasta diff --git a/apps/lnd/manifest.yml b/apps/lnd/manifest.yml index bde08f95..d39bbd7c 100644 --- a/apps/lnd/manifest.yml +++ b/apps/lnd/manifest.yml @@ -5,7 +5,7 @@ app: description: Lightning Network implementation by Lightning Labs. Enables instant, low-cost Bitcoin payments. container: - image: 146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta + image: source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta pull_policy: if-not-present network: archy-net # BITCOIND_HOST must follow the node's actual Bitcoin container — Knots or diff --git a/apps/mempool-api/manifest.yml b/apps/mempool-api/manifest.yml index 9bf8fe27..e25c839c 100644 --- a/apps/mempool-api/manifest.yml +++ b/apps/mempool-api/manifest.yml @@ -5,7 +5,7 @@ app: description: Backend API for mempool explorer. container: - image: 146.59.87.168:3000/lfg2025/mempool-backend:v3.0.0 + image: source.archipelago-foundation.org/lfg2025/mempool-backend:v3.0.0 pull_policy: if-not-present network: archy-net # CORE_RPC_HOST must follow the node's actual Bitcoin container — Knots or diff --git a/apps/mempool/manifest.yml b/apps/mempool/manifest.yml index ee64420b..330154ea 100644 --- a/apps/mempool/manifest.yml +++ b/apps/mempool/manifest.yml @@ -5,7 +5,7 @@ app: description: Bitcoin mempool and blockchain explorer. Real-time transaction and block visualization. container: - image: 146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1 + image: source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1 image_signature: cosign://... pull_policy: if-not-present diff --git a/apps/nextcloud/manifest.yml b/apps/nextcloud/manifest.yml index 6fb16d44..780fbfb5 100644 --- a/apps/nextcloud/manifest.yml +++ b/apps/nextcloud/manifest.yml @@ -5,7 +5,7 @@ app: description: Your own private cloud. File sync, calendars, contacts. container: - image: 146.59.87.168:3000/lfg2025/nextcloud:29 + image: source.archipelago-foundation.org/lfg2025/nextcloud:29 pull_policy: if-not-present network: pasta diff --git a/apps/photoprism/manifest.yml b/apps/photoprism/manifest.yml index 88cbcb73..0030f324 100644 --- a/apps/photoprism/manifest.yml +++ b/apps/photoprism/manifest.yml @@ -5,7 +5,7 @@ app: description: AI-powered photo management with facial recognition. container: - image: 146.59.87.168:3000/lfg2025/photoprism:240915 + image: source.archipelago-foundation.org/lfg2025/photoprism:240915 pull_policy: if-not-present dependencies: diff --git a/apps/portainer/manifest.yml b/apps/portainer/manifest.yml index 868e114e..b6104fc1 100644 --- a/apps/portainer/manifest.yml +++ b/apps/portainer/manifest.yml @@ -6,7 +6,7 @@ app: category: development container: - image: 146.59.87.168:3000/lfg2025/portainer:2.39.1 + image: source.archipelago-foundation.org/lfg2025/portainer:2.39.1 pull_policy: if-not-present data_uid: "1000:1000" diff --git a/apps/searxng/manifest.yml b/apps/searxng/manifest.yml index 0727ff36..14773095 100644 --- a/apps/searxng/manifest.yml +++ b/apps/searxng/manifest.yml @@ -5,7 +5,7 @@ app: description: Privacy-respecting metasearch engine. Search the web without tracking. container: - image: 146.59.87.168:3000/lfg2025/searxng:latest + image: source.archipelago-foundation.org/lfg2025/searxng:latest pull_policy: if-not-present dependencies: diff --git a/apps/uptime-kuma/manifest.yml b/apps/uptime-kuma/manifest.yml index 391b3c88..9b78db16 100644 --- a/apps/uptime-kuma/manifest.yml +++ b/apps/uptime-kuma/manifest.yml @@ -5,7 +5,7 @@ app: description: Self-hosted uptime monitoring. container: - image: 146.59.87.168:3000/lfg2025/uptime-kuma:1 + image: source.archipelago-foundation.org/lfg2025/uptime-kuma:1 pull_policy: if-not-present network: pasta custom_args: ["--", "node", "server/server.js"] diff --git a/apps/vaultwarden/manifest.yml b/apps/vaultwarden/manifest.yml index 1e85629f..b8c4f376 100644 --- a/apps/vaultwarden/manifest.yml +++ b/apps/vaultwarden/manifest.yml @@ -5,7 +5,7 @@ app: description: Self-hosted password vault with zero-knowledge encryption. container: - image: 146.59.87.168:3000/lfg2025/vaultwarden:1.30.0-alpine + image: source.archipelago-foundation.org/lfg2025/vaultwarden:1.30.0-alpine pull_policy: if-not-present network: pasta diff --git a/core/archipelago/src/api/handler/mod.rs b/core/archipelago/src/api/handler/mod.rs index 16fccb8a..70324ee0 100644 --- a/core/archipelago/src/api/handler/mod.rs +++ b/core/archipelago/src/api/handler/mod.rs @@ -152,7 +152,7 @@ impl ApiHandler { } if upstreams.is_empty() { upstreams.push( - "http://146.59.87.168:3000/lfg2025/app-catalog/raw/branch/main/catalog.json" + "https://source.archipelago-foundation.org/lfg2025/app-catalog/raw/branch/main/catalog.json" .to_string(), ); } diff --git a/core/archipelago/src/api/rpc/package/install.rs b/core/archipelago/src/api/rpc/package/install.rs index 5293b05d..cfefe9e2 100644 --- a/core/archipelago/src/api/rpc/package/install.rs +++ b/core/archipelago/src/api/rpc/package/install.rs @@ -1925,7 +1925,7 @@ autopilot.active=false\n", .unwrap_or(true); // Registries are configured as `host[:port]/namespace` (for - // example `146.59.87.168:3000/lfg2025`), but the Docker V2 + // example `source.archipelago-foundation.org/lfg2025`), but the Docker V2 // registry API lives at `/v2/` on the ROOT of the host — NOT // under the namespace. Strip the namespace before appending // `/v2/` so the reachability probe hits the correct URL. diff --git a/core/archipelago/src/api/rpc/package/set_config.rs b/core/archipelago/src/api/rpc/package/set_config.rs index 7c9535f9..d7d0cca2 100644 --- a/core/archipelago/src/api/rpc/package/set_config.rs +++ b/core/archipelago/src/api/rpc/package/set_config.rs @@ -335,15 +335,15 @@ mod tests { #[test] fn image_tag_keeps_registry_port_colon() { assert_eq!( - image_tag("146.59.87.168:3000/lfg2025/bitcoin:28.4").as_deref(), + image_tag("source.archipelago-foundation.org/lfg2025/bitcoin:28.4").as_deref(), Some("28.4") ); assert_eq!( - image_tag("146.59.87.168:3000/lfg2025/bitcoin-knots:29.3.knots20260508").as_deref(), + image_tag("source.archipelago-foundation.org/lfg2025/bitcoin-knots:29.3.knots20260508").as_deref(), Some("29.3.knots20260508") ); // No tag => None (don't mistake the registry port for a tag). - assert_eq!(image_tag("146.59.87.168:3000/lfg2025/bitcoin"), None); + assert_eq!(image_tag("source.archipelago-foundation.org/lfg2025/bitcoin"), None); assert_eq!( image_tag("docker.io/library/redis:7"), Some("7".to_string()) diff --git a/core/archipelago/src/api/rpc/package/stacks.rs b/core/archipelago/src/api/rpc/package/stacks.rs index 8e0a7ed9..91bec6e0 100644 --- a/core/archipelago/src/api/rpc/package/stacks.rs +++ b/core/archipelago/src/api/rpc/package/stacks.rs @@ -774,7 +774,7 @@ fn indeedhub_stack_app_ids() -> &'static [&'static str] { ] } -const REGISTRY: &str = "146.59.87.168:3000/lfg2025"; +const REGISTRY: &str = "source.archipelago-foundation.org/lfg2025"; /// Pull an image with retry and exponential backoff (3 attempts). async fn pull_image_with_retry(image: &str) -> Result<()> { @@ -871,9 +871,9 @@ impl RpcHandler { } let images = [ - "146.59.87.168:3000/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0", - "146.59.87.168:3000/lfg2025/valkey:7-alpine", - "146.59.87.168:3000/lfg2025/immich-server:release", + "source.archipelago-foundation.org/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0", + "source.archipelago-foundation.org/lfg2025/valkey:7-alpine", + "source.archipelago-foundation.org/lfg2025/immich-server:release", ]; self.set_install_phase("immich", InstallPhase::PullingImage) .await; @@ -947,7 +947,7 @@ impl RpcHandler { "POSTGRES_USER=postgres", "-e", "POSTGRES_DB=immich", - "146.59.87.168:3000/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0", + "source.archipelago-foundation.org/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0", ]); run_required_stack_command("immich", "create postgres", &mut postgres_cmd).await?; tokio::time::sleep(std::time::Duration::from_secs(5)).await; @@ -973,7 +973,7 @@ impl RpcHandler { "--health-cmd=valkey-cli ping || exit 1", "--health-interval=30s", "--health-retries=3", - "146.59.87.168:3000/lfg2025/valkey:7-alpine", + "source.archipelago-foundation.org/lfg2025/valkey:7-alpine", ]); run_required_stack_command("immich", "create redis", &mut redis_cmd).await?; tokio::time::sleep(std::time::Duration::from_secs(2)).await; @@ -1016,7 +1016,7 @@ impl RpcHandler { "REDIS_HOSTNAME=immich_redis".to_string(), "-e".to_string(), "UPLOAD_LOCATION=/usr/src/app/upload".to_string(), - "146.59.87.168:3000/lfg2025/immich-server:release".to_string(), + "source.archipelago-foundation.org/lfg2025/immich-server:release".to_string(), ], ) .await?; @@ -1517,7 +1517,7 @@ impl RpcHandler { .into_iter() .find(|r| r.enabled) .map(|r| r.url) - .unwrap_or_else(|| "146.59.87.168:3000/lfg2025".to_string()); + .unwrap_or_else(|| "source.archipelago-foundation.org/lfg2025".to_string()); let user_tmp = format!( "{}/.local/share/containers/tmp", diff --git a/core/archipelago/src/container/app_catalog.rs b/core/archipelago/src/container/app_catalog.rs index 830fbf68..ff0f1dd9 100644 --- a/core/archipelago/src/container/app_catalog.rs +++ b/core/archipelago/src/container/app_catalog.rs @@ -546,7 +546,7 @@ mod tests { "apps": { "indeedhub": { "version": "1.0.1", - "image": "146.59.87.168:3000/lfg2025/indeedhub:1.0.1", + "image": "source.archipelago-foundation.org/lfg2025/indeedhub:1.0.1", "digest": "blake3:deadbeef", "size": 12345, "another_future_field": true @@ -560,7 +560,7 @@ mod tests { assert_eq!(e.version, "1.0.1"); assert_eq!( e.image.as_deref(), - Some("146.59.87.168:3000/lfg2025/indeedhub:1.0.1") + Some("source.archipelago-foundation.org/lfg2025/indeedhub:1.0.1") ); assert_eq!(e.digest.as_deref(), Some("blake3:deadbeef")); } @@ -628,7 +628,7 @@ mod tests { #[test] fn catalog_url_derived_from_mirror() { let mirrors = vec![crate::update::UpdateMirror { - url: "http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json" + url: "https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/releases/manifest.json" .to_string(), label: "Server 1".to_string(), }]; @@ -636,7 +636,7 @@ mod tests { assert_eq!( urls, vec![ - "http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/app-catalog.json" + "https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/releases/app-catalog.json" .to_string() ] ); diff --git a/core/archipelago/src/container/companion.rs b/core/archipelago/src/container/companion.rs index 618c1b88..4b706146 100644 --- a/core/archipelago/src/container/companion.rs +++ b/core/archipelago/src/container/companion.rs @@ -33,7 +33,7 @@ use tracing::{info, warn}; use crate::container::quadlet::{self, BindMount, NetworkMode, QuadletUnit}; use archipelago_container::image_uses_insecure_registry; -const COMPANION_REGISTRY: &str = "146.59.87.168:3000/lfg2025"; +const COMPANION_REGISTRY: &str = "source.archipelago-foundation.org/lfg2025"; const COMPANION_IMAGE_CHECK_TIMEOUT: Duration = Duration::from_secs(15); const COMPANION_BUILD_TIMEOUT: Duration = Duration::from_secs(900); const COMPANION_PULL_TIMEOUT: Duration = Duration::from_secs(300); @@ -54,7 +54,7 @@ pub struct CompanionSpec { /// Container + unit name (e.g. "archy-bitcoin-ui"). pub name: &'static str, /// Image base name in the lfg2025 registry namespace - /// (e.g. "bitcoin-ui" → "146.59.87.168:3000/lfg2025/bitcoin-ui:latest"). + /// (e.g. "bitcoin-ui" → "source.archipelago-foundation.org/lfg2025/bitcoin-ui:latest"). pub image_base: &'static str, /// Filesystem locations to look for a local Dockerfile (build wins /// over registry pull). Searched in order; first hit wins. diff --git a/core/archipelago/src/container/image_policy.rs b/core/archipelago/src/container/image_policy.rs index c6d7eab6..1e2c5ab8 100644 --- a/core/archipelago/src/container/image_policy.rs +++ b/core/archipelago/src/container/image_policy.rs @@ -8,13 +8,13 @@ /// (git.tx1138.com was removed 2026-07-10: the host is retired and must /// never be pulled through again.) pub const TRUSTED_REGISTRIES: &[&str] = - &["docker.io", "ghcr.io", "localhost", "146.59.87.168:3000"]; + &["docker.io", "ghcr.io", "localhost", "source.archipelago-foundation.org"]; /// Validate a container image reference. /// /// Accepts: /// * refs whose explicit registry host is on [`TRUSTED_REGISTRIES`] -/// (`docker.io/grafana/grafana`, `146.59.87.168:3000/archy/x:1`), and +/// (`docker.io/grafana/grafana`, `source.archipelago-foundation.org/archy/x:1`), and /// * registry-less Docker Hub shorthand (`nginx`, `grafana/grafana`) — /// the first segment has no `.`/`:` so it cannot name an attacker host; /// resolution follows the host's registries.conf search order. @@ -55,7 +55,7 @@ mod tests { "docker.io/library/nginx:1.25", "ghcr.io/owner/app:latest", "localhost/archy-dev:1", - "146.59.87.168:3000/archy/bitcoin-knots:28.1", + "source.archipelago-foundation.org/archy/bitcoin-knots:28.1", ] { assert!(is_valid_docker_image(img), "{img} should be accepted"); } diff --git a/core/archipelago/src/container/image_versions.rs b/core/archipelago/src/container/image_versions.rs index b52b577b..749765da 100644 --- a/core/archipelago/src/container/image_versions.rs +++ b/core/archipelago/src/container/image_versions.rs @@ -234,7 +234,7 @@ pub fn available_update_for_images(pinned: &str, running_image: &str) -> Option< } /// Extract version tag from a full image reference. -/// e.g. "146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta" → "v0.18.4-beta" +/// e.g. "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta" → "v0.18.4-beta" /// Returns "latest" if no tag or tag is empty. pub fn extract_version_from_image(image: &str) -> String { // Split off the tag after the last colon, but only if it comes after the last slash @@ -328,11 +328,11 @@ mod tests { #[test] fn test_extract_version() { assert_eq!( - extract_version_from_image("146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta"), + extract_version_from_image("source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta"), "v0.18.4-beta" ); assert_eq!( - extract_version_from_image("146.59.87.168:3000/lfg2025/grafana:10.2.0"), + extract_version_from_image("source.archipelago-foundation.org/lfg2025/grafana:10.2.0"), "10.2.0" ); assert_eq!( @@ -340,7 +340,7 @@ mod tests { "latest" ); assert_eq!( - extract_version_from_image("146.59.87.168:3000/lfg2025/bitcoin-knots:latest"), + extract_version_from_image("source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest"), "latest" ); } @@ -348,11 +348,11 @@ mod tests { #[test] fn strips_registry_and_tag_for_image_identity() { assert_eq!( - image_without_registry_or_tag("146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta"), + image_without_registry_or_tag("source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta"), "lfg2025/lnd" ); assert_eq!( - image_without_registry_or_tag("146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta"), + image_without_registry_or_tag("source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta"), "lfg2025/lnd" ); } @@ -368,8 +368,8 @@ mod tests { fn available_update_ignores_registry_only_changes() { assert_eq!( available_update_for_images( - "146.59.87.168:3000/lfg2025/nextcloud:29", - "146.59.87.168:3000/lfg2025/nextcloud:29", + "source.archipelago-foundation.org/lfg2025/nextcloud:29", + "source.archipelago-foundation.org/lfg2025/nextcloud:29", ), None ); @@ -379,8 +379,8 @@ mod tests { fn available_update_returns_pinned_version_for_same_repo_newer_tag() { assert_eq!( available_update_for_images( - "146.59.87.168:3000/lfg2025/nextcloud:29", - "146.59.87.168:3000/lfg2025/nextcloud:28", + "source.archipelago-foundation.org/lfg2025/nextcloud:29", + "source.archipelago-foundation.org/lfg2025/nextcloud:28", ), Some("29".to_string()) ); @@ -389,7 +389,7 @@ mod tests { #[test] fn test_parse_image_versions() { let content = r#" -ARCHY_REGISTRY="146.59.87.168:3000/lfg2025" +ARCHY_REGISTRY="source.archipelago-foundation.org/lfg2025" LND_IMAGE="$ARCHY_REGISTRY/lnd:v0.18.4-beta" GRAFANA_IMAGE="$ARCHY_REGISTRY/grafana:10.2.0" # comment @@ -398,11 +398,11 @@ NOT_AN_IMAGE="something" let parsed = parse_image_versions(content); assert_eq!( parsed.get("LND_IMAGE"), - Some(&"146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta".to_string()) + Some(&"source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta".to_string()) ); assert_eq!( parsed.get("GRAFANA_IMAGE"), - Some(&"146.59.87.168:3000/lfg2025/grafana:10.2.0".to_string()) + Some(&"source.archipelago-foundation.org/lfg2025/grafana:10.2.0".to_string()) ); assert!(!parsed.contains_key("NOT_AN_IMAGE")); assert!(!parsed.contains_key("ARCHY_REGISTRY")); diff --git a/core/archipelago/src/container/prod_orchestrator.rs b/core/archipelago/src/container/prod_orchestrator.rs index 0ce4fef6..d182bc9e 100644 --- a/core/archipelago/src/container/prod_orchestrator.rs +++ b/core/archipelago/src/container/prod_orchestrator.rs @@ -5224,7 +5224,7 @@ app: name: File Browser version: 1.0.0 container: - image: 146.59.87.168:3000/lfg2025/filebrowser:v2.27.0 + image: source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0 custom_args: - --config - /data/.filebrowser.json @@ -5248,7 +5248,7 @@ app: name: LND version: 1.0.0 container: - image: 146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta + image: source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta secret_env: - key: BITCOIND_RPCPASS secret_file: bitcoin-rpc-password diff --git a/core/archipelago/src/container/quadlet.rs b/core/archipelago/src/container/quadlet.rs index 7771b328..b85ffff3 100644 --- a/core/archipelago/src/container/quadlet.rs +++ b/core/archipelago/src/container/quadlet.rs @@ -956,7 +956,7 @@ mod tests { QuadletUnit { name: "archy-bitcoin-ui".into(), description: "Bitcoin RPC UI proxy".into(), - image: "146.59.87.168:3000/lfg2025/bitcoin-ui:1.7.84-alpha".into(), + image: "source.archipelago-foundation.org/lfg2025/bitcoin-ui:1.7.84-alpha".into(), network: NetworkMode::Host, user: Some("0:0".into()), memory_mb: Some(128), @@ -984,7 +984,7 @@ mod tests { let s = sample_unit().render(); assert!(s.contains("[Container]")); assert!(s.contains("ContainerName=archy-bitcoin-ui")); - assert!(s.contains("Image=146.59.87.168:3000/lfg2025/bitcoin-ui:1.7.84-alpha")); + assert!(s.contains("Image=source.archipelago-foundation.org/lfg2025/bitcoin-ui:1.7.84-alpha")); assert!(s.contains("Pull=never")); assert!(s.contains("Network=host")); assert!(s.contains("DropCapability=ALL")); diff --git a/core/archipelago/src/container/registry.rs b/core/archipelago/src/container/registry.rs index 72d2338c..ad12acea 100644 --- a/core/archipelago/src/container/registry.rs +++ b/core/archipelago/src/container/registry.rs @@ -10,7 +10,7 @@ use std::path::Path; use tokio::fs; const REGISTRY_FILE: &str = "config/registries.json"; -const OVH_REGISTRY_URL: &str = "146.59.87.168:3000/lfg2025"; +const OVH_REGISTRY_URL: &str = "source.archipelago-foundation.org/lfg2025"; /// Retired registry host (release server retired 2026-06-13; the registry /// frontend was fully dead by 2026-07-10 — 500 on every /v2 manifest read). /// Never a default, never force-enabled; stripped from saved configs on @@ -21,7 +21,7 @@ const RETIRED_TX1138_HOST: &str = "git.tx1138.com"; /// A single container registry. #[derive(Debug, Clone, Serialize, Deserialize)] pub struct Registry { - /// Registry URL (e.g., "146.59.87.168:3000/lfg2025"). + /// Registry URL (e.g., "source.archipelago-foundation.org/lfg2025"). pub url: String, /// Human-readable name. pub name: String, @@ -68,8 +68,8 @@ impl RegistryConfig { } /// Rewrite an image reference to use a specific registry. - /// E.g., "docker.io/lfg2025/bitcoin-knots:latest" with registry "146.59.87.168:3000/lfg2025" - /// becomes "146.59.87.168:3000/lfg2025/bitcoin-knots:latest". + /// E.g., "docker.io/lfg2025/bitcoin-knots:latest" with registry "source.archipelago-foundation.org/lfg2025" + /// becomes "source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest". pub fn rewrite_image(&self, image: &str, registry: &Registry) -> String { // Extract the image name (last component after the org/namespace) // Handles: "registry/org/image:tag" -> "image:tag" @@ -79,7 +79,7 @@ impl RegistryConfig { } /// Extract the image name from a full image reference. -/// "146.59.87.168:3000/lfg2025/bitcoin-knots:latest" -> "bitcoin-knots:latest" +/// "source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest" -> "bitcoin-knots:latest" /// "docker.io/gitea/gitea:1.23" -> "gitea:1.23" fn extract_image_name(image: &str) -> &str { // Split by '/' and take the last segment (image:tag) @@ -212,7 +212,7 @@ mod tests { #[test] fn test_extract_image_name() { assert_eq!( - extract_image_name("146.59.87.168:3000/lfg2025/bitcoin-knots:latest"), + extract_image_name("source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest"), "bitcoin-knots:latest" ); assert_eq!( @@ -230,7 +230,7 @@ mod tests { let primary = &config.registries[0]; assert_eq!( config.rewrite_image("docker.io/lfg2025/bitcoin-knots:latest", primary), - "146.59.87.168:3000/lfg2025/bitcoin-knots:latest" + "source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest" ); } diff --git a/core/archipelago/src/update.rs b/core/archipelago/src/update.rs index 69a3345d..88c32475 100644 --- a/core/archipelago/src/update.rs +++ b/core/archipelago/src/update.rs @@ -88,7 +88,7 @@ const DEFAULT_UPDATE_MANIFEST_URL: &str = /// whose DNS or TLS is broken still updates. Dropped from the mirror list /// once the fleet has moved. const LEGACY_UPDATE_MANIFEST_URL: &str = - "http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json"; + "https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/releases/manifest.json"; const UPDATE_STATE_FILE: &str = "update_state.json"; const UPDATE_MIRRORS_FILE: &str = "update-mirrors.json"; /// Marker written by apply_update() just before the service restart and diff --git a/core/container/src/podman_client.rs b/core/container/src/podman_client.rs index baa018dc..b59ed7a4 100644 --- a/core/container/src/podman_client.rs +++ b/core/container/src/podman_client.rs @@ -742,7 +742,7 @@ impl PodmanClient { /// Registries we ship with as `--tls-verify=false` because they're internal /// HTTP mirrors. Add a host:port here only if it's a controlled mirror that /// the fleet trusts and operators won't ever paste a malicious URL into. -const INSECURE_REGISTRY_HOSTS: &[&str] = &["146.59.87.168:3000"]; +const INSECURE_REGISTRY_HOSTS: &[&str] = &["source.archipelago-foundation.org"]; pub fn image_uses_insecure_registry(image: &str) -> bool { image @@ -1087,7 +1087,7 @@ mod tests { #[test] fn insecure_registry_detection_matches_http_mirrors_only() { assert!(image_uses_insecure_registry( - "146.59.87.168:3000/lfg2025/bitcoin-knots:latest" + "source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest" )); // The legacy Hetzner mirror at 23.182.128.160 was decommissioned and // is no longer trusted — it must NOT bypass TLS even if a stale @@ -1106,7 +1106,7 @@ mod tests { // string into its own URL still has the attacker host in the // registry-host slot, so it does NOT match. assert!(!image_uses_insecure_registry( - "evil.example:80/146.59.87.168:3000/lfg2025/x:latest" + "evil.example:80/source.archipelago-foundation.org/lfg2025/x:latest" )); } diff --git a/demo-deploy/.env.example b/demo-deploy/.env.example index cab5b316..305e3e52 100644 --- a/demo-deploy/.env.example +++ b/demo-deploy/.env.example @@ -1,7 +1,7 @@ # Copy to .env and adjust. Used by demo-deploy/docker-compose.yml. # Registry host + namespace that holds the prebuilt demo images. -REGISTRY=146.59.87.168:3000/lfg2025 +REGISTRY=source.archipelago-foundation.org/lfg2025 # Image tag to deploy (CI publishes :demo and :). IMAGE_TAG=demo diff --git a/demo-deploy/docker-compose.yml b/demo-deploy/docker-compose.yml index 64ea99cd..ffef8d85 100644 --- a/demo-deploy/docker-compose.yml +++ b/demo-deploy/docker-compose.yml @@ -18,7 +18,7 @@ services: neode-backend: - image: ${REGISTRY:-146.59.87.168:3000/lfg2025}/archy-demo-backend:${IMAGE_TAG:-demo} + image: ${REGISTRY:-source.archipelago-foundation.org/lfg2025}/archy-demo-backend:${IMAGE_TAG:-demo} container_name: archy-demo-backend environment: DEMO: "1" @@ -40,7 +40,7 @@ services: retries: 3 neode-web: - image: ${REGISTRY:-146.59.87.168:3000/lfg2025}/archy-demo-web:${IMAGE_TAG:-demo} + image: ${REGISTRY:-source.archipelago-foundation.org/lfg2025}/archy-demo-web:${IMAGE_TAG:-demo} container_name: archy-demo-web ports: - "${DEMO_WEB_PORT:-2100}:80" diff --git a/docker/mempool-frontend/Dockerfile b/docker/mempool-frontend/Dockerfile index d312506d..b773591e 100644 --- a/docker/mempool-frontend/Dockerfile +++ b/docker/mempool-frontend/Dockerfile @@ -5,7 +5,7 @@ # the frontend re-resolves the backend (mempool-api) via DNS on every request. # Without this, nginx pins the backend IP at startup and serves 502 / "offline" # after any backend restart (podman reassigns the IP). See the script header. -ARG BASE=146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.0 +ARG BASE=source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.0 FROM ${BASE} # --chmod keeps the exec bit (build runs as USER 1000, plain COPY lands root:0644 diff --git a/docs/1.8.0-RELEASE-HARDENING-PLAN.md b/docs/1.8.0-RELEASE-HARDENING-PLAN.md index 2543eeb7..e1a204fd 100644 --- a/docs/1.8.0-RELEASE-HARDENING-PLAN.md +++ b/docs/1.8.0-RELEASE-HARDENING-PLAN.md @@ -71,7 +71,7 @@ arbitrary app catalog to the entire fleet — fully unattended under install cosign + publish real `image_signature` values (in that order); tracked with the Workstream B signing ceremony item. - [ ] 🟠 **Move the image mirror to HTTPS; drop `--tls-verify=false`.** - `podman_client.rs:641` `INSECURE_REGISTRY_HOSTS = ["146.59.87.168:3000"]` + + `podman_client.rs:641` `INSECURE_REGISTRY_HOSTS = ["source.archipelago-foundation.org"]` + `config.rs:104,124` allowlist pull images over unauthenticated HTTP. Remove the raw-IP entries; give the mirror a valid/pinned cert. (Same host also baked insecurely into the ISO — see §F.) @@ -310,7 +310,7 @@ media (latest artifact only one minor behind). `archipelago ceremony verify` against the pinned anchor; build host never holds the key). **Still open:** Secure Boot — `BOOTX64.EFI` is unsigned though `grub-efi-amd64-signed` is installed. -- [ ] 🟠 **Registries over HTTPS in the image too** — `146.59.87.168:3000` +- [ ] 🟠 **Registries over HTTPS in the image too** — `source.archipelago-foundation.org` are baked `insecure=true`/`tls_verify:false` (`:216`, `:2308`). (Ties to §A.) - [ ] 🟡 **Add `unattended-upgrades` + a default-deny nftables firewall** (allow 22/80/443 + mesh/WG). Neither exists today; OS packages drift until reflash and there is no host diff --git a/docs/archive/demo-deployment-design.md b/docs/archive/demo-deployment-design.md index d0e6a4c1..9a6d81e7 100644 --- a/docs/archive/demo-deployment-design.md +++ b/docs/archive/demo-deployment-design.md @@ -46,7 +46,7 @@ layer**. CI: build archy-demo-web + archy-demo-backend │ push :demo / :latest ▼ - registry (146.59.87.168:3000 / vps2) + registry (source.archipelago-foundation.org / vps2) │ Portainer webhook / re-pull ▼ archy-demo (public repo — tiny) @@ -162,7 +162,7 @@ Today filebrowser upload/delete/rename are 200-OK no-ops. 1. **Demo host** — which Portainer instance (OVH `.168`? a dedicated VPS)? Public DNS + TLS for `demo.`? -2. **Registry for `:demo` images** — `146.59.87.168:3000` vs vps2; public-pull or +2. **Registry for `:demo` images** — `source.archipelago-foundation.org` vs vps2; public-pull or creds baked into Portainer? 3. **Session TTL + concurrency cap** — concrete numbers (30 min / N sessions / 50 MB)? 4. **Chat in the demo** — enable Claude chat (needs key + budget cap) or stub it? diff --git a/docs/bitcoin-multi-version-design.md b/docs/bitcoin-multi-version-design.md index 25b38024..8eb1daf8 100644 --- a/docs/bitcoin-multi-version-design.md +++ b/docs/bitcoin-multi-version-design.md @@ -111,7 +111,7 @@ green first), `MEMORY → project_decoupled_app_updates`, |-------|-------| | `apps/bitcoin-core/Dockerfile` | `FROM bitcoin/bitcoin:24.0` — a **community** image, **stale** (manifest says 28.4), no project-official Docker image exists | | `apps/bitcoin-knots/` | **no Dockerfile** — `:latest` is built/pushed by hand | -| Registry | `scripts/image-versions.sh` → `ARCHY_REGISTRY="146.59.87.168:3000/lfg2025"`; only `BITCOIN_KNOTS_IMAGE=…/bitcoin-knots:latest` pinned, no Core pin | +| Registry | `scripts/image-versions.sh` → `ARCHY_REGISTRY="source.archipelago-foundation.org/lfg2025"`; only `BITCOIN_KNOTS_IMAGE=…/bitcoin-knots:latest` pinned, no Core pin | | Tags in registry | **one tag per image**. No historical versions. | ### Version pinning diff --git a/docs/bitcoin-version-bulletproof-rollout.md b/docs/bitcoin-version-bulletproof-rollout.md index 16005128..2c82f13a 100644 --- a/docs/bitcoin-version-bulletproof-rollout.md +++ b/docs/bitcoin-version-bulletproof-rollout.md @@ -45,7 +45,7 @@ Three **stacked** bugs, plus a data-corruption hazard: removed `USER bitcoin` → run as **container-root** like legacy (still 100% rootless: container-root maps to the unprivileged host service user; `CAP_DAC_OVERRIDE` from the manifest lets bitcoind read the `data_uid`-owned datadir). **All** images rebuilt root + - pushed to the mirror (`146.59.87.168:3000/lfg2025`): + pushed to the mirror (`source.archipelago-foundation.org/lfg2025`): - Knots: `29.3.knots20260508`, `29.3.knots20260507`, `29.3.knots20260210`, `29.2.knots20251110` - Core: `25.2 26.2 27.2 28.4 29.2 29.3 30.2 31.0` + `latest` (→31.0) - **Catalog** (`scripts/generate-app-catalog.sh` VERSIONS map + regenerated diff --git a/docs/container-architecture.html b/docs/container-architecture.html index ce1e6e96..48cfc0f9 100644 --- a/docs/container-architecture.html +++ b/docs/container-architecture.html @@ -842,7 +842,7 @@

Registry

    -
  • Private registry at 146.59.87.168:3000/lfg2025/
    • +
  • Private registry at source.archipelago-foundation.org/lfg2025/
  • HTTPS (self-hosted Gitea)
  • All images pre-pulled into registry; nodes pull on first boot
diff --git a/docs/demo-build-info.md b/docs/demo-build-info.md index 4992b7c9..027c95d8 100644 --- a/docs/demo-build-info.md +++ b/docs/demo-build-info.md @@ -3,7 +3,7 @@ **Status:** implemented & deployable (2026-07-14) **Branch:** `main` — the demo machinery was merged from the old `demo-build` branch and now lives on main, pushed to -`gitea-vps2` = `http://146.59.87.168:3000/lfg2025/archy.git`. +`gitea-vps2` = `https://source.archipelago-foundation.org/lfg2025/archy.git`. A public, click-to-play demo of the Archipelago UI, 100% mock-data driven, multi-visitor, deployed via Portainer. See also `docs/archive/demo-deployment-design.md` @@ -17,7 +17,7 @@ Build-from-repo (works today, no registry needed): | Field | Value | |-------|-------| -| Repository URL | `http://146.59.87.168:3000/lfg2025/archy.git` | +| Repository URL | `https://source.archipelago-foundation.org/lfg2025/archy.git` | | Reference | `refs/heads/main` | | Compose path | `docker-compose.demo.yml` | | Auth | user `lfg2025`, password = Gitea token | diff --git a/docs/dht-distribution-design.md b/docs/dht-distribution-design.md index a209c4c7..2c69ff90 100644 --- a/docs/dht-distribution-design.md +++ b/docs/dht-distribution-design.md @@ -28,7 +28,7 @@ origin": ### OTA (`core/archipelago/src/update.rs`) - Manifest at `DEFAULT_UPDATE_MANIFEST_URL` (`update.rs:67`) = vps2 OVH - (`146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json`). + (`source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/releases/manifest.json`). - `check_for_updates()` (`:565`) walks an operator mirror list (`default_mirrors()` `:105`, `load_mirrors()` `:123`), origin-rewrites component URLs to the chosen mirror (`rewrite_manifest_origins()` `:227`). @@ -65,9 +65,9 @@ origin": ### IndeeHub (the streaming target) - Original platform (not a fork). Working source: `~/Projects/Indeedhub Prototype/` - (Vue 3 + NestJS). Submodule `146.59.87.168:3000/lfg2025/indeehub.git` (repointed off the retired host — + (Vue 3 + NestJS). Submodule `source.archipelago-foundation.org/lfg2025/indeehub.git` (repointed off the retired host — needs a live remote). In `archy`: image-only, `apps/indeedhub/manifest.yml` pulls - `146.59.87.168:3000/lfg2025/indeedhub:1.0.0` (+ `-api`, `-ffmpeg`, postgres, redis, + `source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0` (+ `-api`, `-ffmpeg`, postgres, redis, minio, nostr-rs-relay). - Streaming today: FFmpeg → **HLS (.m3u8 + AES-128 .ts segments)** in **MinIO** (`indeedhub-private`/`-public`), metadata in Postgres, transcode queue in Redis, diff --git a/docs/dual-ecash-design.md b/docs/dual-ecash-design.md index 664bcbfe..7911a95f 100644 --- a/docs/dual-ecash-design.md +++ b/docs/dual-ecash-design.md @@ -94,7 +94,7 @@ in sync with the manifest env. clientd is a **client, not the guardian** — it under `image-recipe/_archived/` (likely stale); `first-boot-containers.sh`/`image-versions.sh` are current. - Image: build from source (no official image; `flake.nix` only) → push to vps2 - `146.59.87.168:3000/lfg2025/fedimint-clientd:v0.4.0`. + `source.archipelago-foundation.org/lfg2025/fedimint-clientd:v0.4.0`. ### 5. Unified balance `HomeWalletCard` ecash row = Cashu `wallet.ecash-balance` + Fedimint `wallet.fedimint-balance`. diff --git a/image-recipe/_archived/.gitea-workflows/build-iso-dev.yml b/image-recipe/_archived/.gitea-workflows/build-iso-dev.yml index bc63a62f..e674ead3 100644 --- a/image-recipe/_archived/.gitea-workflows/build-iso-dev.yml +++ b/image-recipe/_archived/.gitea-workflows/build-iso-dev.yml @@ -112,7 +112,7 @@ jobs: run: | sudo mkdir -p /etc/containers/registries.conf.d echo '[[registry]] - location = "146.59.87.168:3000" + location = "source.archipelago-foundation.org" insecure = true' | sudo tee /etc/containers/registries.conf.d/archipelago.conf - name: Build unbundled ISO diff --git a/image-recipe/_archived/build-auto-installer-iso.sh b/image-recipe/_archived/build-auto-installer-iso.sh index 876d140f..a652cab4 100755 --- a/image-recipe/_archived/build-auto-installer-iso.sh +++ b/image-recipe/_archived/build-auto-installer-iso.sh @@ -223,7 +223,7 @@ check_tools() { fi if mkdir -p "$REGCONF_DIR" 2>/dev/null && cat > "$REGCONF_DIR/archipelago.conf" 2>/dev/null <<'REGCONF' [[registry]] -location = "146.59.87.168:3000" +location = "source.archipelago-foundation.org" insecure = true REGCONF then @@ -241,7 +241,7 @@ mkdir -p "$OUTPUT_DIR" container_pull() { local image="$1" - if [[ "$CONTAINER_CMD" == podman* && "$image" == 146.59.87.168:3000/* ]]; then + if [[ "$CONTAINER_CMD" == podman* && "$image" == source.archipelago-foundation.org/* ]]; then $CONTAINER_CMD pull --tls-verify=false --platform "$CONTAINER_PLATFORM" "$image" else $CONTAINER_CMD pull --platform "$CONTAINER_PLATFORM" "$image" @@ -1317,11 +1317,11 @@ fi # Extract nostr-rs-relay binary from container image (native system service for VPN signaling) echo " Extracting nostr-rs-relay binary..." -RELAY_IMAGE="$($CONTAINER_CMD images -q 146.59.87.168:3000/lfg2025/nostr-rs-relay:0.9.0 2>/dev/null)" +RELAY_IMAGE="$($CONTAINER_CMD images -q source.archipelago-foundation.org/lfg2025/nostr-rs-relay:0.9.0 2>/dev/null)" if [ -z "$RELAY_IMAGE" ]; then - $CONTAINER_CMD pull 146.59.87.168:3000/lfg2025/nostr-rs-relay:0.9.0 2>/dev/null || true + $CONTAINER_CMD pull source.archipelago-foundation.org/lfg2025/nostr-rs-relay:0.9.0 2>/dev/null || true fi -RELAY_CONTAINER=$($CONTAINER_CMD create 146.59.87.168:3000/lfg2025/nostr-rs-relay:0.9.0 2>/dev/null) || true +RELAY_CONTAINER=$($CONTAINER_CMD create source.archipelago-foundation.org/lfg2025/nostr-rs-relay:0.9.0 2>/dev/null) || true if [ -n "$RELAY_CONTAINER" ]; then # The relay image builds to its WORKDIR /usr/src/app and execs # ./nostr-rs-relay from there (not /usr/local/bin — that path was from an @@ -1346,7 +1346,7 @@ if [ -n "$MISSING_VPN_BINARIES" ]; then echo " ⚠ Building WITHOUT:$MISSING_VPN_BINARIES (ALLOW_MISSING_VPN_BINARIES=1)" else echo " ❌ Required binaries not extracted:$MISSING_VPN_BINARIES" - echo " The registry (146.59.87.168:3000) must be reachable and hold the images," + echo " The registry (source.archipelago-foundation.org) must be reachable and hold the images," echo " or set ALLOW_MISSING_VPN_BINARIES=1 to ship without VPN signaling." exit 1 fi @@ -3002,11 +3002,11 @@ cat > /mnt/target/home/archipelago/.config/containers/registries.conf <<'REGCONF unqualified-search-registries = ["docker.io"] [[registry]] -location = "146.59.87.168:3000" +location = "source.archipelago-foundation.org" insecure = true [[registry]] -location = "146.59.87.168:3000" +location = "source.archipelago-foundation.org" insecure = true REGCONF chown -R 1000:1000 /mnt/target/home/archipelago/.config @@ -3016,8 +3016,8 @@ mkdir -p /mnt/target/var/lib/archipelago/config cat > /mnt/target/var/lib/archipelago/config/registries.json <<'DYNREG' { "registries": [ - {"url": "146.59.87.168:3000/lfg2025", "name": "Archipelago Primary", "tls_verify": false, "enabled": true, "priority": 0}, - {"url": "146.59.87.168:3000/lfg2025", "name": "Archipelago Fallback", "tls_verify": true, "enabled": true, "priority": 10} + {"url": "source.archipelago-foundation.org/lfg2025", "name": "Archipelago Primary", "tls_verify": false, "enabled": true, "priority": 0}, + {"url": "source.archipelago-foundation.org/lfg2025", "name": "Archipelago Fallback", "tls_verify": true, "enabled": true, "priority": 10} ] } DYNREG @@ -3191,7 +3191,7 @@ if [ -d "$REPO_DIR/.git" ]; then exit 0 # Already cloned fi echo "[update] Cloning Archipelago repo for self-updates..." -su - archipelago -c "git clone https://146.59.87.168:3000/lfg2025/archy $REPO_DIR" 2>/dev/null || { +su - archipelago -c "git clone https://source.archipelago-foundation.org/lfg2025/archy $REPO_DIR" 2>/dev/null || { echo "[update] Git clone failed (network?). Updates will retry on next boot." exit 0 } diff --git a/image-recipe/scripts/install-podman.sh b/image-recipe/scripts/install-podman.sh index e772a4e0..c252ce20 100755 --- a/image-recipe/scripts/install-podman.sh +++ b/image-recipe/scripts/install-podman.sh @@ -40,10 +40,10 @@ EOF # Configure registries (use Docker Hub and quay.io) mkdir -p /home/archipelago/.config/containers/registries.conf.d cat > /home/archipelago/.config/containers/registries.conf < { }) /** App dependency definitions */ -const R = '146.59.87.168:3000/lfg2025' +const R = 'source.archipelago-foundation.org/lfg2025' const APP_DEPENDENCIES: Record = { 'electrumx': [{ id: 'bitcoin-knots', title: 'Bitcoin Knots', dockerImage: `${R}/bitcoin-knots:latest` }], 'lnd': [{ id: 'bitcoin-knots', title: 'Bitcoin Knots', dockerImage: `${R}/bitcoin-knots:latest` }], diff --git a/neode-ui/src/views/discover/curatedApps.ts b/neode-ui/src/views/discover/curatedApps.ts index 3e0c6a5e..67edc76d 100644 --- a/neode-ui/src/views/discover/curatedApps.ts +++ b/neode-ui/src/views/discover/curatedApps.ts @@ -1,6 +1,6 @@ import type { MarketplaceApp } from './types' -const R = '146.59.87.168:3000/lfg2025' +const R = 'source.archipelago-foundation.org/lfg2025' // ---------- Dynamic catalog from registry ---------- export interface CatalogFeatured { diff --git a/neode-ui/src/views/marketplace/marketplaceData.ts b/neode-ui/src/views/marketplace/marketplaceData.ts index 19b55307..7e7c72ca 100644 --- a/neode-ui/src/views/marketplace/marketplaceData.ts +++ b/neode-ui/src/views/marketplace/marketplaceData.ts @@ -46,7 +46,7 @@ export interface InstallProgress { } /** Archipelago app registry — all app images are mirrored here */ -const REGISTRY = '146.59.87.168:3000/lfg2025' +const REGISTRY = 'source.archipelago-foundation.org/lfg2025' /** Marketplace app ID -> backend package keys (for "Already Installed" when first-boot/deploy created them) */ export const INSTALLED_ALIASES: Record = { @@ -390,7 +390,7 @@ export function getCuratedAppList(): MarketplaceApp[] { description: 'Bitcoin documentary streaming platform with Nostr identity sign-in. Stream God Bless Bitcoin and other educational content about sovereignty and decentralized technology.', icon: '/assets/img/app-icons/indeedhub.png', author: 'Indeehub Team', - dockerImage: '146.59.87.168:3000/lfg2025/indeedhub:latest', + dockerImage: 'source.archipelago-foundation.org/lfg2025/indeedhub:latest', manifestUrl: undefined, repoUrl: 'https://github.com/indeedhub/indeedhub' }, diff --git a/scripts/app-catalog-image-smoke-test.py b/scripts/app-catalog-image-smoke-test.py index 7e3e71be..90bc2ed3 100755 --- a/scripts/app-catalog-image-smoke-test.py +++ b/scripts/app-catalog-image-smoke-test.py @@ -31,7 +31,7 @@ from pathlib import Path import yaml -INSECURE_REGISTRIES = ("146.59.87.168:3000", "23.182.128.160:3000") +INSECURE_REGISTRIES = ("source.archipelago-foundation.org", "23.182.128.160:3000") def run(cmd: list[str], timeout: int = 120) -> subprocess.CompletedProcess[str]: diff --git a/scripts/bootstrap-switchover.sh b/scripts/bootstrap-switchover.sh index 4f4543e4..1b24ae5e 100755 --- a/scripts/bootstrap-switchover.sh +++ b/scripts/bootstrap-switchover.sh @@ -78,7 +78,7 @@ if $DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -q '^electrumx$'; then -e "DAEMON_URL=http://${RPC_USER}:${RPC_PASS}@bitcoin-knots:8332/" \ -e COIN=Bitcoin -e DB_DIRECTORY=/data \ -e "SERVICES=tcp://:50001,rpc://0.0.0.0:8000" \ - "${ELECTRUMX_IMAGE:-146.59.87.168:3000/lfg2025/electrumx:v1.18.0}" + "${ELECTRUMX_IMAGE:-source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0}" fi # Mempool API @@ -98,7 +98,7 @@ if $DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -q '^mempool-api$'; th -e "DATABASE_ENABLED=true" -e "DATABASE_HOST=archy-mempool-db" \ -e "DATABASE_DATABASE=mempool" -e "DATABASE_USERNAME=mempool" \ -e "DATABASE_PASSWORD=$(cat "$SECRETS_DIR/mempool-db-password" 2>/dev/null || echo mempoolpass)" \ - "${MEMPOOL_API_IMAGE:-146.59.87.168:3000/lfg2025/mempool-api:v3.2.0}" + "${MEMPOOL_API_IMAGE:-source.archipelago-foundation.org/lfg2025/mempool-api:v3.2.0}" fi # Stop Tor tunnel if it was active diff --git a/scripts/create-release-manifest.sh b/scripts/create-release-manifest.sh index b2c147b2..fa4eff77 100755 --- a/scripts/create-release-manifest.sh +++ b/scripts/create-release-manifest.sh @@ -18,7 +18,7 @@ RELEASE_DATE="" OUTPUT_FILE="manifest.json" BACKEND_BINARY="" FRONTEND_ARCHIVE="" -BASE_URL="http://146.59.87.168:3000/lfg2025/archy/releases/download" +BASE_URL="https://source.archipelago-foundation.org/lfg2025/archy/releases/download" usage() { echo "Usage: $0 --version VERSION [--date DATE] [--output FILE]" diff --git a/scripts/create-release.sh b/scripts/create-release.sh index 9739b148..ec4fbfa2 100755 --- a/scripts/create-release.sh +++ b/scripts/create-release.sh @@ -293,4 +293,4 @@ echo " 2. Publish commits, tag, artifacts, and verify download URLs:" echo " scripts/publish-release-assets.sh ${VERSION} gitea-vps2" echo " 3. Verify manifest is live on both mirrors:" echo " curl -fsS http://localhost:3000/lfg2025/archy/raw/branch/main/releases/manifest.json" -echo " curl -fsS http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json" +echo " curl -fsS https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/releases/manifest.json" diff --git a/scripts/deploy-bitcoin-knots.sh b/scripts/deploy-bitcoin-knots.sh index 96c402d5..52046cce 100644 --- a/scripts/deploy-bitcoin-knots.sh +++ b/scripts/deploy-bitcoin-knots.sh @@ -74,7 +74,7 @@ mkdir -p "$BUILD_DIR" # Create Dockerfile cat > "$BUILD_DIR/Dockerfile" << 'EOF' -FROM ${NGINX_ALPINE_IMAGE:-146.59.87.168:3000/lfg2025/nginx:1.29.6-alpine} +FROM ${NGINX_ALPINE_IMAGE:-source.archipelago-foundation.org/lfg2025/nginx:1.29.6-alpine} # Copy the static UI COPY index.html /usr/share/nginx/html/ diff --git a/scripts/dev-container-test.sh b/scripts/dev-container-test.sh index 939e26af..1ea834b8 100755 --- a/scripts/dev-container-test.sh +++ b/scripts/dev-container-test.sh @@ -151,7 +151,7 @@ run_smoke_tests() { # Test 3: Install a lightweight container (filebrowser — small, fast, no deps) TESTS=$((TESTS + 1)) - local install_img="146.59.87.168:3000/lfg2025/filebrowser:v2.27.0" + local install_img="source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0" # Check if already installed local fb_state fb_state=$(ssh $SSH_OPTS "$SSH_HOST" "podman inspect filebrowser --format '{{.State.Status}}' 2>/dev/null || echo 'none'") diff --git a/scripts/first-boot-containers.sh b/scripts/first-boot-containers.sh index 242ed15d..58616daa 100755 --- a/scripts/first-boot-containers.sh +++ b/scripts/first-boot-containers.sh @@ -9,7 +9,7 @@ # # Image versions: sourced from /opt/archipelago/image-versions.sh (single source of truth). # All container image references use the $*_IMAGE variables defined there. -# Images pull from the Archipelago app registry (146.59.87.168:3000/lfg2025/). +# Images pull from the Archipelago app registry (source.archipelago-foundation.org/lfg2025/). # # --- PLANNED REFACTOR (post-beta) --- # This script is ~995 lines and should be split into a modular library. diff --git a/scripts/generate-app-catalog.sh b/scripts/generate-app-catalog.sh index cfd47f0e..73a933c6 100755 --- a/scripts/generate-app-catalog.sh +++ b/scripts/generate-app-catalog.sh @@ -172,7 +172,7 @@ if os.environ.get("EMBED_MANIFESTS") and apps_dir: # image.sh (Phase 0) publishes more tagged images, e.g.: # {"version": "30.0", "image": f"{REGISTRY}/bitcoin:30.0"}, # {"version": "27.2", "image": f"{REGISTRY}/bitcoin:27.2", "deprecated": True, "eol": "2026-12-31"}, -REGISTRY = os.environ.get("ARCHY_REGISTRY", "146.59.87.168:3000/lfg2025") +REGISTRY = os.environ.get("ARCHY_REGISTRY", "source.archipelago-foundation.org/lfg2025") VERSIONS = { # Curated Core set (latest patch per major, current → 25). Images built + # verified (SHA-256 + OpenPGP, fail-closed) and pushed by diff --git a/scripts/image-versions.sh b/scripts/image-versions.sh index 5988c471..95425ba7 100644 --- a/scripts/image-versions.sh +++ b/scripts/image-versions.sh @@ -5,12 +5,12 @@ # Usage: source /opt/archipelago/image-versions.sh 2>/dev/null || true # source "$(dirname "$0")/image-versions.sh" 2>/dev/null || true # -# Tags MUST match what's actually in the registry at 146.59.87.168:3000/lfg2025/ -# Run: podman images --format '{{.Repository}}:{{.Tag}}' | grep '146.59.87.168:3000' | sort +# Tags MUST match what's actually in the registry at source.archipelago-foundation.org/lfg2025/ +# Run: podman images --format '{{.Repository}}:{{.Tag}}' | grep 'source.archipelago-foundation.org' | sort # to verify against the registry. # Archipelago app registries (primary + fallback) -ARCHY_REGISTRY="146.59.87.168:3000/lfg2025" +ARCHY_REGISTRY="source.archipelago-foundation.org/lfg2025" # No fallback registry: the old tx1138 registry host was retired (2026-06-13); empty disables the fallback path. ARCHY_REGISTRY_FALLBACK="" diff --git a/scripts/self-update.sh b/scripts/self-update.sh index dc243ca9..927a362a 100755 --- a/scripts/self-update.sh +++ b/scripts/self-update.sh @@ -1,5 +1,5 @@ #!/bin/bash -# Self-update: pull latest code from the OVH Gitea (146.59.87.168:3000) and apply +# Self-update: pull latest code from the OVH Gitea (source.archipelago-foundation.org) and apply # Designed to run on installed Archipelago nodes (as archipelago user) # # Usage: @@ -8,7 +8,7 @@ # ./self-update.sh --force # Apply even if already up to date # # The script: -# 1. Pulls latest code from origin (146.59.87.168:3000) +# 1. Pulls latest code from origin (source.archipelago-foundation.org) # 2. Builds the Rust backend (release mode) # 3. Builds the Vue frontend (production mode) # 4. Installs the new binary and web UI @@ -69,7 +69,7 @@ done # Ensure repo exists if [ ! -d "$REPO_DIR/.git" ]; then err "Repo not found at $REPO_DIR" - err "Clone it first: git clone http://146.59.87.168:3000/lfg2025/archy ~/archy" + err "Clone it first: git clone https://source.archipelago-foundation.org/lfg2025/archy ~/archy" exit 1 fi diff --git a/scripts/validate-app-manifest.sh b/scripts/validate-app-manifest.sh index 657957a6..0c7d9bd1 100755 --- a/scripts/validate-app-manifest.sh +++ b/scripts/validate-app-manifest.sh @@ -137,7 +137,7 @@ fi if [[ -n "$IMAGE" ]]; then TRUSTED=false - for reg in "docker.io" "ghcr.io" "quay.io" "registry.hub.docker.com" "146.59.87.168:3000" "localhost/"; do + for reg in "docker.io" "ghcr.io" "quay.io" "registry.hub.docker.com" "source.archipelago-foundation.org" "localhost/"; do if [[ "$IMAGE" == *"$reg"* ]]; then TRUSTED=true break diff --git a/tests/lifecycle/bats/immich.bats b/tests/lifecycle/bats/immich.bats index fd305642..1f6df607 100644 --- a/tests/lifecycle/bats/immich.bats +++ b/tests/lifecycle/bats/immich.bats @@ -15,7 +15,7 @@ load '../lib/rpc.bash' -IMMICH_IMAGE="146.59.87.168:3000/lfg2025/immich-server:release" +IMMICH_IMAGE="source.archipelago-foundation.org/lfg2025/immich-server:release" setup_file() { : "${ARCHY_PASSWORD:?Set ARCHY_PASSWORD env var to the UI password}" diff --git a/tests/lifecycle/remote-lifecycle.sh b/tests/lifecycle/remote-lifecycle.sh index 2dfd0ba6..a9b1a2f4 100755 --- a/tests/lifecycle/remote-lifecycle.sh +++ b/tests/lifecycle/remote-lifecycle.sh @@ -133,29 +133,29 @@ is_pruned_node() { image_for() { case "$1" in - bitcoin-knots) echo "146.59.87.168:3000/lfg2025/bitcoin-knots:latest" ;; + bitcoin-knots) echo "source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest" ;; bitcoin-core) echo "docker.io/bitcoin/bitcoin:28.4" ;; btcpay-server) echo "docker.io/btcpayserver/btcpayserver:2.3.9" ;; - lnd) echo "146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta" ;; - mempool) echo "146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.0" ;; - homeassistant) echo "146.59.87.168:3000/lfg2025/home-assistant:2024.1" ;; - grafana) echo "146.59.87.168:3000/lfg2025/grafana:10.2.0" ;; - searxng) echo "146.59.87.168:3000/lfg2025/searxng:latest" ;; - ollama) echo "146.59.87.168:3000/lfg2025/ollama:latest" ;; - nextcloud) echo "146.59.87.168:3000/lfg2025/nextcloud:28" ;; - vaultwarden) echo "146.59.87.168:3000/lfg2025/vaultwarden:1.30.0-alpine" ;; - jellyfin) echo "146.59.87.168:3000/lfg2025/jellyfin:10.8.13" ;; - photoprism) echo "146.59.87.168:3000/lfg2025/photoprism:240915" ;; - immich) echo "146.59.87.168:3000/lfg2025/immich-server:release" ;; - filebrowser) echo "146.59.87.168:3000/lfg2025/filebrowser:v2.27.0" ;; - nginx-proxy-manager) echo "146.59.87.168:3000/lfg2025/nginx-proxy-manager:latest" ;; - portainer) echo "146.59.87.168:3000/lfg2025/portainer:latest" ;; - uptime-kuma) echo "146.59.87.168:3000/lfg2025/uptime-kuma:1" ;; - tailscale) echo "146.59.87.168:3000/lfg2025/tailscale:stable" ;; - electrumx) echo "146.59.87.168:3000/lfg2025/electrumx:v1.18.0" ;; - fedimint) echo "146.59.87.168:3000/lfg2025/fedimintd:v0.10.0" ;; - indeedhub) echo "146.59.87.168:3000/lfg2025/indeedhub:1.0.0" ;; - botfights) echo "146.59.87.168:3000/lfg2025/botfights:1.1.0" ;; + lnd) echo "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta" ;; + mempool) echo "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.0" ;; + homeassistant) echo "source.archipelago-foundation.org/lfg2025/home-assistant:2024.1" ;; + grafana) echo "source.archipelago-foundation.org/lfg2025/grafana:10.2.0" ;; + searxng) echo "source.archipelago-foundation.org/lfg2025/searxng:latest" ;; + ollama) echo "source.archipelago-foundation.org/lfg2025/ollama:latest" ;; + nextcloud) echo "source.archipelago-foundation.org/lfg2025/nextcloud:28" ;; + vaultwarden) echo "source.archipelago-foundation.org/lfg2025/vaultwarden:1.30.0-alpine" ;; + jellyfin) echo "source.archipelago-foundation.org/lfg2025/jellyfin:10.8.13" ;; + photoprism) echo "source.archipelago-foundation.org/lfg2025/photoprism:240915" ;; + immich) echo "source.archipelago-foundation.org/lfg2025/immich-server:release" ;; + filebrowser) echo "source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0" ;; + nginx-proxy-manager) echo "source.archipelago-foundation.org/lfg2025/nginx-proxy-manager:latest" ;; + portainer) echo "source.archipelago-foundation.org/lfg2025/portainer:latest" ;; + uptime-kuma) echo "source.archipelago-foundation.org/lfg2025/uptime-kuma:1" ;; + tailscale) echo "source.archipelago-foundation.org/lfg2025/tailscale:stable" ;; + electrumx) echo "source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0" ;; + fedimint) echo "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0" ;; + indeedhub) echo "source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0" ;; + botfights) echo "source.archipelago-foundation.org/lfg2025/botfights:1.1.0" ;; gitea) echo "docker.io/gitea/gitea:1.23" ;; *) return 1 ;; esac