feat(registry): move image and OTA references to the public domain

Replaces the registry host across 86 files: 309 references, covering all 40 app manifests, the orchestrator and container crates, the release and catalog scripts, both demo-images workflows, the ISO builder, demo-deploy, and the frontend marketplace data. Verified the domain actually serves the registry before rewriting anything, rather than assuming the web host implies the registry: - TLS verifies clean, HTTP/2 on the web root - an anonymous token grants a manifest fetch (HTTP 200) with no credentials - skopeo inspect --no-creds resolves an image and lists its tags That last check is the one that matters: an outside developer with no account can now pull, which was the functional blocker for publishing at all. Plain-HTTP references become HTTPS in the same pass, so OTA downloads stop crossing the network in the clear. Deliberately NOT rewritten: - The public FIPS anchor on port 8444. It is a functional network endpoint every node dials to bootstrap the mesh — closer to Bitcoin Core's hardcoded seeds than to leaked infrastructure. The domain does resolve to the same host, so it could become a hostname, but that adds a DNS dependency to the path used precisely when things are broken. Worth a deliberate decision, not a side effect of this change. - The companion APK on port 2100. The domain returns 404 for that path, so rewriting it would swap a working URL for a broken one. The Releases page does serve (200), which is where the plan already wants those binaries. - releases/app-catalog.json, releases/manifest.json and release-manifest.json. These carry `signature` and `signed_by`; editing their contents invalidates the signature and the fleet refuses artifacts that fail verification. They were rewritten in a first pass and reverted — they must be regenerated and re-signed through the signing ceremony instead, which needs the mnemonic. So the catalog still advertises the old host until that ceremony runs. Nodes resolve images through the signed catalog, not the on-disk manifests, so this commit alone does not change what a node pulls. Verified: archipelago-container 75/75; every manifest still parses with a top-level app block; no signed artifact modified. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-07 11:31:20 -04:00
parent b2c7592840
commit 8e814ca06a
86 changed files with 210 additions and 210 deletions
@@ -5,7 +5,7 @@ app:
  description: Postgres backend for BTCPay and NBXplorer.

  container:
-    image: 146.59.87.168:3000/lfg2025/postgres:15.17
+    image: source.archipelago-foundation.org/lfg2025/postgres:15.17
    pull_policy: if-not-present
    network: archy-net
    data_uid: "100998:100998"
@@ -5,7 +5,7 @@ app:
  description: MariaDB backend for the mempool explorer stack.

  container:
-    image: 146.59.87.168:3000/lfg2025/mariadb:11.4.10
+    image: source.archipelago-foundation.org/lfg2025/mariadb:11.4.10
    pull_policy: if-not-present
    network: archy-net
    data_uid: "100998:100998"
@@ -6,7 +6,7 @@ app:
  container_name: mempool

  container:
-    image: 146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1
+    image: source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1
    pull_policy: if-not-present
    network: archy-net

@@ -5,7 +5,7 @@ app:
  description: BTCPay blockchain indexer service.

  container:
-    image: 146.59.87.168:3000/lfg2025/nbxplorer:2.6.0
+    image: source.archipelago-foundation.org/lfg2025/nbxplorer:2.6.0
    pull_policy: if-not-present
    network: archy-net
    secret_env:
@@ -10,7 +10,7 @@ app:
    # apps/barkd/Dockerfile and pushed to the node registry. Pin the tag to
    # match the REST shapes coded in core/archipelago/src/wallet/ark_client.rs
    # (validated against barkd 0.3.0 on signet, 2026-07-14).
-    image: 146.59.87.168:3000/lfg2025/barkd:0.3.0
+    image: source.archipelago-foundation.org/lfg2025/barkd:0.3.0
    pull_policy: if-not-present
    network: archy-net
    # The entrypoint installs the shared secret below via `barkd secret
@@ -7,7 +7,7 @@ app:
  container_name: bitcoin-core

  container:
-    image: 146.59.87.168:3000/lfg2025/bitcoin:28.4
+    image: source.archipelago-foundation.org/lfg2025/bitcoin:28.4
    pull_policy: if-not-present
    network: archy-net
    entrypoint: ["sh", "-lc"]
@@ -7,7 +7,7 @@ app:
  container_name: bitcoin-knots

  container:
-    image: 146.59.87.168:3000/lfg2025/bitcoin-knots:latest
+    image: source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest
    pull_policy: if-not-present
    network: archy-net
    entrypoint: ["sh", "-lc"]
@@ -6,7 +6,7 @@ app:
  category: community

  container:
-    image: 146.59.87.168:3000/lfg2025/botfights:1.2.11
+    image: source.archipelago-foundation.org/lfg2025/botfights:1.2.11
    pull_policy: always
    # Auto-generated on first install (random hex, 0600, rootless-owned). The
    # 1.2.x image's server/src/middleware/jwt.ts throws at module import when
@@ -5,7 +5,7 @@ app:
  description: Electrum server indexing Bitcoin chain data for lightweight wallet queries.

  container:
-    image: 146.59.87.168:3000/lfg2025/electrumx:v1.18.0
+    image: source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0
    pull_policy: if-not-present
    network: archy-net
    data_uid: "1000:1000"
@@ -9,7 +9,7 @@ app:
    # 0.8.2 — iroh-capable). No usable upstream image exists, so we build + push
    # this to the node registry. Pin the tag to match the REST shapes coded in
    # core/archipelago/src/wallet/fedimint_client.rs (validated against 0.8.2).
-    image: 146.59.87.168:3000/lfg2025/fmcd:0.8.1
+    image: source.archipelago-foundation.org/lfg2025/fmcd:0.8.1
    pull_policy: if-not-present
    network: archy-net
    # No entrypoint override: the image's resilient `fmcd-run` launcher loops
@@ -5,7 +5,7 @@ app:
  description: Fedimint gateway service with automatic LND-or-LDK backend selection.

  container:
-    image: 146.59.87.168:3000/lfg2025/gatewayd:v0.10.0
+    image: source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.0
    pull_policy: if-not-present
    network: archy-net
    entrypoint: ["sh", "-lc"]
@@ -5,7 +5,7 @@ app:
  description: Federated Bitcoin minting service with built-in Guardian UI. Privacy-preserving Bitcoin custody.

  container:
-    image: 146.59.87.168:3000/lfg2025/fedimintd:v0.10.0
+    image: source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0
    pull_policy: if-not-present
    network: archy-net
    entrypoint: ["sh", "-lc"]
@@ -5,7 +5,7 @@ app:
  description: Baseline Archipelago file manager service.

  container:
-    image: 146.59.87.168:3000/lfg2025/filebrowser:v2.27.0
+    image: source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0
    pull_policy: if-not-present
    network: archy-net
    custom_args: ["--config", "/data/.filebrowser.json"]
@@ -5,7 +5,7 @@ app:
  description: Open source home automation platform. Control and monitor your smart home devices.
  
  container:
-    image: 146.59.87.168:3000/lfg2025/home-assistant:2026.7.3
+    image: source.archipelago-foundation.org/lfg2025/home-assistant:2026.7.3
    pull_policy: if-not-present
    network: pasta
    
@@ -11,7 +11,7 @@ app:
  container_name: immich_postgres

  container:
-    image: 146.59.87.168:3000/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0
+    image: source.archipelago-foundation.org/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0
    pull_policy: if-not-present
    network: archy-net
    # postgres drops to its own uid (container 999 → host 100998 under rootless),
@@ -9,7 +9,7 @@ app:
  container_name: immich_redis

  container:
-    image: 146.59.87.168:3000/lfg2025/valkey:7-alpine
+    image: source.archipelago-foundation.org/lfg2025/valkey:7-alpine
    pull_policy: if-not-present
    network: archy-net

@@ -13,7 +13,7 @@ app:
  container_name: immich_server

  container:
-    image: 146.59.87.168:3000/lfg2025/immich-server:release
+    image: source.archipelago-foundation.org/lfg2025/immich-server:release
    pull_policy: if-not-present
    network: archy-net
    secret_env:
@@ -12,7 +12,7 @@ app:
  container_name: indeedhub-api

  container:
-    image: 146.59.87.168:3000/lfg2025/indeedhub-api:1.0.0
+    image: source.archipelago-foundation.org/lfg2025/indeedhub-api:1.0.0
    pull_policy: if-not-present
    network: indeedhub-net
    network_aliases: [api]
@@ -11,7 +11,7 @@ app:
  container_name: indeedhub-ffmpeg

  container:
-    image: 146.59.87.168:3000/lfg2025/indeedhub-ffmpeg:1.0.0
+    image: source.archipelago-foundation.org/lfg2025/indeedhub-ffmpeg:1.0.0
    pull_policy: if-not-present
    network: indeedhub-net
    secret_env:
@@ -11,7 +11,7 @@ app:
  container_name: indeedhub-minio

  container:
-    image: 146.59.87.168:3000/lfg2025/minio:RELEASE.2024-11-07T00-52-20Z
+    image: source.archipelago-foundation.org/lfg2025/minio:RELEASE.2024-11-07T00-52-20Z
    pull_policy: if-not-present
    network: indeedhub-net
    network_aliases: [minio]
@@ -14,7 +14,7 @@ app:
  container_name: indeedhub-postgres

  container:
-    image: 146.59.87.168:3000/lfg2025/postgres:16.13-alpine
+    image: source.archipelago-foundation.org/lfg2025/postgres:16.13-alpine
    pull_policy: if-not-present
    network: indeedhub-net
    network_aliases: [postgres]
@@ -10,7 +10,7 @@ app:
  container_name: indeedhub-redis

  container:
-    image: 146.59.87.168:3000/lfg2025/redis:7.4.8-alpine
+    image: source.archipelago-foundation.org/lfg2025/redis:7.4.8-alpine
    pull_policy: if-not-present
    network: indeedhub-net
    network_aliases: [redis]
@@ -11,7 +11,7 @@ app:
  container_name: indeedhub-relay

  container:
-    image: 146.59.87.168:3000/lfg2025/nostr-rs-relay:0.9.0
+    image: source.archipelago-foundation.org/lfg2025/nostr-rs-relay:0.9.0
    pull_policy: if-not-present
    network: indeedhub-net
    network_aliases: [relay]
@@ -12,7 +12,7 @@ app:
  container_name: indeedhub

  container:
-    image: 146.59.87.168:3000/lfg2025/indeedhub:1.0.0
+    image: source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0
    pull_policy: if-not-present
    network: indeedhub-net

@@ -12,7 +12,7 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FRONTEND_DIR="${INDEEHUB_FRONTEND:-$HOME/Projects/indeehub-frontend}"
 VERSION="${1:-latest}"
-REGISTRY="${REGISTRY:-146.59.87.168:3000}"
+REGISTRY="${REGISTRY:-source.archipelago-foundation.org}"
 NAMESPACE="${NAMESPACE:-lfg2025}"
 IMAGE_NAME="indeedhub"
 RUNTIME="${RUNTIME:-podman}"
@@ -5,7 +5,7 @@ app:
  description: Free media server. Stream movies, music, and photos.

  container:
-    image: 146.59.87.168:3000/lfg2025/jellyfin:10.8.13
+    image: source.archipelago-foundation.org/lfg2025/jellyfin:10.8.13
    pull_policy: if-not-present
    network: pasta

@@ -5,7 +5,7 @@ app:
  description: Lightning Network implementation by Lightning Labs. Enables instant, low-cost Bitcoin payments.

  container:
-    image: 146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta
+    image: source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta
    pull_policy: if-not-present
    network: archy-net
    # BITCOIND_HOST must follow the node's actual Bitcoin container — Knots or
@@ -5,7 +5,7 @@ app:
  description: Backend API for mempool explorer.

  container:
-    image: 146.59.87.168:3000/lfg2025/mempool-backend:v3.0.0
+    image: source.archipelago-foundation.org/lfg2025/mempool-backend:v3.0.0
    pull_policy: if-not-present
    network: archy-net
    # CORE_RPC_HOST must follow the node's actual Bitcoin container — Knots or
@@ -5,7 +5,7 @@ app:
  description: Bitcoin mempool and blockchain explorer. Real-time transaction and block visualization.
  
  container:
-    image: 146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1
+    image: source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1
    image_signature: cosign://...
    pull_policy: if-not-present
    
@@ -5,7 +5,7 @@ app:
  description: Your own private cloud. File sync, calendars, contacts.

  container:
-    image: 146.59.87.168:3000/lfg2025/nextcloud:29
+    image: source.archipelago-foundation.org/lfg2025/nextcloud:29
    pull_policy: if-not-present
    network: pasta

@@ -5,7 +5,7 @@ app:
  description: AI-powered photo management with facial recognition.

  container:
-    image: 146.59.87.168:3000/lfg2025/photoprism:240915
+    image: source.archipelago-foundation.org/lfg2025/photoprism:240915
    pull_policy: if-not-present

  dependencies:
@@ -6,7 +6,7 @@ app:
  category: development

  container:
-    image: 146.59.87.168:3000/lfg2025/portainer:2.39.1
+    image: source.archipelago-foundation.org/lfg2025/portainer:2.39.1
    pull_policy: if-not-present
    data_uid: "1000:1000"

@@ -5,7 +5,7 @@ app:
  description: Privacy-respecting metasearch engine. Search the web without tracking.
  
  container:
-    image: 146.59.87.168:3000/lfg2025/searxng:latest
+    image: source.archipelago-foundation.org/lfg2025/searxng:latest
    pull_policy: if-not-present
    
  dependencies:
@@ -5,7 +5,7 @@ app:
  description: Self-hosted uptime monitoring.

  container:
-    image: 146.59.87.168:3000/lfg2025/uptime-kuma:1
+    image: source.archipelago-foundation.org/lfg2025/uptime-kuma:1
    pull_policy: if-not-present
    network: pasta
    custom_args: ["--", "node", "server/server.js"]
@@ -5,7 +5,7 @@ app:
  description: Self-hosted password vault with zero-knowledge encryption.

  container:
-    image: 146.59.87.168:3000/lfg2025/vaultwarden:1.30.0-alpine
+    image: source.archipelago-foundation.org/lfg2025/vaultwarden:1.30.0-alpine
    pull_policy: if-not-present
    network: pasta