feat: botfights, discover, mobile gamepad, content handler, package config updates

Miscellaneous improvements: botfights manifest, discover page curated apps, mobile gamepad enhancements, content HTTP handler, package install config updates, health monitor tweaks, shared content UI, container specs and image version updates. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-11 23:11:41 -04:00
parent 24f122f35a
commit bb14490fb7
23 changed files with 782 additions and 75 deletions
@@ -1,6 +1,7 @@
 use super::RpcHandler;
 use crate::content_server::{self, AccessControl, Availability, ContentItem};
 use crate::network::dwn_store::DwnStore;
+use crate::wallet::ecash;
 use anyhow::{Context, Result};
 use tracing::debug;

@@ -313,4 +314,156 @@ impl RpcHandler {

        Ok(body)
    }
+
+    /// Download paid content from a peer: mint ecash token, send with request.
+    pub(super) async fn handle_content_download_peer_paid(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let params = params.ok_or_else(|| anyhow::anyhow!("Missing params"))?;
+        let onion = params
+            .get("onion")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("Missing onion address"))?;
+        let content_id = params
+            .get("content_id")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("Missing content_id"))?;
+        let price_sats = params
+            .get("price_sats")
+            .and_then(|v| v.as_u64())
+            .ok_or_else(|| anyhow::anyhow!("Missing price_sats"))?;
+
+        if price_sats == 0 {
+            return Err(anyhow::anyhow!("price_sats must be > 0"));
+        }
+        if !is_valid_v3_onion(onion) {
+            return Err(anyhow::anyhow!("Invalid v3 onion address"));
+        }
+
+        // Mint ecash payment token
+        let token_str = ecash::send_token(&self.config.data_dir, price_sats)
+            .await
+            .context("Failed to create ecash payment token — check wallet balance")?;
+
+        let socks_proxy = reqwest::Proxy::all(crate::constants::TOR_SOCKS_PROXY)
+            .context("Failed to create SOCKS proxy")?;
+
+        let client = reqwest::Client::builder()
+            .proxy(socks_proxy)
+            .timeout(std::time::Duration::from_secs(120))
+            .build()
+            .context("Failed to build Tor HTTP client")?;
+
+        let (data, _) = self.state_manager.get_snapshot().await;
+        let local_did = crate::identity::did_key_from_pubkey_hex(&data.server_info.pubkey)?;
+
+        let url = format!("http://{}/content/{}", onion, content_id);
+        let response = client
+            .get(&url)
+            .header("X-Federation-DID", &local_did)
+            .header("X-Payment-Token", &token_str)
+            .send()
+            .await
+            .context("Failed to connect to peer over Tor")?;
+
+        if response.status() == reqwest::StatusCode::PAYMENT_REQUIRED {
+            // Payment was rejected — token is spent but content not received
+            return Err(anyhow::anyhow!(
+                "Payment rejected by peer — token may have been insufficient or invalid"
+            ));
+        }
+
+        if !response.status().is_success() {
+            return Err(anyhow::anyhow!("Peer returned: {}", response.status()));
+        }
+
+        let bytes = response
+            .bytes()
+            .await
+            .context("Failed to read response body")?;
+
+        use base64::Engine;
+        let encoded = base64::engine::general_purpose::STANDARD.encode(&bytes);
+
+        Ok(serde_json::json!({
+            "data": encoded,
+            "size": bytes.len(),
+            "paid_sats": price_sats,
+        }))
+    }
+
+    /// Fetch a preview of paid content from a peer (no payment required).
+    pub(super) async fn handle_content_preview_peer(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let params = params.ok_or_else(|| anyhow::anyhow!("Missing params"))?;
+        let onion = params
+            .get("onion")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("Missing onion address"))?;
+        let content_id = params
+            .get("content_id")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("Missing content_id"))?;
+
+        if !is_valid_v3_onion(onion) {
+            return Err(anyhow::anyhow!("Invalid v3 onion address"));
+        }
+
+        let socks_proxy = reqwest::Proxy::all(crate::constants::TOR_SOCKS_PROXY)
+            .context("Failed to create SOCKS proxy")?;
+
+        let client = reqwest::Client::builder()
+            .proxy(socks_proxy)
+            .timeout(std::time::Duration::from_secs(30))
+            .build()
+            .context("Failed to build Tor HTTP client")?;
+
+        let url = format!("http://{}/content/{}/preview", onion, content_id);
+        debug!("Fetching content preview from {}", url);
+
+        let response = client
+            .get(&url)
+            .send()
+            .await
+            .context("Failed to connect to peer for preview")?;
+
+        if !response.status().is_success() {
+            return Err(anyhow::anyhow!(
+                "Peer returned error for preview: {}",
+                response.status()
+            ));
+        }
+
+        let is_preview = response
+            .headers()
+            .get("X-Content-Preview")
+            .and_then(|v| v.to_str().ok())
+            .unwrap_or("")
+            .to_string();
+
+        let content_type = response
+            .headers()
+            .get("content-type")
+            .and_then(|v| v.to_str().ok())
+            .unwrap_or("application/octet-stream")
+            .to_string();
+
+        let bytes = response
+            .bytes()
+            .await
+            .context("Failed to read preview response")?;
+
+        use base64::Engine;
+        let encoded = base64::engine::general_purpose::STANDARD.encode(&bytes);
+
+        Ok(serde_json::json!({
+            "data": encoded,
+            "size": bytes.len(),
+            "content_type": content_type,
+            "preview_mode": is_preview,
+        }))
+    }
 }
@@ -218,6 +218,11 @@ pub(super) fn get_health_check_args(app_id: &str, _rpc_pass: &str) -> Vec<String
            "60s",
            "3",
        ),
+        "fedimint-gateway" => (
+            "curl -sf http://localhost:8176/ || exit 1",
+            "60s",
+            "3",
+        ),
        "nostr-rs-relay" | "nostr-relay" => {
            ("curl -sf http://localhost:8080/ || exit 1", "30s", "3")
        }
@@ -754,37 +759,43 @@ pub(super) async fn get_app_config(
            Some(vec![
                "--data-dir".to_string(),
                "/data".to_string(),
-                format!("--bitcoind-url=http://{}:{}@host.containers.internal:8332", rpc_user, rpc_pass),
-            ]),
-        ),
-        "fedimint-gateway" => (
-            vec!["8176:8176".to_string(), "9737:9737".to_string()],
-            vec!["/var/lib/archipelago/fedimint-gateway:/data".to_string()],
-            vec![],
-            None,
-            Some(vec![
-                "gatewayd".to_string(),
-                "--data-dir".to_string(),
-                "/data".to_string(),
-                "--listen".to_string(),
-                "0.0.0.0:8176".to_string(),
-                "--bcrypt-password-hash".to_string(),
-                "$2y$10$t9YjjxkiktrlYvjajB/zgOMDnSNVg4HqrbDqh47u7Jf42whNdxNqC".to_string(),
-                "--network".to_string(),
-                "bitcoin".to_string(),
-                "--bitcoind-url".to_string(),
-                format!("http://{}:8332", host_ip),
-                "--bitcoind-username".to_string(),
-                rpc_user.to_string(),
-                "--bitcoind-password".to_string(),
-                rpc_pass.to_string(),
-                "ldk".to_string(),
-                "--ldk-lightning-port".to_string(),
-                "9737".to_string(),
-                "--ldk-alias".to_string(),
-                "archipelago-gateway".to_string(),
+                format!("--bitcoind-url=http://{}:{}@{}:8332", rpc_user, rpc_pass, host_ip),
            ]),
        ),
+        "fedimint-gateway" => {
+            let fedi_hash = read_secret(
+                "fedimint-gateway-hash",
+                "$2y$10$t9YjjxkiktrlYvjajB/zgOMDnSNVg4HqrbDqh47u7Jf42whNdxNqC",
+            );
+            (
+                vec!["8176:8176".to_string(), "9737:9737".to_string()],
+                vec!["/var/lib/archipelago/fedimint-gateway:/data".to_string()],
+                vec![],
+                None,
+                Some(vec![
+                    "gatewayd".to_string(),
+                    "--data-dir".to_string(),
+                    "/data".to_string(),
+                    "--listen".to_string(),
+                    "0.0.0.0:8176".to_string(),
+                    "--bcrypt-password-hash".to_string(),
+                    fedi_hash,
+                    "--network".to_string(),
+                    "bitcoin".to_string(),
+                    "--bitcoind-url".to_string(),
+                    format!("http://{}:8332", host_ip),
+                    "--bitcoind-username".to_string(),
+                    rpc_user.to_string(),
+                    "--bitcoind-password".to_string(),
+                    rpc_pass.to_string(),
+                    "ldk".to_string(),
+                    "--ldk-lightning-port".to_string(),
+                    "9737".to_string(),
+                    "--ldk-alias".to_string(),
+                    "archipelago-gateway".to_string(),
+                ]),
+            )
+        }
        "indeedhub" => (
            vec!["7778:7777".to_string()],
            vec![],
@@ -567,8 +567,18 @@ impl RpcHandler {
        debug!("Pulling image: {}", docker_image);
        self.set_install_progress(package_id, 0, 0).await;

+        // Set TMPDIR to user-writable location — rootless podman's user namespace
+        // makes /var/tmp read-only, which causes `podman pull` to fail with
+        // "mkdir /var/tmp/container_images_storage...: read-only file system"
+        let user_tmp = format!(
+            "{}/.local/share/containers/tmp",
+            std::env::var("HOME").unwrap_or_else(|_| "/home/archipelago".to_string())
+        );
+        let _ = std::fs::create_dir_all(&user_tmp);
+
        let mut child = tokio::process::Command::new("podman")
            .args(["pull", docker_image])
+            .env("TMPDIR", &user_tmp)
            .stdout(std::process::Stdio::piped())
            .stderr(std::process::Stdio::piped())
            .spawn()