feat(registry): move image and OTA references to the public domain

Replaces the registry host across 86 files: 309 references, covering all 40
app manifests, the orchestrator and container crates, the release and catalog
scripts, both demo-images workflows, the ISO builder, demo-deploy, and the
frontend marketplace data.

Verified the domain actually serves the registry before rewriting anything,
rather than assuming the web host implies the registry:
- TLS verifies clean, HTTP/2 on the web root
- an anonymous token grants a manifest fetch (HTTP 200) with no credentials
- skopeo inspect --no-creds resolves an image and lists its tags

That last check is the one that matters: an outside developer with no account
can now pull, which was the functional blocker for publishing at all.

Plain-HTTP references become HTTPS in the same pass, so OTA downloads stop
crossing the network in the clear.

Deliberately NOT rewritten:
- The public FIPS anchor on port 8444. It is a functional network endpoint
  every node dials to bootstrap the mesh — closer to Bitcoin Core's hardcoded
  seeds than to leaked infrastructure. The domain does resolve to the same
  host, so it could become a hostname, but that adds a DNS dependency to the
  path used precisely when things are broken. Worth a deliberate decision,
  not a side effect of this change.
- The companion APK on port 2100. The domain returns 404 for that path, so
  rewriting it would swap a working URL for a broken one. The Releases page
  does serve (200), which is where the plan already wants those binaries.
- releases/app-catalog.json, releases/manifest.json and release-manifest.json.
  These carry `signature` and `signed_by`; editing their contents invalidates
  the signature and the fleet refuses artifacts that fail verification. They
  were rewritten in a first pass and reverted — they must be regenerated and
  re-signed through the signing ceremony instead, which needs the mnemonic.

So the catalog still advertises the old host until that ceremony runs. Nodes
resolve images through the signed catalog, not the on-disk manifests, so this
commit alone does not change what a node pulls.

Verified: archipelago-container 75/75; every manifest still parses with a
top-level app block; no signed artifact modified.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/app-catalog-image-smoke-test.py

@@ -31,7 +31,7 @@ from pathlib import Path
 import yaml
 
 
-INSECURE_REGISTRIES = ("146.59.87.168:3000", "23.182.128.160:3000")
+INSECURE_REGISTRIES = ("source.archipelago-foundation.org", "23.182.128.160:3000")
 
 
 def run(cmd: list[str], timeout: int = 120) -> subprocess.CompletedProcess[str]:

scripts/bootstrap-switchover.sh

@@ -78,7 +78,7 @@ if $DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -q '^electrumx$'; then
         -e "DAEMON_URL=http://${RPC_USER}:${RPC_PASS}@bitcoin-knots:8332/" \
         -e COIN=Bitcoin -e DB_DIRECTORY=/data \
         -e "SERVICES=tcp://:50001,rpc://0.0.0.0:8000" \
-        "${ELECTRUMX_IMAGE:-146.59.87.168:3000/lfg2025/electrumx:v1.18.0}"
+        "${ELECTRUMX_IMAGE:-source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0}"
 fi
 
 # Mempool API
@@ -98,7 +98,7 @@ if $DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -q '^mempool-api$'; th
         -e "DATABASE_ENABLED=true" -e "DATABASE_HOST=archy-mempool-db" \
         -e "DATABASE_DATABASE=mempool" -e "DATABASE_USERNAME=mempool" \
         -e "DATABASE_PASSWORD=$(cat "$SECRETS_DIR/mempool-db-password" 2>/dev/null || echo mempoolpass)" \
-        "${MEMPOOL_API_IMAGE:-146.59.87.168:3000/lfg2025/mempool-api:v3.2.0}"
+        "${MEMPOOL_API_IMAGE:-source.archipelago-foundation.org/lfg2025/mempool-api:v3.2.0}"
 fi
 
 # Stop Tor tunnel if it was active

scripts/create-release-manifest.sh

@@ -18,7 +18,7 @@ RELEASE_DATE=""
 OUTPUT_FILE="manifest.json"
 BACKEND_BINARY=""
 FRONTEND_ARCHIVE=""
-BASE_URL="http://146.59.87.168:3000/lfg2025/archy/releases/download"
+BASE_URL="https://source.archipelago-foundation.org/lfg2025/archy/releases/download"
 
 usage() {
     echo "Usage: $0 --version VERSION [--date DATE] [--output FILE]"

scripts/create-release.sh

@@ -293,4 +293,4 @@ echo "  2. Publish commits, tag, artifacts, and verify download URLs:"
 echo "       scripts/publish-release-assets.sh ${VERSION} gitea-vps2"
 echo "  3. Verify manifest is live on both mirrors:"
 echo "       curl -fsS http://localhost:3000/lfg2025/archy/raw/branch/main/releases/manifest.json"
-echo "       curl -fsS http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json"
+echo "       curl -fsS https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/releases/manifest.json"

scripts/deploy-bitcoin-knots.sh

@@ -74,7 +74,7 @@ mkdir -p "$BUILD_DIR"
 
 # Create Dockerfile
 cat > "$BUILD_DIR/Dockerfile" << 'EOF'
-FROM ${NGINX_ALPINE_IMAGE:-146.59.87.168:3000/lfg2025/nginx:1.29.6-alpine}
+FROM ${NGINX_ALPINE_IMAGE:-source.archipelago-foundation.org/lfg2025/nginx:1.29.6-alpine}
 
 # Copy the static UI
 COPY index.html /usr/share/nginx/html/

scripts/dev-container-test.sh

@@ -151,7 +151,7 @@ run_smoke_tests() {
 
     # Test 3: Install a lightweight container (filebrowser — small, fast, no deps)
     TESTS=$((TESTS + 1))
-    local install_img="146.59.87.168:3000/lfg2025/filebrowser:v2.27.0"
+    local install_img="source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0"
     # Check if already installed
     local fb_state
     fb_state=$(ssh $SSH_OPTS "$SSH_HOST" "podman inspect filebrowser --format '{{.State.Status}}' 2>/dev/null || echo 'none'")

scripts/first-boot-containers.sh

@@ -9,7 +9,7 @@
 #
 # Image versions: sourced from /opt/archipelago/image-versions.sh (single source of truth).
 # All container image references use the $*_IMAGE variables defined there.
-# Images pull from the Archipelago app registry (146.59.87.168:3000/lfg2025/).
+# Images pull from the Archipelago app registry (source.archipelago-foundation.org/lfg2025/).
 #
 # --- PLANNED REFACTOR (post-beta) ---
 # This script is ~995 lines and should be split into a modular library.

scripts/generate-app-catalog.sh

@@ -172,7 +172,7 @@ if os.environ.get("EMBED_MANIFESTS") and apps_dir:
 # image.sh (Phase 0) publishes more tagged images, e.g.:
 #   {"version": "30.0", "image": f"{REGISTRY}/bitcoin:30.0"},
 #   {"version": "27.2", "image": f"{REGISTRY}/bitcoin:27.2", "deprecated": True, "eol": "2026-12-31"},
-REGISTRY = os.environ.get("ARCHY_REGISTRY", "146.59.87.168:3000/lfg2025")
+REGISTRY = os.environ.get("ARCHY_REGISTRY", "source.archipelago-foundation.org/lfg2025")
 VERSIONS = {
     # Curated Core set (latest patch per major, current → 25). Images built +
     # verified (SHA-256 + OpenPGP, fail-closed) and pushed by

scripts/image-versions.sh

@@ -5,12 +5,12 @@
 # Usage: source /opt/archipelago/image-versions.sh 2>/dev/null || true
 #        source "$(dirname "$0")/image-versions.sh" 2>/dev/null || true
 #
-# Tags MUST match what's actually in the registry at 146.59.87.168:3000/lfg2025/
-# Run: podman images --format '{{.Repository}}:{{.Tag}}' | grep '146.59.87.168:3000' | sort
+# Tags MUST match what's actually in the registry at source.archipelago-foundation.org/lfg2025/
+# Run: podman images --format '{{.Repository}}:{{.Tag}}' | grep 'source.archipelago-foundation.org' | sort
 # to verify against the registry.
 
 # Archipelago app registries (primary + fallback)
-ARCHY_REGISTRY="146.59.87.168:3000/lfg2025"
+ARCHY_REGISTRY="source.archipelago-foundation.org/lfg2025"
 # No fallback registry: the old tx1138 registry host was retired (2026-06-13); empty disables the fallback path.
 ARCHY_REGISTRY_FALLBACK=""
 

scripts/self-update.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Self-update: pull latest code from the OVH Gitea (146.59.87.168:3000) and apply
+# Self-update: pull latest code from the OVH Gitea (source.archipelago-foundation.org) and apply
 # Designed to run on installed Archipelago nodes (as archipelago user)
 #
 # Usage:
@@ -8,7 +8,7 @@
 #   ./self-update.sh --force      # Apply even if already up to date
 #
 # The script:
-#   1. Pulls latest code from origin (146.59.87.168:3000)
+#   1. Pulls latest code from origin (source.archipelago-foundation.org)
 #   2. Builds the Rust backend (release mode)
 #   3. Builds the Vue frontend (production mode)
 #   4. Installs the new binary and web UI
@@ -69,7 +69,7 @@ done
 # Ensure repo exists
 if [ ! -d "$REPO_DIR/.git" ]; then
     err "Repo not found at $REPO_DIR"
-    err "Clone it first: git clone http://146.59.87.168:3000/lfg2025/archy ~/archy"
+    err "Clone it first: git clone https://source.archipelago-foundation.org/lfg2025/archy ~/archy"
     exit 1
 fi
 

scripts/validate-app-manifest.sh

@@ -137,7 +137,7 @@ fi
 
 if [[ -n "$IMAGE" ]]; then
     TRUSTED=false
-    for reg in "docker.io" "ghcr.io" "quay.io" "registry.hub.docker.com" "146.59.87.168:3000" "localhost/"; do
+    for reg in "docker.io" "ghcr.io" "quay.io" "registry.hub.docker.com" "source.archipelago-foundation.org" "localhost/"; do
         if [[ "$IMAGE" == *"$reg"* ]]; then
             TRUSTED=true
             break