backend: harden rootless app lifecycle orchestration

core/archipelago/src/api/rpc/analytics.rs

@@ -189,6 +189,27 @@ impl RpcHandler {
             .map(|f| f as u64)
             .unwrap_or(0);
 
+        let latest = self.metrics_store.latest().await;
+        let (cpu_pct, mem_pct, disk_pct): (f64, f64, f64) = latest
+            .map(|s| {
+                let mem_total = s.system.mem_total_bytes as f64;
+                let disk_total = s.system.disk_total_bytes as f64;
+                (
+                    s.system.cpu_percent,
+                    if mem_total > 0.0 {
+                        (s.system.mem_used_bytes as f64 / mem_total) * 100.0
+                    } else {
+                        0.0
+                    },
+                    if disk_total > 0.0 {
+                        (s.system.disk_used_bytes as f64 / disk_total) * 100.0
+                    } else {
+                        0.0
+                    },
+                )
+            })
+            .unwrap_or((0.0, 0.0, 0.0));
+
         // Recent alerts from metrics store
         let recent_alerts: Vec<serde_json::Value> = self
             .metrics_store
@@ -210,6 +231,9 @@ impl RpcHandler {
             "uptime_secs": uptime_secs,
             "cpu_cores": cpu_cores,
             "ram_mb": total_ram_mb,
+            "cpu_pct": (cpu_pct * 10.0).round() / 10.0,
+            "mem_pct": (mem_pct * 10.0).round() / 10.0,
+            "disk_pct": (disk_pct * 10.0).round() / 10.0,
             "containers": containers,
             "container_count": data.package_data.len(),
             "running_count": data.package_data.values()

core/archipelago/src/api/rpc/auth.rs

@@ -79,7 +79,8 @@ impl RpcHandler {
             .and_then(|v| v.as_bool())
             .unwrap_or(true);
 
-        self.auth_manager
+        let outcome = self
+            .auth_manager
             .change_password(current_password, new_password, also_change_ssh)
             .await?;
 
@@ -88,7 +89,12 @@ impl RpcHandler {
             self.session_store.invalidate_all_except(token).await;
         }
 
-        Ok(serde_json::json!({ "success": true, "session_rotated": true }))
+        Ok(serde_json::json!({
+            "success": true,
+            "session_rotated": true,
+            "ssh_updated": outcome.ssh_updated,
+            "ssh_error": outcome.ssh_error,
+        }))
     }
 
     pub(super) async fn handle_auth_is_setup(&self) -> Result<serde_json::Value> {

core/archipelago/src/api/rpc/bitcoin_relay.rs

@@ -0,0 +1,900 @@
+use super::RpcHandler;
+use crate::container::docker_packages;
+use crate::data_model::{Notification, NotificationLevel};
+use crate::{bitcoin_status, identity, peers};
+use anyhow::{Context, Result};
+use base64::{engine::general_purpose::STANDARD as BASE64, Engine as _};
+use hmac::{Hmac, Mac};
+use rand::RngCore;
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+use sha2::Sha256;
+use std::path::{Path, PathBuf};
+use tokio::fs;
+
+const RELAY_DIR: &str = "bitcoin-relay";
+const RELAY_STATE_FILE: &str = "state.json";
+const TXRELAY_USER: &str = "txrelay";
+const TXRELAY_PASSWORD_FILE: &str = "bitcoin-rpc-txrelay-password";
+const TXRELAY_RPCAUTH_FILE: &str = "bitcoin-rpc-txrelay-rpcauth";
+const TXRELAY_CLIENT_ENV_FILE: &str = "bitcoin-rpc-txrelay-client.env";
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+struct BitcoinRelayState {
+    settings: BitcoinRelaySettings,
+    requests: Vec<BitcoinRelayRequest>,
+    updated_at: Option<String>,
+}
+
+impl Default for BitcoinRelayState {
+    fn default() -> Self {
+        Self {
+            settings: BitcoinRelaySettings::default(),
+            requests: Vec::new(),
+            updated_at: None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+struct BitcoinRelaySettings {
+    enabled_for_peers: bool,
+    allow_peer_requests: bool,
+    allow_http: bool,
+    allow_https: bool,
+    allow_tor: bool,
+    selected_peer_pubkey: Option<String>,
+    http_endpoint: Option<String>,
+    https_endpoint: Option<String>,
+    tor_endpoint: Option<String>,
+}
+
+impl Default for BitcoinRelaySettings {
+    fn default() -> Self {
+        Self {
+            enabled_for_peers: false,
+            allow_peer_requests: false,
+            allow_http: false,
+            allow_https: true,
+            allow_tor: false,
+            selected_peer_pubkey: None,
+            http_endpoint: None,
+            https_endpoint: None,
+            tor_endpoint: None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct BitcoinRelayRequest {
+    id: String,
+    direction: RelayRequestDirection,
+    status: RelayRequestStatus,
+    peer_pubkey: String,
+    peer_onion: String,
+    peer_name: Option<String>,
+    message: Option<String>,
+    approved_endpoint: Option<String>,
+    credential_secret_path: Option<String>,
+    created_at: String,
+    updated_at: String,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+enum RelayRequestDirection {
+    Incoming,
+    Outbound,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+enum RelayRequestStatus {
+    Pending,
+    Approved,
+    Rejected,
+}
+
+#[derive(Debug, Serialize)]
+struct TrustedRelayPeer {
+    pubkey: String,
+    onion: String,
+    name: Option<String>,
+    relay_approved: bool,
+}
+
+#[derive(Debug, Clone)]
+struct TxRelayCredentials {
+    username: String,
+    password: String,
+}
+
+impl RpcHandler {
+    pub(super) async fn handle_bitcoin_relay_status(&self) -> Result<serde_json::Value> {
+        let mut state = load_relay_state(&self.config.data_dir).await?;
+        hydrate_tor_endpoint(&self.config.data_dir, &mut state).await;
+        let known_peers = peers::load_peers(&self.config.data_dir)
+            .await
+            .unwrap_or_default();
+        let trusted_nodes = trusted_relay_peers(&known_peers, &state);
+        let local_node = local_sync_status().await;
+        let credential_status = txrelay_credential_status(&self.config.data_dir).await;
+
+        Ok(json!({
+            "settings": state.settings,
+            "trusted_nodes": trusted_nodes,
+            "requests": state.requests,
+            "local_node": local_node,
+            "credentials": credential_status,
+        }))
+    }
+
+    pub(super) async fn handle_bitcoin_relay_update_settings(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let params = params.unwrap_or_default();
+        let mut state = load_relay_state(&self.config.data_dir).await?;
+        let known_peers = peers::load_peers(&self.config.data_dir)
+            .await
+            .unwrap_or_default();
+
+        update_bool(
+            &params,
+            "enabled_for_peers",
+            &mut state.settings.enabled_for_peers,
+        );
+        update_bool(
+            &params,
+            "allow_peer_requests",
+            &mut state.settings.allow_peer_requests,
+        );
+        update_bool(&params, "allow_http", &mut state.settings.allow_http);
+        update_bool(&params, "allow_https", &mut state.settings.allow_https);
+        update_bool(&params, "allow_tor", &mut state.settings.allow_tor);
+
+        update_endpoint(&params, "http_endpoint", &mut state.settings.http_endpoint)?;
+        update_endpoint(
+            &params,
+            "https_endpoint",
+            &mut state.settings.https_endpoint,
+        )?;
+        update_endpoint(&params, "tor_endpoint", &mut state.settings.tor_endpoint)?;
+
+        if state.settings.enabled_for_peers {
+            ensure_txrelay_credentials(&self.config.data_dir).await?;
+        }
+
+        if params.get("selected_peer_pubkey").is_some() {
+            let selected = params
+                .get("selected_peer_pubkey")
+                .and_then(|v| v.as_str())
+                .map(str::trim)
+                .filter(|s| !s.is_empty());
+            if let Some(pubkey) = selected {
+                if !known_peers.iter().any(|p| p.pubkey == pubkey) {
+                    anyhow::bail!("Selected relay peer is not in trusted nodes");
+                }
+                state.settings.selected_peer_pubkey = Some(pubkey.to_string());
+            } else {
+                state.settings.selected_peer_pubkey = None;
+            }
+        }
+
+        state.updated_at = Some(now());
+        save_relay_state(&self.config.data_dir, &state).await?;
+        self.notify(
+            "Bitcoin relay settings updated",
+            "Transaction relay sharing preferences were saved.",
+        )
+        .await;
+        self.handle_bitcoin_relay_status().await
+    }
+
+    pub(super) async fn handle_bitcoin_relay_request_peer(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let params = params.unwrap_or_default();
+        let peer_pubkey = params
+            .get("peer_pubkey")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("Missing required parameter: peer_pubkey"))?;
+        let message = params
+            .get("message")
+            .and_then(|v| v.as_str())
+            .map(sanitize_optional_text)
+            .transpose()?;
+        let peer = peers::load_peers(&self.config.data_dir)
+            .await
+            .unwrap_or_default()
+            .into_iter()
+            .find(|p| p.pubkey == peer_pubkey)
+            .ok_or_else(|| anyhow::anyhow!("Peer is not in trusted nodes"))?;
+
+        let mut state = load_relay_state(&self.config.data_dir).await?;
+        let existing = state.requests.iter_mut().find(|r| {
+            r.direction == RelayRequestDirection::Outbound
+                && r.peer_pubkey == peer.pubkey
+                && r.status == RelayRequestStatus::Pending
+        });
+        let request_id = if let Some(req) = existing {
+            req.message = message.clone();
+            req.updated_at = now();
+            req.id.clone()
+        } else {
+            let timestamp = now();
+            let req = BitcoinRelayRequest {
+                id: uuid::Uuid::new_v4().to_string(),
+                direction: RelayRequestDirection::Outbound,
+                status: RelayRequestStatus::Pending,
+                peer_pubkey: peer.pubkey.clone(),
+                peer_onion: peer.onion.clone(),
+                peer_name: peer.name.clone(),
+                message: message.clone(),
+                approved_endpoint: None,
+                credential_secret_path: None,
+                created_at: timestamp.clone(),
+                updated_at: timestamp,
+            };
+            let id = req.id.clone();
+            state.requests.push(req);
+            id
+        };
+        state.updated_at = Some(now());
+        save_relay_state(&self.config.data_dir, &state).await?;
+
+        if let Err(e) = self
+            .send_relay_peer_message(
+                &peer,
+                json!({
+                    "type": "bitcoin_relay_request",
+                    "request_id": request_id,
+                    "message": message,
+                }),
+            )
+            .await
+        {
+            tracing::warn!(peer = %peer.onion, error = %e, "Failed to send Bitcoin relay request");
+        }
+
+        self.notify(
+            "Bitcoin relay request sent",
+            "A trusted peer was asked to approve transaction relay access.",
+        )
+        .await;
+        Ok(json!({ "ok": true, "request_id": request_id }))
+    }
+
+    pub(super) async fn handle_bitcoin_relay_approve_request(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        self.update_relay_request_status(params, RelayRequestStatus::Approved)
+            .await
+    }
+
+    pub(super) async fn handle_bitcoin_relay_reject_request(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        self.update_relay_request_status(params, RelayRequestStatus::Rejected)
+            .await
+    }
+
+    pub(super) async fn handle_bitcoin_relay_create_tor_service(
+        &self,
+    ) -> Result<serde_json::Value> {
+        let params = json!({
+            "name": "bitcoin-rpc",
+            "local_port": 80,
+            "remote_port": 80,
+        });
+        let created = match self.handle_tor_create_service(Some(params)).await {
+            Ok(v) => v,
+            Err(e) if e.to_string().contains("already exists") => {
+                self.handle_tor_get_onion_address(Some(json!({ "name": "bitcoin-rpc" })))
+                    .await?
+            }
+            Err(e) => return Err(e),
+        };
+
+        let onion = created
+            .get("onion_address")
+            .and_then(|v| v.as_str())
+            .map(|s| s.trim().to_string())
+            .filter(|s| !s.is_empty());
+        if let Some(onion) = onion {
+            let mut state = load_relay_state(&self.config.data_dir).await?;
+            state.settings.allow_tor = true;
+            state.settings.tor_endpoint = Some(format!("http://{onion}/"));
+            state.updated_at = Some(now());
+            save_relay_state(&self.config.data_dir, &state).await?;
+        }
+
+        self.notify(
+            "Bitcoin relay Tor service enabled",
+            "A Tor endpoint was created for Bitcoin transaction relay access.",
+        )
+        .await;
+        Ok(created)
+    }
+
+    async fn update_relay_request_status(
+        &self,
+        params: Option<serde_json::Value>,
+        status: RelayRequestStatus,
+    ) -> Result<serde_json::Value> {
+        let params = params.unwrap_or_default();
+        let request_id = params
+            .get("id")
+            .or_else(|| params.get("request_id"))
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("Missing required parameter: id"))?;
+        let mut state = load_relay_state(&self.config.data_dir).await?;
+        let serving_endpoint = if status == RelayRequestStatus::Approved {
+            preferred_endpoint(&state.settings)
+        } else {
+            None
+        };
+        let request_direction = state
+            .requests
+            .iter()
+            .find(|r| r.id == request_id)
+            .ok_or_else(|| anyhow::anyhow!("Request not found: {}", request_id))?
+            .direction;
+        if status == RelayRequestStatus::Approved
+            && request_direction == RelayRequestDirection::Incoming
+            && serving_endpoint.is_none()
+        {
+            anyhow::bail!(
+                "Configure an HTTP, HTTPS, or Tor relay endpoint before approving access"
+            );
+        }
+        let credentials = if status == RelayRequestStatus::Approved {
+            Some(ensure_txrelay_credentials(&self.config.data_dir).await?)
+        } else {
+            None
+        };
+        let (peer_pubkey, peer_onion, peer_name, direction) = {
+            let req = state
+                .requests
+                .iter_mut()
+                .find(|r| r.id == request_id)
+                .ok_or_else(|| anyhow::anyhow!("Request not found: {}", request_id))?;
+            req.status = status;
+            req.updated_at = now();
+            if let Some(endpoint) = &serving_endpoint {
+                req.approved_endpoint = Some(endpoint.clone());
+            }
+            (
+                req.peer_pubkey.clone(),
+                req.peer_onion.clone(),
+                req.peer_name.clone(),
+                req.direction,
+            )
+        };
+        let peer = peers::load_peers(&self.config.data_dir)
+            .await
+            .unwrap_or_default()
+            .into_iter()
+            .find(|p| p.pubkey == peer_pubkey);
+        let peer_name = peer_name.unwrap_or_else(|| peer_onion.clone());
+        state.updated_at = Some(now());
+        save_relay_state(&self.config.data_dir, &state).await?;
+
+        if let Some(peer) = peer {
+            let message_type = match status {
+                RelayRequestStatus::Approved => "bitcoin_relay_approved",
+                RelayRequestStatus::Rejected => "bitcoin_relay_rejected",
+                RelayRequestStatus::Pending => "bitcoin_relay_pending",
+            };
+            if let Err(e) = self
+                .send_relay_peer_message(
+                    &peer,
+                    relay_response_payload(
+                        message_type,
+                        request_id,
+                        direction,
+                        serving_endpoint.as_deref(),
+                        credentials.as_ref(),
+                    ),
+                )
+                .await
+            {
+                tracing::warn!(peer = %peer.onion, error = %e, "Failed to send Bitcoin relay response");
+            }
+        }
+
+        let title = match status {
+            RelayRequestStatus::Approved => "Bitcoin relay request approved",
+            RelayRequestStatus::Rejected => "Bitcoin relay request rejected",
+            RelayRequestStatus::Pending => "Bitcoin relay request updated",
+        };
+        self.notify(
+            title,
+            &format!("Relay access request for {peer_name} was updated."),
+        )
+        .await;
+        Ok(json!({ "ok": true, "request_id": request_id }))
+    }
+
+    async fn send_relay_peer_message(
+        &self,
+        peer: &peers::KnownPeer,
+        mut payload: serde_json::Value,
+    ) -> Result<()> {
+        let (data, _) = self.state_manager.get_snapshot().await;
+        let my_pubkey = data.server_info.pubkey.clone();
+        let my_did = identity::did_key_from_pubkey_hex(&my_pubkey).ok();
+        let my_onion = docker_packages::read_tor_address("archipelago")
+            .await
+            .unwrap_or_default();
+        payload["from_did"] = my_did.map(serde_json::Value::String).unwrap_or_default();
+        payload["from_pubkey"] = serde_json::Value::String(my_pubkey.clone());
+        payload["from_onion"] = serde_json::Value::String(my_onion);
+        payload["from_name"] = data
+            .server_info
+            .name
+            .clone()
+            .map(serde_json::Value::String)
+            .unwrap_or_default();
+
+        let to_fips_npub =
+            crate::federation::fips_npub_for_onion(&self.config.data_dir, &peer.onion).await;
+        let identity_dir = self.config.data_dir.join("identity");
+        let signing_key = crate::identity::NodeIdentity::load_or_create(&identity_dir)
+            .await
+            .ok();
+        crate::node_message::send_to_peer(
+            &peer.onion,
+            to_fips_npub.as_deref(),
+            &my_pubkey,
+            &payload.to_string(),
+            signing_key.as_ref().map(|i| i.signing_key()),
+            Some(&peer.pubkey),
+            data.server_info.name.as_deref(),
+        )
+        .await
+    }
+
+    async fn notify(&self, title: &str, message: &str) {
+        let (mut data, _) = self.state_manager.get_snapshot().await;
+        data.notifications.push(Notification {
+            id: format!("bitcoin-relay-{}", uuid::Uuid::new_v4()),
+            level: NotificationLevel::Info,
+            title: title.to_string(),
+            message: message.to_string(),
+            timestamp: now(),
+            app_id: Some("bitcoin-knots".to_string()),
+        });
+        let len = data.notifications.len();
+        if len > 30 {
+            data.notifications.drain(0..len - 30);
+        }
+        self.state_manager.update_data(data).await;
+    }
+}
+
+pub(crate) async fn record_incoming_relay_message(
+    data_dir: &Path,
+    from_pubkey: &str,
+    from_name: Option<&str>,
+    payload: &serde_json::Value,
+) -> Result<Option<&'static str>> {
+    let msg_type = payload.get("type").and_then(|v| v.as_str()).unwrap_or("");
+    match msg_type {
+        "bitcoin_relay_request" => {
+            let from_onion = payload
+                .get("from_onion")
+                .and_then(|v| v.as_str())
+                .unwrap_or_default()
+                .to_string();
+            let message = payload
+                .get("message")
+                .and_then(|v| v.as_str())
+                .map(sanitize_optional_text)
+                .transpose()?;
+            let remote_request_id = payload
+                .get("request_id")
+                .and_then(|v| v.as_str())
+                .unwrap_or_default();
+            let mut state = load_relay_state(data_dir).await?;
+            if !state.settings.allow_peer_requests {
+                return Ok(Some("bitcoin_relay_request_disabled"));
+            }
+            if !state.requests.iter().any(|r| {
+                r.direction == RelayRequestDirection::Incoming
+                    && r.peer_pubkey == from_pubkey
+                    && r.status == RelayRequestStatus::Pending
+            }) {
+                let timestamp = now();
+                state.requests.push(BitcoinRelayRequest {
+                    id: if remote_request_id.is_empty() {
+                        uuid::Uuid::new_v4().to_string()
+                    } else {
+                        remote_request_id.to_string()
+                    },
+                    direction: RelayRequestDirection::Incoming,
+                    status: RelayRequestStatus::Pending,
+                    peer_pubkey: from_pubkey.to_string(),
+                    peer_onion: from_onion,
+                    peer_name: from_name.map(String::from),
+                    message,
+                    approved_endpoint: None,
+                    credential_secret_path: None,
+                    created_at: timestamp.clone(),
+                    updated_at: timestamp,
+                });
+                state.updated_at = Some(now());
+                save_relay_state(data_dir, &state).await?;
+            }
+            Ok(Some("bitcoin_relay_request"))
+        }
+        "bitcoin_relay_approved" | "bitcoin_relay_rejected" => {
+            let request_id = payload.get("request_id").and_then(|v| v.as_str());
+            let mut state = load_relay_state(data_dir).await?;
+            let status = if msg_type == "bitcoin_relay_approved" {
+                RelayRequestStatus::Approved
+            } else {
+                RelayRequestStatus::Rejected
+            };
+            let approved_access = if status == RelayRequestStatus::Approved {
+                save_peer_relay_access(data_dir, from_pubkey, payload).await?
+            } else {
+                None
+            };
+            if let Some(req) = state.requests.iter_mut().find(|r| {
+                r.direction == RelayRequestDirection::Outbound
+                    && r.peer_pubkey == from_pubkey
+                    && request_id.map(|id| id == r.id).unwrap_or(true)
+            }) {
+                req.status = status;
+                req.updated_at = now();
+                if let Some((endpoint, secret_path)) = approved_access {
+                    req.approved_endpoint = Some(endpoint);
+                    req.credential_secret_path = Some(secret_path);
+                }
+                state.updated_at = Some(now());
+                save_relay_state(data_dir, &state).await?;
+            }
+            Ok(Some(if msg_type == "bitcoin_relay_approved" {
+                "bitcoin_relay_approved"
+            } else {
+                "bitcoin_relay_rejected"
+            }))
+        }
+        _ => Ok(None),
+    }
+}
+
+fn trusted_relay_peers(
+    known_peers: &[peers::KnownPeer],
+    state: &BitcoinRelayState,
+) -> Vec<TrustedRelayPeer> {
+    known_peers
+        .iter()
+        .map(|peer| TrustedRelayPeer {
+            pubkey: peer.pubkey.clone(),
+            onion: peer.onion.clone(),
+            name: peer.name.clone(),
+            relay_approved: state.requests.iter().any(|req| {
+                req.peer_pubkey == peer.pubkey && req.status == RelayRequestStatus::Approved
+            }),
+        })
+        .collect()
+}
+
+async fn txrelay_credential_status(data_dir: &Path) -> serde_json::Value {
+    let (password_path, rpcauth_path, client_env_path) = txrelay_secret_paths(data_dir);
+    let password_available = fs::metadata(&password_path).await.is_ok();
+    let rpcauth_available = fs::metadata(&rpcauth_path).await.is_ok();
+    let client_env_available = fs::metadata(&client_env_path).await.is_ok();
+    json!({
+        "username": TXRELAY_USER,
+        "available": password_available && rpcauth_available && client_env_available,
+        "password_available": password_available,
+        "rpcauth_available": rpcauth_available,
+        "client_env_available": client_env_available,
+        "client_env_path": client_env_path.display().to_string(),
+        "restart_hint": "If this was just generated, restart Bitcoin Core/Knots so bitcoind loads the txrelay rpcauth whitelist.",
+    })
+}
+
+async fn ensure_txrelay_credentials(data_dir: &Path) -> Result<TxRelayCredentials> {
+    let (password_path, rpcauth_path, client_env_path) = txrelay_secret_paths(data_dir);
+    let password = match read_trimmed(&password_path).await {
+        Some(value) => value,
+        None => {
+            let generated = generate_random_password();
+            write_secret_file(&password_path, &generated).await?;
+            generated
+        }
+    };
+    let rpcauth = match read_trimmed(&rpcauth_path).await {
+        Some(value) => value,
+        None => {
+            let generated = generate_rpcauth(TXRELAY_USER, &password);
+            write_secret_file(&rpcauth_path, &generated).await?;
+            generated
+        }
+    };
+    let client_env = format!(
+        "BITCOIN_RPC_TXRELAY_USER={}\nBITCOIN_RPC_TXRELAY_PASSWORD={}\nBITCOIN_RPC_TXRELAY_RPCAUTH={}\n",
+        TXRELAY_USER, password, rpcauth
+    );
+    write_secret_file(&client_env_path, &client_env).await?;
+
+    Ok(TxRelayCredentials {
+        username: TXRELAY_USER.to_string(),
+        password,
+    })
+}
+
+fn txrelay_secret_paths(data_dir: &Path) -> (PathBuf, PathBuf, PathBuf) {
+    let secrets_dir = data_dir.join("secrets");
+    (
+        secrets_dir.join(TXRELAY_PASSWORD_FILE),
+        secrets_dir.join(TXRELAY_RPCAUTH_FILE),
+        secrets_dir.join(TXRELAY_CLIENT_ENV_FILE),
+    )
+}
+
+async fn read_trimmed(path: &Path) -> Option<String> {
+    fs::read_to_string(path)
+        .await
+        .ok()
+        .map(|s| s.trim().to_string())
+        .filter(|s| !s.is_empty())
+}
+
+async fn write_secret_file(path: &Path, contents: &str) -> Result<()> {
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent).await?;
+    }
+    fs::write(path, contents).await?;
+    set_private_permissions(path).await;
+    Ok(())
+}
+
+async fn set_private_permissions(path: &Path) {
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let _ = fs::set_permissions(path, std::fs::Permissions::from_mode(0o600)).await;
+    }
+}
+
+fn generate_random_password() -> String {
+    let mut bytes = [0u8; 32];
+    rand::rngs::OsRng.fill_bytes(&mut bytes);
+    BASE64.encode(bytes)
+}
+
+fn generate_rpcauth(username: &str, password: &str) -> String {
+    let mut salt_bytes = [0u8; 16];
+    rand::rngs::OsRng.fill_bytes(&mut salt_bytes);
+    let salt_hex = hex::encode(salt_bytes);
+    let mut mac =
+        Hmac::<Sha256>::new_from_slice(salt_hex.as_bytes()).expect("HMAC accepts any key length");
+    mac.update(password.as_bytes());
+    let hash_hex = hex::encode(mac.finalize().into_bytes());
+    format!("{username}:{salt_hex}${hash_hex}")
+}
+
+fn preferred_endpoint(settings: &BitcoinRelaySettings) -> Option<String> {
+    if settings.allow_https {
+        if let Some(endpoint) = settings.https_endpoint.clone() {
+            return Some(endpoint);
+        }
+    }
+    if settings.allow_tor {
+        if let Some(endpoint) = settings.tor_endpoint.clone() {
+            return Some(endpoint);
+        }
+    }
+    if settings.allow_http {
+        if let Some(endpoint) = settings.http_endpoint.clone() {
+            return Some(endpoint);
+        }
+    }
+    settings
+        .https_endpoint
+        .clone()
+        .or_else(|| settings.tor_endpoint.clone())
+        .or_else(|| settings.http_endpoint.clone())
+}
+
+fn relay_response_payload(
+    message_type: &str,
+    request_id: &str,
+    request_direction: RelayRequestDirection,
+    endpoint: Option<&str>,
+    credentials: Option<&TxRelayCredentials>,
+) -> serde_json::Value {
+    let mut payload = json!({
+        "type": message_type,
+        "request_id": request_id,
+    });
+    if message_type == "bitcoin_relay_approved"
+        && request_direction == RelayRequestDirection::Incoming
+    {
+        if let (Some(endpoint), Some(credentials)) = (endpoint, credentials) {
+            payload["relay_access"] = json!({
+                "endpoint": endpoint,
+                "username": &credentials.username,
+                "password": &credentials.password,
+            });
+        }
+    }
+    payload
+}
+
+async fn save_peer_relay_access(
+    data_dir: &Path,
+    from_pubkey: &str,
+    payload: &serde_json::Value,
+) -> Result<Option<(String, String)>> {
+    let Some(access) = payload.get("relay_access") else {
+        return Ok(None);
+    };
+    let endpoint = access
+        .get("endpoint")
+        .and_then(|v| v.as_str())
+        .map(validate_endpoint)
+        .transpose()?;
+    let username = access.get("username").and_then(|v| v.as_str());
+    let password = access.get("password").and_then(|v| v.as_str());
+    let (Some(endpoint), Some(username), Some(password)) = (endpoint, username, password) else {
+        return Ok(None);
+    };
+    validate_env_value(username)?;
+    validate_env_value(password)?;
+
+    let secret_path = data_dir.join("secrets").join(format!(
+        "bitcoin-relay-peer-{}.env",
+        safe_pubkey_fragment(from_pubkey)
+    ));
+    let contents = format!(
+        "BITCOIN_RELAY_PEER_PUBKEY={}\nBITCOIN_RELAY_ENDPOINT={}\nBITCOIN_RELAY_USERNAME={}\nBITCOIN_RELAY_PASSWORD={}\n",
+        from_pubkey, endpoint, username, password
+    );
+    write_secret_file(&secret_path, &contents).await?;
+    Ok(Some((endpoint, secret_path.display().to_string())))
+}
+
+fn validate_env_value(value: &str) -> Result<()> {
+    if value.is_empty() || value.len() > 1024 || value.contains('\n') || value.contains('\r') {
+        anyhow::bail!("Invalid relay credential value");
+    }
+    Ok(())
+}
+
+fn safe_pubkey_fragment(pubkey: &str) -> String {
+    let fragment = pubkey
+        .chars()
+        .filter(|c| c.is_ascii_hexdigit())
+        .take(24)
+        .collect::<String>();
+    if fragment.is_empty() {
+        "unknown".to_string()
+    } else {
+        fragment
+    }
+}
+
+async fn hydrate_tor_endpoint(data_dir: &Path, state: &mut BitcoinRelayState) {
+    if state.settings.tor_endpoint.is_some() {
+        return;
+    }
+    if let Some(onion) = docker_packages::read_tor_address("bitcoin-rpc").await {
+        let onion = onion.trim().trim_end_matches('/').to_string();
+        if !onion.is_empty() {
+            state.settings.tor_endpoint = Some(format!("http://{onion}/"));
+            let _ = save_relay_state(data_dir, state).await;
+        }
+    }
+}
+
+async fn local_sync_status() -> serde_json::Value {
+    let status = bitcoin_status::get_bitcoin_status().await;
+    let blockchain = status.blockchain_info.as_ref();
+    let blocks = blockchain
+        .and_then(|v| v.get("blocks"))
+        .and_then(|v| v.as_u64())
+        .unwrap_or(0);
+    let headers = blockchain
+        .and_then(|v| v.get("headers"))
+        .and_then(|v| v.as_u64())
+        .unwrap_or(0);
+    let initial_block_download = blockchain
+        .and_then(|v| v.get("initialblockdownload"))
+        .and_then(|v| v.as_bool())
+        .unwrap_or(true);
+    let synced =
+        status.ok && headers > 0 && blocks >= headers.saturating_sub(1) && !initial_block_download;
+
+    json!({
+        "synced": synced,
+        "blocks": blocks,
+        "headers": headers,
+        "chain": blockchain
+            .and_then(|v| v.get("chain"))
+            .and_then(|v| v.as_str())
+            .unwrap_or("unknown"),
+        "status_ok": status.ok,
+        "status_stale": status.stale,
+        "error": status.error,
+    })
+}
+
+async fn load_relay_state(data_dir: &Path) -> Result<BitcoinRelayState> {
+    let path = state_path(data_dir);
+    if !path.exists() {
+        return Ok(BitcoinRelayState::default());
+    }
+    let content = fs::read_to_string(&path)
+        .await
+        .with_context(|| format!("Failed to read {}", path.display()))?;
+    Ok(serde_json::from_str(&content).unwrap_or_default())
+}
+
+async fn save_relay_state(data_dir: &Path, state: &BitcoinRelayState) -> Result<()> {
+    let dir = data_dir.join(RELAY_DIR);
+    fs::create_dir_all(&dir).await?;
+    let content = serde_json::to_string_pretty(state)?;
+    fs::write(dir.join(RELAY_STATE_FILE), content).await?;
+    Ok(())
+}
+
+fn state_path(data_dir: &Path) -> PathBuf {
+    data_dir.join(RELAY_DIR).join(RELAY_STATE_FILE)
+}
+
+fn update_bool(params: &serde_json::Value, key: &str, target: &mut bool) {
+    if let Some(value) = params.get(key).and_then(|v| v.as_bool()) {
+        *target = value;
+    }
+}
+
+fn update_endpoint(
+    params: &serde_json::Value,
+    key: &str,
+    target: &mut Option<String>,
+) -> Result<()> {
+    if !params.get(key).is_some() {
+        return Ok(());
+    }
+    let endpoint = params
+        .get(key)
+        .and_then(|v| v.as_str())
+        .map(str::trim)
+        .filter(|s| !s.is_empty());
+    *target = endpoint.map(validate_endpoint).transpose()?;
+    Ok(())
+}
+
+fn validate_endpoint(endpoint: &str) -> Result<String> {
+    if endpoint.len() > 512 || endpoint.contains('\n') || endpoint.contains('\r') {
+        anyhow::bail!("Invalid endpoint");
+    }
+    let lower = endpoint.to_ascii_lowercase();
+    if !(lower.starts_with("http://") || lower.starts_with("https://")) {
+        anyhow::bail!("Endpoint must start with http:// or https://");
+    }
+    Ok(endpoint.to_string())
+}
+
+fn sanitize_optional_text(value: &str) -> Result<String> {
+    let value = value.trim();
+    if value.len() > 500 || value.contains('\0') {
+        anyhow::bail!("Invalid message");
+    }
+    Ok(value.to_string())
+}
+
+fn now() -> String {
+    chrono::Utc::now().to_rfc3339()
+}

core/archipelago/src/api/rpc/container.rs

@@ -4,8 +4,9 @@ use super::RpcHandler;
 use anyhow::{Context, Result};
 use std::time::Duration;
 
-const PODMAN_INSPECT_TIMEOUT: Duration = Duration::from_secs(10);
-const PODMAN_PS_TIMEOUT: Duration = Duration::from_secs(10);
+const PODMAN_INSPECT_TIMEOUT: Duration = Duration::from_secs(5);
+const PODMAN_PS_TIMEOUT: Duration = Duration::from_secs(5);
+const ORCHESTRATOR_HEALTH_TIMEOUT: Duration = Duration::from_secs(5);
 
 impl RpcHandler {
     pub(super) async fn handle_container_install(
@@ -171,46 +172,69 @@ impl RpcHandler {
         // between "installed" and "not-installed" in the UI.
         let (data, _) = self.state_manager.get_snapshot().await;
         if data.server_info.status_info.containers_scanned && !data.package_data.is_empty() {
-            let containers: Vec<serde_json::Value> = data
-                .package_data
-                .iter()
-                .map(|(id, pkg)| {
-                    // Keep this mapping in sync with the UI's
-                    // ContainerStatus.state union in
-                    // neode-ui/src/api/container-client.ts. The UI maps
-                    // transitional variants to single-button labels
-                    // (Stopping… / Starting… / Restarting…).
-                    let state = match &pkg.state {
-                        crate::data_model::PackageState::Running => "running",
-                        crate::data_model::PackageState::Stopped => "stopped",
-                        crate::data_model::PackageState::Exited => "exited",
-                        crate::data_model::PackageState::Starting => "starting",
-                        crate::data_model::PackageState::Stopping => "stopping",
-                        crate::data_model::PackageState::Restarting => "restarting",
-                        crate::data_model::PackageState::Installing => "installing",
-                        crate::data_model::PackageState::Installed => "installed",
-                        crate::data_model::PackageState::Updating => "updating",
-                        crate::data_model::PackageState::Removing => "removing",
-                        crate::data_model::PackageState::CreatingBackup => "creating-backup",
-                        crate::data_model::PackageState::RestoringBackup => "restoring-backup",
-                        crate::data_model::PackageState::BackingUp => "backing-up",
-                    };
-                    let lan = pkg
-                        .installed
-                        .as_ref()
-                        .and_then(|i| i.interface_addresses.get("main"))
-                        .and_then(|a| a.lan_address.as_deref());
-                    serde_json::json!({
-                        "id": id,
-                        "name": id,
-                        "state": state,
-                        "image": "",
-                        "created": "",
-                        "ports": [],
-                        "lan_address": lan,
-                    })
-                })
-                .collect();
+            let mut containers = Vec::with_capacity(data.package_data.len());
+            for (id, pkg) in &data.package_data {
+                // Keep this mapping in sync with the UI's
+                // ContainerStatus.state union in
+                // neode-ui/src/api/container-client.ts. The UI maps
+                // transitional variants to single-button labels
+                // (Stopping… / Starting… / Restarting…).
+                let mut state = match &pkg.state {
+                    crate::data_model::PackageState::Running => "running".to_string(),
+                    crate::data_model::PackageState::Stopped => "stopped".to_string(),
+                    crate::data_model::PackageState::Exited => "exited".to_string(),
+                    crate::data_model::PackageState::Starting => "starting".to_string(),
+                    crate::data_model::PackageState::Stopping => "stopping".to_string(),
+                    crate::data_model::PackageState::Restarting => "restarting".to_string(),
+                    crate::data_model::PackageState::Installing => "installing".to_string(),
+                    crate::data_model::PackageState::Installed => "installed".to_string(),
+                    crate::data_model::PackageState::Updating => "updating".to_string(),
+                    crate::data_model::PackageState::Removing => "removing".to_string(),
+                    crate::data_model::PackageState::CreatingBackup => {
+                        "creating-backup".to_string()
+                    }
+                    crate::data_model::PackageState::RestoringBackup => {
+                        "restoring-backup".to_string()
+                    }
+                    crate::data_model::PackageState::BackingUp => "backing-up".to_string(),
+                };
+
+                // Scanner backoff preserves cached package_data. Refresh stable
+                // states so callers do not see stale `running`/`exited` after
+                // health-monitor recovery or Quadlet --rm container removal.
+                if state == "running" && requires_launch_port_for_health(id) {
+                    if !self.cached_reachable_health(id).await?.is_some() {
+                        state = live_state_for_app(id)
+                            .await
+                            .unwrap_or("starting".to_string());
+                    }
+                } else if should_refresh_cached_state(&state) {
+                    if launch_port_reachable(id).await {
+                        state = "running".to_string();
+                    } else {
+                        if let Some(live) = live_state_for_app(id).await {
+                            state = live;
+                        } else if quadlet_service_active(id).await {
+                            state = "starting".to_string();
+                        }
+                    }
+                }
+
+                let lan = pkg
+                    .installed
+                    .as_ref()
+                    .and_then(|i| i.interface_addresses.get("main"))
+                    .and_then(|a| a.lan_address.as_deref());
+                containers.push(serde_json::json!({
+                    "id": id,
+                    "name": id,
+                    "state": state,
+                    "image": "",
+                    "created": "",
+                    "ports": [],
+                    "lan_address": lan,
+                }));
+            }
             return Ok(serde_json::json!(containers));
         }
 
@@ -383,15 +407,33 @@ impl RpcHandler {
         // If app_id is provided, get health for that app.
         if let Some(params) = params {
             if let Some(app_id) = params.get("app_id").and_then(|v| v.as_str()) {
+                if let Some(health) = self.cached_reachable_health(app_id).await? {
+                    return Ok(serde_json::json!({ app_id: health }));
+                }
+
+                if let Some(health) = self.cached_state_health(app_id).await {
+                    return Ok(serde_json::json!({ app_id: health }));
+                }
+
+                if requires_launch_port_for_health(app_id) {
+                    return Ok(serde_json::json!({ app_id: "starting" }));
+                }
+
                 if let Some(health) = self.stack_health(app_id).await? {
                     return Ok(serde_json::json!({ app_id: health }));
                 }
 
                 let mut last_err: Option<anyhow::Error> = None;
                 for candidate in status_app_id_candidates(app_id) {
-                    match orchestrator.health(&candidate).await {
-                        Ok(health) => return Ok(serde_json::json!({ app_id: health })),
-                        Err(e) => last_err = Some(e),
+                    match tokio::time::timeout(
+                        ORCHESTRATOR_HEALTH_TIMEOUT,
+                        orchestrator.health(&candidate),
+                    )
+                    .await
+                    {
+                        Ok(Ok(health)) => return Ok(serde_json::json!({ app_id: health })),
+                        Ok(Err(e)) => last_err = Some(e),
+                        Err(_) => {}
                     }
                 }
                 for name in status_container_name_candidates(app_id) {
@@ -424,14 +466,19 @@ impl RpcHandler {
                 .and_then(|s| s.strip_suffix("-dev"))
                 .or_else(|| container.name.strip_prefix("archy-"))
                 .unwrap_or(container.name.as_str());
-            match orchestrator.health(app_id_candidate).await {
-                Ok(health) => {
+            match tokio::time::timeout(
+                ORCHESTRATOR_HEALTH_TIMEOUT,
+                orchestrator.health(app_id_candidate),
+            )
+            .await
+            {
+                Ok(Ok(health)) => {
                     health_map.insert(
                         app_id_candidate.to_string(),
                         serde_json::Value::String(health),
                     );
                 }
-                Err(_) => {
+                Ok(Err(_)) | Err(_) => {
                     health_map.insert(
                         app_id_candidate.to_string(),
                         serde_json::Value::String("unknown".to_string()),
@@ -443,6 +490,65 @@ impl RpcHandler {
         Ok(serde_json::Value::Object(health_map))
     }
 
+    async fn cached_state_health(&self, app_id: &str) -> Option<&'static str> {
+        let (data, _) = self.state_manager.get_snapshot().await;
+        let Some(pkg) = data.package_data.get(app_id) else {
+            if data.server_info.status_info.containers_scanned {
+                return Some("stopped");
+            }
+            return None;
+        };
+        match pkg.state {
+            crate::data_model::PackageState::Running => None,
+            crate::data_model::PackageState::Installing
+            | crate::data_model::PackageState::Installed
+            | crate::data_model::PackageState::Starting => Some("starting"),
+            crate::data_model::PackageState::Stopping
+            | crate::data_model::PackageState::Stopped
+            | crate::data_model::PackageState::Exited => Some("stopped"),
+            crate::data_model::PackageState::Removing => Some("removing"),
+            crate::data_model::PackageState::Restarting
+            | crate::data_model::PackageState::Updating
+            | crate::data_model::PackageState::CreatingBackup
+            | crate::data_model::PackageState::RestoringBackup
+            | crate::data_model::PackageState::BackingUp => Some("starting"),
+        }
+    }
+
+    async fn cached_reachable_health(&self, app_id: &str) -> Result<Option<String>> {
+        let (data, _) = self.state_manager.get_snapshot().await;
+        let pkg = data.package_data.get(app_id);
+        if matches!(
+            pkg.map(|pkg| &pkg.state),
+            Some(crate::data_model::PackageState::Removing)
+        ) {
+            return Ok(None);
+        }
+
+        let url = pkg
+            .and_then(|pkg| pkg.installed.as_ref())
+            .and_then(|i| i.interface_addresses.get("main"))
+            .and_then(|a| a.lan_address.as_deref())
+            .map(ToOwned::to_owned)
+            .or_else(|| health_probe_url_for_app(app_id));
+
+        let Some(url) = url else {
+            return Ok(None);
+        };
+        if url.starts_with("http://") || url.starts_with("https://") {
+            return Ok(http_launch_url_reachable(&url)
+                .await
+                .then(|| "healthy".to_string()));
+        }
+
+        let Some(port) = port_from_url(&url) else {
+            return Ok(None);
+        };
+        Ok(launch_port_reachable_by_port(port)
+            .await
+            .then(|| "healthy".to_string()))
+    }
+
     async fn stack_health(&self, app_id: &str) -> Result<Option<String>> {
         let Some(members) = stack_health_members(app_id) else {
             return Ok(None);
@@ -469,8 +575,14 @@ impl RpcHandler {
         }
 
         if saw_unknown {
+            if let Some(health) = self.cached_reachable_health(app_id).await? {
+                return Ok(Some(health));
+            }
             Ok(Some("unknown".to_string()))
         } else if saw_starting {
+            if let Some(health) = self.cached_reachable_health(app_id).await? {
+                return Ok(Some(health));
+            }
             Ok(Some("starting".to_string()))
         } else {
             Ok(Some("healthy".to_string()))
@@ -482,7 +594,9 @@ async fn member_health(
     orchestrator: &dyn crate::container::traits::ContainerOrchestrator,
     app_id: &str,
 ) -> Result<String> {
-    if let Ok(health) = orchestrator.health(app_id).await {
+    if let Ok(Ok(health)) =
+        tokio::time::timeout(ORCHESTRATOR_HEALTH_TIMEOUT, orchestrator.health(app_id)).await
+    {
         return Ok(health);
     }
     for name in status_container_name_candidates(app_id) {
@@ -508,10 +622,8 @@ fn stack_health_members(app_id: &str) -> Option<&'static [&'static str]> {
             "indeedhub-minio",
             "indeedhub-relay",
             "indeedhub-api",
-            "indeedhub-ffmpeg",
             "indeedhub",
         ]),
-        "fedimint" => Some(&["fedimint"]),
         _ => None,
     }
 }
@@ -583,6 +695,115 @@ fn status_container_name_candidates(app_id: &str) -> Vec<String> {
     out
 }
 
+fn should_refresh_cached_state(state: &str) -> bool {
+    matches!(state, "exited" | "stopped" | "stopping")
+}
+
+async fn live_state_for_app(app_id: &str) -> Option<String> {
+    for name in status_container_name_candidates(app_id) {
+        if let Some(live) = inspect_container_state_value(&name).await {
+            if let Some(live_state) = live.get("state").and_then(|v| v.as_str()) {
+                return Some(live_state.to_string());
+            }
+        }
+    }
+    None
+}
+
+async fn quadlet_service_active(app_id: &str) -> bool {
+    for name in status_container_name_candidates(app_id) {
+        let service = format!("{name}.service");
+        let mut cmd = tokio::process::Command::new("systemctl");
+        cmd.args(["--user", "is-active", "--quiet", &service]);
+        cmd.kill_on_drop(true);
+        if matches!(
+            tokio::time::timeout(Duration::from_secs(2), cmd.status()).await,
+            Ok(Ok(status)) if status.success()
+        ) {
+            return true;
+        }
+    }
+    false
+}
+
+fn health_probe_url_for_app(app_id: &str) -> Option<String> {
+    let port = match app_id {
+        "bitcoin-ui" => 8334,
+        "botfights" => 9100,
+        "btcpay-server" | "btcpay" | "btcpayserver" => 23000,
+        "dwn" => 3100,
+        "electrumx" | "electrs" | "mempool-electrs" | "electrs-ui" => 50002,
+        "fedimint" | "fedimintd" => 8175,
+        "filebrowser" => 8083,
+        "gitea" => 3001,
+        "grafana" => 3000,
+        "homeassistant" | "home-assistant" => 8123,
+        "immich" | "immich_server" => 2283,
+        "indeedhub" => 7778,
+        "jellyfin" => 8096,
+        "lnd" | "lnd-ui" => 18083,
+        "mempool" | "mempool-web" => 4080,
+        "nginx-proxy-manager" => 8081,
+        "ollama" => 11434,
+        "photoprism" => 2342,
+        "portainer" => 9000,
+        "searxng" => 8888,
+        "tailscale" => 8240,
+        "uptime-kuma" => 3002,
+        "vaultwarden" => 8082,
+        _ => return None,
+    };
+    Some(format!("http://localhost:{port}"))
+}
+
+fn requires_launch_port_for_health(app_id: &str) -> bool {
+    matches!(app_id, "fedimint" | "fedimintd" | "fedimint-gateway")
+}
+
+async fn launch_port_reachable(app_id: &str) -> bool {
+    let Some(port) = health_probe_url_for_app(app_id).and_then(|url| port_from_url(&url)) else {
+        return false;
+    };
+    launch_port_reachable_by_port(port).await
+}
+
+async fn launch_port_reachable_by_port(port: u16) -> bool {
+    matches!(
+        tokio::time::timeout(
+            Duration::from_secs(2),
+            tokio::net::TcpStream::connect(("127.0.0.1", port)),
+        )
+        .await,
+        Ok(Ok(_))
+    )
+}
+
+async fn http_launch_url_reachable(url: &str) -> bool {
+    let Ok(client) = reqwest::Client::builder()
+        .timeout(Duration::from_secs(2))
+        .redirect(reqwest::redirect::Policy::none())
+        .build()
+    else {
+        return false;
+    };
+    match client.get(url).send().await {
+        Ok(response) => {
+            let status = response.status();
+            status.is_success() || status.is_redirection()
+        }
+        Err(_) => false,
+    }
+}
+
+fn port_from_url(url: &str) -> Option<u16> {
+    let after_colon = url.rsplit_once(':')?.1;
+    let port = after_colon
+        .chars()
+        .take_while(|c| c.is_ascii_digit())
+        .collect::<String>();
+    port.parse::<u16>().ok()
+}
+
 async fn inspect_container_state_value(name: &str) -> Option<serde_json::Value> {
     if let Some(v) = ps_container_state_value(name).await {
         return Some(v);

core/archipelago/src/api/rpc/dispatcher.rs

@@ -98,6 +98,20 @@ impl RpcHandler {
 
             // Bitcoin & Lightning deep data
             "bitcoin.getinfo" => self.handle_bitcoin_getinfo().await,
+            "bitcoin.relay-status" => self.handle_bitcoin_relay_status().await,
+            "bitcoin.relay-update-settings" => {
+                self.handle_bitcoin_relay_update_settings(params).await
+            }
+            "bitcoin.relay-request-peer" => self.handle_bitcoin_relay_request_peer(params).await,
+            "bitcoin.relay-approve-request" => {
+                self.handle_bitcoin_relay_approve_request(params).await
+            }
+            "bitcoin.relay-reject-request" => {
+                self.handle_bitcoin_relay_reject_request(params).await
+            }
+            "bitcoin.relay-create-tor-service" => {
+                self.handle_bitcoin_relay_create_tor_service().await
+            }
             "bitcoin.init-wallet-from-seed" => {
                 self.handle_bitcoin_init_wallet_from_seed(params).await
             }

core/archipelago/src/api/rpc/lnd/wallet.rs

@@ -23,10 +23,15 @@ impl RpcHandler {
             .await
             .context("Failed to parse newaddress response")?;
 
+        if let Some(error) = body.get("error").and_then(|v| v.as_str()) {
+            anyhow::bail!("LND could not generate an address: {}", error);
+        }
+
         let address = body
             .get("address")
             .and_then(|v| v.as_str())
-            .unwrap_or("")
+            .filter(|addr| !addr.trim().is_empty())
+            .ok_or_else(|| anyhow::anyhow!("LND did not return a Bitcoin address. The wallet may still be locked, uninitialized, or waiting for Bitcoin to sync."))?
             .to_string();
 
         Ok(serde_json::json!({ "address": address }))

core/archipelago/src/api/rpc/mod.rs

@@ -2,6 +2,7 @@ mod analytics;
 mod auth;
 mod backup_rpc;
 mod bitcoin;
+pub(crate) mod bitcoin_relay;
 mod container;
 mod content;
 mod credentials;
@@ -302,6 +303,7 @@ impl RpcHandler {
                 | "system.stats"
                 | "tor.status"
                 | "tor.onion-addresses"
+                | "bitcoin.relay-status"
                 | "federation.list-nodes"
                 | "system.get-settings"
                 | "system.get-node-key"

core/archipelago/src/api/rpc/package/config.rs

@@ -3,7 +3,7 @@ use crate::port_allocator::PortAllocator;
 use anyhow::{Context, Result};
 use std::time::Duration;
 
-const PODMAN_LIST_TIMEOUT: Duration = Duration::from_secs(15);
+const PODMAN_LIST_TIMEOUT: Duration = Duration::from_secs(60);
 
 fn is_platform_managed_app(app_id: &str) -> bool {
     matches!(
@@ -31,7 +31,6 @@ fn is_platform_managed_app(app_id: &str) -> bool {
             | "fedimint"
             | "fedimint-gateway"
             | "indeedhub"
-            | "saleor"
             | "immich"
     )
 }
@@ -501,15 +500,6 @@ pub(super) fn all_container_names(package_id: &str) -> Vec<String> {
             "netbird-dashboard".into(),
             "netbird-server".into(),
         ],
-        "saleor" => vec![
-            "saleor-db".into(),
-            "saleor-cache".into(),
-            "saleor-api".into(),
-            "saleor-worker".into(),
-            "saleor-jaeger".into(),
-            "saleor-mailpit".into(),
-            "saleor".into(),
-        ],
         "nostr-vpn" => vec![
             "nostr-vpn".into(),
             "archy-nostr-vpn".into(),
@@ -599,7 +589,6 @@ pub(super) fn get_data_dirs_for_app(package_id: &str) -> Vec<String> {
             format!("{}/penpot-postgres", base),
         ],
         "netbird" => vec![format!("{}/netbird", base)],
-        "saleor" => vec![format!("{}/saleor", base), format!("{}/saleor-db", base)],
         _ => vec![format!("{}/{}", base, package_id)],
     }
 }
@@ -977,6 +966,7 @@ pub(super) async fn get_app_config(
             vec![
                 "/var/lib/archipelago/portainer:/data".to_string(),
                 "/run/user/1000/podman/podman.sock:/var/run/docker.sock".to_string(),
+                "/var/lib/archipelago/portainer/compose:/data/compose".to_string(),
             ],
             vec![],
             None,
@@ -1006,7 +996,7 @@ pub(super) async fn get_app_config(
             Some(vec![
                 "sh".to_string(),
                 "-c".to_string(),
-                "tailscaled --tun=userspace-networking & sleep 2; tailscale web --listen 0.0.0.0:8240 & wait".to_string(),
+                "tailscaled --tun=userspace-networking & for i in $(seq 1 30); do [ -S /var/run/tailscale/tailscaled.sock ] && break; sleep 1; done; tailscale web --listen 0.0.0.0:8240 & wait".to_string(),
             ]),
         ),
         "fedimint" => (
@@ -1079,13 +1069,6 @@ pub(super) async fn get_app_config(
             None,
             None,
         ),
-        "saleor" => (
-            vec!["9010:80".to_string(), "8000:8000".to_string()],
-            vec!["/var/lib/archipelago/saleor:/app/media".to_string()],
-            vec![],
-            None,
-            None,
-        ),
         "nostr-rs-relay" => (
             vec!["18081:8080".to_string()],
             vec!["/var/lib/archipelago/nostr-rs-relay:/usr/src/app/db".to_string()],

core/archipelago/src/api/rpc/package/dependencies.rs

@@ -289,15 +289,6 @@ pub(super) fn startup_order(package_id: &str) -> &'static [&'static str] {
             &["archy-btcpay-db", "archy-nbxplorer", "btcpay-server"]
         }
         "netbird" => &["netbird-server", "netbird-dashboard", "netbird"],
-        "saleor" => &[
-            "saleor-db",
-            "saleor-cache",
-            "saleor-jaeger",
-            "saleor-mailpit",
-            "saleor-api",
-            "saleor-worker",
-            "saleor",
-        ],
         "penpot" | "penpot-frontend" => &[
             "penpot-postgres",
             "penpot-valkey",

core/archipelago/src/api/rpc/package/install.rs

@@ -13,11 +13,12 @@ use crate::api::rpc::RpcHandler;
 use crate::data_model::InstallPhase;
 use crate::update::host_sudo;
 use anyhow::{Context, Result};
-use tokio::io::{AsyncBufReadExt, BufReader};
+use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader};
 use tokio::time::{timeout, Duration};
 use tracing::{debug, info, warn};
 
 const INSTALL_LOG: &str = "/var/log/archipelago/container-installs.log";
+const IMAGE_INSPECT_TIMEOUT: Duration = Duration::from_secs(10);
 
 /// Append a timestamped line to the persistent install log.
 pub(in crate::api::rpc) async fn install_log(msg: &str) {
@@ -34,6 +35,36 @@ pub(in crate::api::rpc) async fn install_log(msg: &str) {
     }
 }
 
+async fn local_podman_image_exists(image: &str) -> Result<bool> {
+    let mut cmd = tokio::process::Command::new("podman");
+    cmd.args(["image", "inspect", image]);
+    cmd.kill_on_drop(true);
+    let output = timeout(IMAGE_INSPECT_TIMEOUT, cmd.output())
+        .await
+        .with_context(|| {
+            format!(
+                "podman image inspect {} timed out after {}s",
+                image,
+                IMAGE_INSPECT_TIMEOUT.as_secs()
+            )
+        })?
+        .with_context(|| format!("Failed to execute podman image inspect {}", image))?;
+    match output.status.code() {
+        Some(0) => Ok(true),
+        Some(1) => Ok(false),
+        Some(code) => Err(anyhow::anyhow!(
+            "podman image inspect {} exited with {}: {}",
+            image,
+            code,
+            String::from_utf8_lossy(&output.stderr).trim()
+        )),
+        None => Err(anyhow::anyhow!(
+            "podman image inspect {} terminated by signal",
+            image
+        )),
+    }
+}
+
 pub(super) async fn patch_indeedhub_nostr_provider() {
     tokio::time::sleep(std::time::Duration::from_secs(5)).await;
 
@@ -244,10 +275,6 @@ impl RpcHandler {
         if package_id == "netbird" {
             return self.install_netbird_stack().await;
         }
-        if package_id == "saleor" {
-            return self.install_saleor_stack().await;
-        }
-
         // Dependency checks. Prefer the scanner's cached package state so a
         // congested Podman API does not turn an already-running dependency into
         // a false install failure. Fall back to a bounded direct Podman probe
@@ -447,6 +474,7 @@ impl RpcHandler {
                     Ok(container_name) => {
                         self.set_install_phase(package_id, InstallPhase::WaitingHealthy)
                             .await;
+                        ensure_host_port_listener(package_id, &container_name, &[]).await?;
                         crate::api::rpc::package::runtime::reconcile_companions_for(package_id)
                             .await;
                         install_log(&format!(
@@ -652,10 +680,6 @@ impl RpcHandler {
             self.write_lnd_conf(&rpc_user, &rpc_pass).await?;
         }
 
-        if package_id == "portainer" {
-            ensure_user_podman_socket().await?;
-        }
-
         // Pre-install: SearXNG settings.yml (required or container exits immediately)
         if package_id == "searxng" {
             let searx_dir = "/var/lib/archipelago/searxng";
@@ -748,16 +772,10 @@ impl RpcHandler {
         .await;
         debug!("Running container with args: {:?}", run_args);
 
-        // Build command with optional custom command/args
-        let mut cmd = tokio::process::Command::new("podman");
-        cmd.args(&run_args);
-        if let Some(custom_cmd) = custom_command {
-            cmd.arg(custom_cmd);
-        } else if let Some(args) = custom_args {
-            cmd.args(args);
-        }
-
-        let mut run_output = cmd.output().await.context("Failed to run container")?;
+        let command_tail = install_command_tail(custom_command.as_deref(), custom_args.as_ref());
+        let mut run_output = podman_run_for_install(package_id, &run_args, &command_tail)
+            .await
+            .context("Failed to run container")?;
 
         if !run_output.status.success() {
             let stderr = String::from_utf8_lossy(&run_output.stderr).to_string();
@@ -766,7 +784,9 @@ impl RpcHandler {
                     .args(["rm", "-f", container_name])
                     .output()
                     .await;
-                run_output = cmd.output().await.context("Failed to rerun container")?;
+                run_output = podman_run_for_install(package_id, &run_args, &command_tail)
+                    .await
+                    .context("Failed to rerun container")?;
             }
         }
 
@@ -922,12 +942,7 @@ impl RpcHandler {
         let is_local_image = docker_image.starts_with("localhost/");
         let has_local_fallback = if !is_local_image {
             let local_tag = format!("localhost/{}:latest", package_id);
-            let check = tokio::process::Command::new("podman")
-                .args(["images", "-q", &local_tag])
-                .output()
-                .await
-                .ok();
-            check.is_some_and(|o| !String::from_utf8_lossy(&o.stdout).trim().is_empty())
+            local_podman_image_exists(&local_tag).await.unwrap_or(false)
         } else {
             false
         };
@@ -942,14 +957,9 @@ impl RpcHandler {
             );
         } else {
             // Local image — verify it exists
-            let images_output = tokio::process::Command::new("podman")
-                .args(["images", "-q", docker_image])
-                .output()
+            if !local_podman_image_exists(docker_image)
                 .await
-                .context("Failed to check local image")?;
-            if String::from_utf8_lossy(&images_output.stdout)
-                .trim()
-                .is_empty()
+                .context("Failed to check local image")?
             {
                 return Err(anyhow::anyhow!(
                     "Local image {} not found. Build the image first \
@@ -1139,12 +1149,10 @@ impl RpcHandler {
         }
 
         // Verify image exists locally after pull.
-        let verify = tokio::process::Command::new("podman")
-            .args(["images", "-q", docker_image])
-            .output()
+        if !local_podman_image_exists(docker_image)
             .await
-            .context("Failed to verify pulled image")?;
-        if String::from_utf8_lossy(&verify.stdout).trim().is_empty() {
+            .context("Failed to verify pulled image")?
+        {
             return Err(anyhow::anyhow!(
                 "Image {} not found locally after pull",
                 docker_image
@@ -1278,11 +1286,13 @@ impl RpcHandler {
         // set `prune=N` in bitcoin.conf themselves after install.
         let bitcoin_conf = format!(
             "\
-# rpcauth: salted hash only — no plaintext password in config or CLI\n\
+# rpcauth: salted hash only - no plaintext password in config or CLI\n\
 {}\n\
 server=1\n\
 rpcallowip=0.0.0.0/0\n\
 listen=1\n\
+rpcthreads=16\n\
+rpcworkqueue=256\n\
 printtoconsole=1\n",
             rpcauth_line
         );
@@ -1871,29 +1881,34 @@ autopilot.active=false\n",
             .unwrap_or_default();
         super::validation::validate_app_id(app_id)?;
 
-        match app_id {
-            "saleor" => {
-                let password =
-                    tokio::fs::read_to_string("/var/lib/archipelago/secrets/saleor-admin-password")
-                        .await
-                        .unwrap_or_default()
-                        .trim()
-                        .to_string();
-                if password.is_empty() {
-                    return Ok(serde_json::json!({ "credentials": [] }));
-                }
-
-                Ok(serde_json::json!({
-                    "title": "Saleor admin login",
-                    "description": "Saleor opens to its own dashboard login. Use this generated admin account to sign in.",
-                    "credentials": [
-                        { "label": "Email", "value": "admin@example.com", "sensitive": false },
-                        { "label": "Password", "value": password, "sensitive": true }
-                    ]
-                }))
-            }
-            _ => Ok(serde_json::json!({ "credentials": [] })),
+        if app_id == "filebrowser" {
+            let password =
+                tokio::fs::read_to_string("/var/lib/archipelago/secrets/filebrowser/password")
+                    .await
+                    .map(|p| p.trim().to_string())
+                    .unwrap_or_else(|_| "admin".to_string());
+            return Ok(serde_json::json!({
+                "title": "File Browser credentials",
+                "description": "Use these credentials when File Browser asks you to sign in.",
+                "credentials": [
+                    { "label": "Username", "value": "admin" },
+                    { "label": "Password", "value": password, "sensitive": true }
+                ]
+            }));
         }
+
+        if app_id == "photoprism" {
+            return Ok(serde_json::json!({
+                "title": "PhotoPrism credentials",
+                "description": "Use these credentials when PhotoPrism asks you to sign in.",
+                "credentials": [
+                    { "label": "Username", "value": "admin" },
+                    { "label": "Password", "value": "archipelago", "sensitive": true }
+                ]
+            }));
+        }
+
+        Ok(serde_json::json!({ "credentials": [] }))
     }
 }
 
@@ -1914,10 +1929,128 @@ async fn cleanup_stale_package_ports(package_id: &str) {
             cleanup_stale_pasta_port("8444").await;
         }
         "nextcloud" => cleanup_stale_pasta_port("8085").await,
+        "portainer" => cleanup_stale_pasta_port("9000").await,
         _ => {}
     }
 }
 
+fn install_command_tail(
+    custom_cmd: Option<&str>,
+    custom_args: Option<&Vec<String>>,
+) -> Vec<String> {
+    if let Some(cmd) = custom_cmd {
+        vec![cmd.to_string()]
+    } else if let Some(args) = custom_args {
+        args.clone()
+    } else {
+        Vec::new()
+    }
+}
+
+async fn podman_run_for_install(
+    package_id: &str,
+    run_args: &[&str],
+    command_tail: &[String],
+) -> Result<std::process::Output> {
+    if should_scope_podman_run(package_id) {
+        match podman_create_then_scoped_start(package_id, run_args, command_tail).await {
+            Ok(output) => return Ok(output),
+            Err(err) => {
+                tracing::warn!(package_id, error = %err, "scoped podman create/start failed; falling back to direct podman run");
+            }
+        }
+    }
+
+    let mut cmd = tokio::process::Command::new("podman");
+    cmd.args(run_args);
+    cmd.args(command_tail);
+    cmd.output().await.context("Failed to run podman")
+}
+
+async fn podman_create_then_scoped_start(
+    package_id: &str,
+    run_args: &[&str],
+    command_tail: &[String],
+) -> Result<std::process::Output> {
+    let container_name = run_args
+        .windows(2)
+        .find_map(|pair| (pair[0] == "--name").then_some(pair[1]))
+        .unwrap_or(package_id);
+    let mut create_args = Vec::with_capacity(run_args.len() + command_tail.len());
+    for (idx, arg) in run_args.iter().enumerate() {
+        if idx == 0 && *arg == "run" {
+            create_args.push("create".to_string());
+        } else if *arg != "-d" {
+            create_args.push((*arg).to_string());
+        }
+    }
+    create_args.extend(command_tail.iter().cloned());
+
+    let mut create = tokio::process::Command::new("podman");
+    create.args(&create_args);
+    let create_output = create
+        .output()
+        .await
+        .context("Failed to run podman create")?;
+    if !create_output.status.success() {
+        return Ok(create_output);
+    }
+
+    let mut scoped_start = tokio::process::Command::new("systemd-run");
+    scoped_start.args([
+        "--user",
+        "--scope",
+        "--quiet",
+        "--collect",
+        "podman",
+        "start",
+        container_name,
+    ]);
+    match scoped_start.output().await {
+        Ok(output) if output.status.success() => Ok(create_output),
+        Ok(output) => {
+            tracing::warn!(
+                package_id,
+                container = container_name,
+                stderr = %String::from_utf8_lossy(&output.stderr).trim(),
+                "scoped podman start after create failed; trying direct podman start"
+            );
+            let mut direct_start = tokio::process::Command::new("podman");
+            direct_start.args(["start", container_name]);
+            let direct_output = direct_start
+                .output()
+                .await
+                .context("Failed to run fallback podman start")?;
+            if direct_output.status.success() {
+                Ok(create_output)
+            } else {
+                Ok(direct_output)
+            }
+        }
+        Err(err) => Err(err).context("Failed to run scoped podman start"),
+    }
+}
+
+fn should_scope_podman_run(package_id: &str) -> bool {
+    matches!(
+        package_id,
+        "botfights"
+            | "filebrowser"
+            | "gitea"
+            | "grafana"
+            | "homeassistant"
+            | "home-assistant"
+            | "jellyfin"
+            | "nginx-proxy-manager"
+            | "nostr-rs-relay"
+            | "photoprism"
+            | "portainer"
+            | "searxng"
+            | "uptime-kuma"
+            | "vaultwarden"
+    )
+}
+
 async fn cleanup_start_conflict(package_id: &str, stderr: &str) -> bool {
     if stderr.contains("name is already in use") || stderr.contains("name \"") {
         return true;
@@ -1968,6 +2101,12 @@ async fn cleanup_start_conflict(package_id: &str, stderr: &str) -> bool {
             cleanup_stale_pasta_port("8085").await;
             true
         }
+        "portainer"
+            if stderr.contains("pasta failed") || stderr.contains("address already in use") =>
+        {
+            cleanup_stale_pasta_port("9000").await;
+            true
+        }
         _ => false,
     }
 }
@@ -2026,7 +2165,7 @@ async fn ensure_host_port_listener(
         return Ok(());
     };
 
-    if wait_for_host_port(port, 10).await {
+    if wait_for_host_port(package_id, port, 10).await {
         return Ok(());
     }
 
@@ -2052,7 +2191,7 @@ async fn ensure_host_port_listener(
         ));
     }
 
-    if wait_for_host_port(port, 60).await {
+    if wait_for_host_port(package_id, port, 60).await {
         install_log(&format!(
             "INSTALL REPAIR OK: {} — host port {} is listening after restart",
             package_id, port
@@ -2084,31 +2223,6 @@ fn published_host_port(container_name: &str) -> Option<u16> {
     })
 }
 
-async fn ensure_user_podman_socket() -> Result<()> {
-    let socket_path = "/run/user/1000/podman/podman.sock";
-    if tokio::fs::try_exists(socket_path).await.unwrap_or(false) {
-        return Ok(());
-    }
-
-    let status = tokio::process::Command::new("systemctl")
-        .args(["--user", "restart", "podman.socket"])
-        .status()
-        .await
-        .context("spawn systemctl --user restart podman.socket")?;
-    if !status.success() {
-        anyhow::bail!("systemctl --user restart podman.socket exited {status}");
-    }
-
-    for _ in 0..20 {
-        if tokio::fs::try_exists(socket_path).await.unwrap_or(false) {
-            return Ok(());
-        }
-        tokio::time::sleep(Duration::from_millis(250)).await;
-    }
-
-    anyhow::bail!("podman socket {socket_path} did not appear after restart")
-}
-
 fn required_host_port(package_id: &str) -> Option<u16> {
     match package_id {
         "grafana" => Some(3000),
@@ -2118,17 +2232,21 @@ fn required_host_port(package_id: &str) -> Option<u16> {
         "gitea" => Some(3001),
         "nextcloud" => Some(8085),
         "nginx-proxy-manager" => Some(8081),
+        "portainer" => Some(9000),
         _ => None,
     }
 }
 
-async fn wait_for_host_port(port: u16, timeout_secs: u64) -> bool {
+async fn wait_for_host_port(package_id: &str, port: u16, timeout_secs: u64) -> bool {
     let deadline = std::time::Instant::now() + std::time::Duration::from_secs(timeout_secs);
     loop {
-        if tokio::net::TcpStream::connect(("127.0.0.1", port))
-            .await
-            .is_ok()
-        {
+        let ready = match package_id {
+            "uptime-kuma" => http_host_port_ready(port, "/").await,
+            _ => tokio::net::TcpStream::connect(("127.0.0.1", port))
+                .await
+                .is_ok(),
+        };
+        if ready {
             return true;
         }
 
@@ -2140,6 +2258,36 @@ async fn wait_for_host_port(port: u16, timeout_secs: u64) -> bool {
     }
 }
 
+async fn http_host_port_ready(port: u16, path: &str) -> bool {
+    let Ok(Ok(mut stream)) = tokio::time::timeout(
+        Duration::from_secs(3),
+        tokio::net::TcpStream::connect(("127.0.0.1", port)),
+    )
+    .await
+    else {
+        return false;
+    };
+
+    let request = format!("GET {path} HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n");
+    if stream.write_all(request.as_bytes()).await.is_err() {
+        return false;
+    }
+
+    let mut buf = [0u8; 128];
+    let Ok(Ok(n)) = tokio::time::timeout(Duration::from_secs(3), stream.read(&mut buf)).await
+    else {
+        return false;
+    };
+    if n == 0 {
+        return false;
+    }
+    let head = String::from_utf8_lossy(&buf[..n]);
+    head.starts_with("HTTP/1.1 2")
+        || head.starts_with("HTTP/1.1 3")
+        || head.starts_with("HTTP/1.0 2")
+        || head.starts_with("HTTP/1.0 3")
+}
+
 /// Resolve the host gateway IP for --add-host flag.
 /// Resolve the default gateway IP from the routing table for --add-host flag.
 /// Explicit IP avoids issues with "host-gateway" in rootless Podman.
@@ -2235,6 +2383,18 @@ set -eu
 conf=/var/lib/archipelago/bitcoin/bitcoin.conf
 [ -f "$conf" ] || exit 0
 changed=0
+tmp=$(mktemp)
+awk -F= '
+    /^(server|txindex|rpcbind|rpcallowip|rpcport|listen|bind|dbcache|rpcthreads|rpcworkqueue)=/ {
+        if (seen[$1]++) next
+    }
+    { print }
+' "$conf" > "$tmp"
+if ! cmp -s "$conf" "$tmp"; then
+    cat "$tmp" > "$conf"
+    changed=1
+fi
+rm -f "$tmp"
 ensure_line() {
     line="$1"
     key="${line%%=*}"
@@ -2246,6 +2406,8 @@ ensure_line() {
 ensure_line server=1
 ensure_line rpcallowip=0.0.0.0/0
 ensure_line listen=1
+ensure_line rpcthreads=16
+ensure_line rpcworkqueue=256
 [ "$changed" -eq 0 ] && exit 0
 exit 2
 "#;
@@ -2272,6 +2434,7 @@ fn should_try_orchestrator_install(package_id: &str, orchestrator_available: boo
 fn orchestrator_install_app_id(package_id: &str) -> &str {
     match package_id {
         "electrs" | "mempool-electrs" => "electrumx",
+        "home-assistant" => "homeassistant",
         _ => package_id,
     }
 }
@@ -2299,6 +2462,16 @@ fn uses_orchestrator_install_flow(package_id: &str) -> bool {
             | "archy-btcpay-db"
             | "archy-nbxplorer"
             | "btcpay-server"
+            | "homeassistant"
+            | "home-assistant"
+            | "nextcloud"
+            | "vaultwarden"
+            | "jellyfin"
+            | "photoprism"
+            | "uptime-kuma"
+            | "gitea"
+            | "portainer"
+            | "meshtastic"
     )
 }
 
@@ -2336,6 +2509,16 @@ mod tests {
             "archy-btcpay-db",
             "archy-nbxplorer",
             "btcpay-server",
+            "homeassistant",
+            "home-assistant",
+            "nextcloud",
+            "vaultwarden",
+            "jellyfin",
+            "photoprism",
+            "uptime-kuma",
+            "gitea",
+            "portainer",
+            "meshtastic",
         ] {
             assert!(uses_orchestrator_install_flow(app));
             assert!(should_try_orchestrator_install(app, true));
@@ -2364,6 +2547,10 @@ mod tests {
         assert_eq!(orchestrator_install_app_id("bitcoin-core"), "bitcoin-core");
         assert_eq!(orchestrator_install_app_id("electrs"), "electrumx");
         assert_eq!(orchestrator_install_app_id("mempool-electrs"), "electrumx");
+        assert_eq!(
+            orchestrator_install_app_id("home-assistant"),
+            "homeassistant"
+        );
         assert_eq!(orchestrator_install_app_id("lnd"), "lnd");
     }
 

core/archipelago/src/api/rpc/package/runtime.rs

@@ -2,15 +2,18 @@ use super::config::{
     get_app_capabilities, get_containers_for_app, get_data_dirs_for_app, get_health_check_args,
     get_memory_limit, is_valid_docker_image,
 };
-use super::dependencies::ordered_containers_for_start;
+use super::dependencies::{ordered_containers_for_start, startup_order};
 use super::install::install_log;
 use super::validation::validate_app_id;
 use crate::api::rpc::RpcHandler;
 use crate::data_model::PackageState;
 use anyhow::{Context, Result};
+use archipelago_container::AppManifest;
+use std::path::Path;
 use std::process::Output;
 use std::sync::Arc;
 use std::time::Duration;
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tracing::warn;
 
 const PODMAN_CONTROL_TIMEOUT: Duration = Duration::from_secs(30);
@@ -53,7 +56,11 @@ impl RpcHandler {
             .ok_or_else(|| anyhow::anyhow!("Missing package id"))?;
         validate_app_id(package_id)?;
 
-        let to_start = ordered_containers_for_start(package_id).await?;
+        let to_start = if self.orchestrator.is_some() && uses_single_orchestrator_app(package_id) {
+            vec![orchestrator_app_id(package_id).to_string()]
+        } else {
+            ordered_containers_for_start(package_id).await?
+        };
         if to_start.is_empty() {
             tracing::warn!("package.start {}: no containers found", package_id);
             return Err(anyhow::anyhow!("No containers found for {}", package_id));
@@ -124,7 +131,16 @@ impl RpcHandler {
             .ok_or_else(|| anyhow::anyhow!("Missing package id"))?;
         validate_app_id(package_id)?;
 
-        let containers = get_containers_for_app(package_id).await?;
+        let single_orchestrator_app =
+            self.orchestrator.is_some() && uses_single_orchestrator_app(package_id);
+        let mut containers = if single_orchestrator_app {
+            vec![orchestrator_app_id(package_id).to_string()]
+        } else {
+            get_containers_for_app(package_id).await?
+        };
+        if !single_orchestrator_app {
+            containers.reverse();
+        }
         if containers.is_empty() {
             tracing::warn!("package.stop {}: no containers found", package_id);
             return Err(anyhow::anyhow!("No containers found for {}", package_id));
@@ -190,7 +206,13 @@ impl RpcHandler {
             .ok_or_else(|| anyhow::anyhow!("Missing package id"))?;
         validate_app_id(package_id)?;
 
-        let containers = get_containers_for_app(package_id).await?;
+        let single_orchestrator_app =
+            self.orchestrator.is_some() && uses_single_orchestrator_app(package_id);
+        let containers = if single_orchestrator_app {
+            vec![orchestrator_app_id(package_id).to_string()]
+        } else {
+            get_containers_for_app(package_id).await?
+        };
         if containers.is_empty() {
             tracing::warn!("package.restart {}: no containers found", package_id);
             return Err(anyhow::anyhow!("No containers found for {}", package_id));
@@ -206,7 +228,11 @@ impl RpcHandler {
 
         let package_id_owned = package_id.to_string();
         let companion_app_id = package_id_owned.clone();
-        let to_restart = ordered_containers_for_start(package_id).await?;
+        let to_restart = if single_orchestrator_app {
+            vec![orchestrator_app_id(package_id).to_string()]
+        } else {
+            ordered_containers_for_start(package_id).await?
+        };
         let state_manager = Arc::clone(&self.state_manager);
         let orchestrator = self.orchestrator.clone();
         let pre_state =
@@ -323,7 +349,9 @@ impl RpcHandler {
             match rm_out {
                 Ok(o) if o.status.success() => removed += 1,
                 Ok(o) => {
-                    // If normal rm fails (e.g., still running), force as fallback
+                    // If normal rm fails (e.g., still running/stopping/removing),
+                    // force with targeted cleanup fallbacks. This is deliberately
+                    // container-scoped; never prune the store during uninstall.
                     let stderr = String::from_utf8_lossy(&o.stderr);
                     tracing::warn!(
                         "Uninstall {}: rm {} failed ({}), trying force",
@@ -331,28 +359,36 @@ impl RpcHandler {
                         name,
                         stderr.trim()
                     );
-                    let force_rm = podman_control(&["rm", "-f", name]).await;
-                    match force_rm {
-                        Ok(o2) if o2.status.success() => removed += 1,
-                        _ => {
-                            let msg = format!("Failed to remove {}: {}", name, stderr.trim());
+                    match force_remove_runtime_container(name).await {
+                        Ok(()) => removed += 1,
+                        Err(e) => {
+                            let msg =
+                                format!("Failed to remove {}: {}; {}", name, stderr.trim(), e);
                             tracing::error!("Uninstall {}: {}", package_id, msg);
                             errors.push(msg);
                         }
                     }
                 }
-                Err(e) => {
-                    let msg = format!("Failed to remove {}: {}", name, e);
-                    tracing::error!("Uninstall {}: {}", package_id, msg);
-                    errors.push(msg);
-                }
+                Err(e) => match force_remove_runtime_container(name).await {
+                    Ok(()) => removed += 1,
+                    Err(force_err) => {
+                        let msg = format!("Failed to remove {}: {}; {}", name, e, force_err);
+                        tracing::error!("Uninstall {}: {}", package_id, msg);
+                        errors.push(msg);
+                    }
+                },
             }
         }
 
         self.set_uninstall_stage(package_id, "Cleaning up volumes")
             .await;
-        // Clean up dangling volumes associated with removed containers
-        let _ = podman_control(&["volume", "prune", "-f"]).await;
+        // Avoid global Podman volume prune on production nodes: store-wide
+        // Podman cleanup commands can block app health under load. App data is
+        // removed explicitly below when preserve_data=false.
+        tracing::info!(
+            package_id = %package_id,
+            "Skipping global podman volume prune during uninstall"
+        );
 
         // Clean up app-specific networks (only if no other containers use them)
         let app_networks: Vec<&str> = match package_id {
@@ -600,9 +636,25 @@ async fn do_package_start(to_start: &[String]) -> Result<()> {
         if i > 0 {
             tokio::time::sleep(std::time::Duration::from_secs(2)).await;
         }
+        if let Err(e) = ensure_startable_container_state(name).await {
+            tracing::error!(container = %name, error = %e, "container is not startable");
+            errors.push(format!("{}: {}", name, e));
+            continue;
+        }
+        match inspect_runtime_container_state(name).await {
+            Ok(Some(state)) if state == "running" => {
+                tracing::debug!(container = %name, "container already running during package start");
+                continue;
+            }
+            Ok(_) => {}
+            Err(e) => {
+                tracing::warn!(container = %name, error = %e, "failed to re-inspect before package start")
+            }
+        }
         repair_before_package_start(name).await;
+        wait_before_package_start(name).await;
         tracing::info!("Starting container: {}", name);
-        let out = podman_control(&["start", name])
+        let out = podman_start_container(name)
             .await
             .context(format!("Failed to exec podman start {}", name))?;
         if !out.status.success() {
@@ -669,6 +721,7 @@ async fn do_orchestrator_package_start(
             tokio::time::sleep(std::time::Duration::from_secs(2)).await;
         }
         repair_before_package_start(name).await;
+        wait_before_package_start(name).await;
         match orchestrator.start(name).await {
             Ok(()) => wait_after_orchestrator_start(name).await,
             Err(e) if is_unknown_app_id_error(&e) => {
@@ -681,10 +734,13 @@ async fn do_orchestrator_package_start(
             }
         }
     }
-    if errors.is_empty() {
-        Ok(())
-    } else {
+    if !errors.is_empty() {
         Err(anyhow::anyhow!("Start failed: {}", errors.join("; ")))
+    } else {
+        for name in to_start {
+            ensure_runtime_host_port_listener(name).await?;
+        }
+        Ok(())
     }
 }
 
@@ -703,6 +759,137 @@ async fn podman_control(args: &[&str]) -> Result<Output> {
     podman_with_timeout(args, podman_control_timeout(args)).await
 }
 
+async fn force_remove_runtime_container(container_name: &str) -> Result<()> {
+    for args in [
+        vec!["rm", "-f", container_name],
+        vec!["rm", "-f", "--time", "0", container_name],
+    ] {
+        let output = podman_control(&args).await?;
+        if output.status.success()
+            || is_missing_container_error(&String::from_utf8_lossy(&output.stderr))
+        {
+            return Ok(());
+        }
+    }
+
+    let _ = podman_control(&["container", "cleanup", container_name]).await;
+    let output = podman_control(&["rm", "-f", container_name]).await?;
+    if output.status.success()
+        || is_missing_container_error(&String::from_utf8_lossy(&output.stderr))
+    {
+        return Ok(());
+    }
+
+    Err(anyhow::anyhow!(
+        "force remove failed: {}",
+        String::from_utf8_lossy(&output.stderr).trim()
+    ))
+}
+
+async fn force_stop_runtime_container(container_name: &str) -> Result<()> {
+    for args in [
+        vec!["stop", "-t", "0", container_name],
+        vec!["kill", container_name],
+    ] {
+        let output = podman_control(&args).await?;
+        if output.status.success()
+            || is_missing_container_error(&String::from_utf8_lossy(&output.stderr))
+        {
+            return Ok(());
+        }
+    }
+
+    for _ in 0..15 {
+        match inspect_runtime_container_state(container_name).await? {
+            None => return Ok(()),
+            Some(state) if matches!(state.as_str(), "exited" | "stopped" | "configured") => {
+                return Ok(())
+            }
+            Some(_) => tokio::time::sleep(Duration::from_secs(2)).await,
+        }
+    }
+
+    Err(anyhow::anyhow!(
+        "container did not reach stopped state after force stop"
+    ))
+}
+
+async fn ensure_startable_container_state(container_name: &str) -> Result<()> {
+    let Some(state) = inspect_runtime_container_state(container_name).await? else {
+        return Ok(());
+    };
+
+    match state.as_str() {
+        "configured" | "created" | "exited" | "stopped" | "running" | "paused" => Ok(()),
+        "removing" => {
+            wait_for_container_absent_or_startable(container_name, Duration::from_secs(60)).await
+        }
+        other => Err(anyhow::anyhow!(
+            "container is in unsupported state before start: {}",
+            other
+        )),
+    }
+}
+
+async fn wait_for_container_absent_or_startable(
+    container_name: &str,
+    timeout: Duration,
+) -> Result<()> {
+    let deadline = std::time::Instant::now() + timeout;
+    loop {
+        match inspect_runtime_container_state(container_name).await? {
+            None => return Ok(()),
+            Some(state)
+                if matches!(
+                    state.as_str(),
+                    "configured" | "created" | "exited" | "stopped" | "running" | "paused"
+                ) =>
+            {
+                return Ok(())
+            }
+            Some(state) if state == "removing" && std::time::Instant::now() < deadline => {
+                tokio::time::sleep(Duration::from_secs(2)).await;
+            }
+            Some(state) if state == "removing" => {
+                force_remove_runtime_container(container_name).await?;
+                return Ok(());
+            }
+            Some(state) => {
+                return Err(anyhow::anyhow!(
+                    "container is in unsupported state before start: {}",
+                    state
+                ))
+            }
+        }
+    }
+}
+
+async fn inspect_runtime_container_state(container_name: &str) -> Result<Option<String>> {
+    let output = podman_with_timeout(
+        &["inspect", container_name, "--format", "{{.State.Status}}"],
+        Duration::from_secs(10),
+    )
+    .await?;
+    if output.status.success() {
+        return Ok(Some(
+            String::from_utf8_lossy(&output.stdout).trim().to_string(),
+        ));
+    }
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    if is_missing_container_error(&stderr) {
+        Ok(None)
+    } else {
+        Err(anyhow::anyhow!("inspect failed: {}", stderr.trim()))
+    }
+}
+
+fn is_missing_container_error(stderr: &str) -> bool {
+    stderr.contains("no such container")
+        || stderr.contains("no container with name")
+        || stderr.contains("does not exist")
+        || stderr.contains("not found")
+}
+
 fn podman_control_timeout(args: &[&str]) -> Duration {
     args.windows(2)
         .find_map(|pair| {
@@ -714,6 +901,13 @@ fn podman_control_timeout(args: &[&str]) -> Duration {
         .unwrap_or(PODMAN_CONTROL_TIMEOUT)
 }
 
+fn podman_start_timeout(container_name: &str) -> Duration {
+    match container_name {
+        "immich_server" | "netbird-server" => Duration::from_secs(120),
+        _ => PODMAN_CONTROL_TIMEOUT,
+    }
+}
+
 async fn podman_with_timeout(args: &[&str], timeout: Duration) -> Result<Output> {
     let mut cmd = tokio::process::Command::new("podman");
     cmd.args(args);
@@ -732,12 +926,48 @@ async fn command_with_timeout(
         .with_context(|| format!("Failed to exec {}", description))
 }
 
+async fn podman_start_container(container_name: &str) -> Result<Output> {
+    if !runtime_host_ports(container_name).is_empty() {
+        let mut cmd = tokio::process::Command::new("systemd-run");
+        cmd.args([
+            "--user",
+            "--scope",
+            "--quiet",
+            "--collect",
+            "podman",
+            "start",
+        ])
+        .arg(container_name);
+        let scoped = command_with_timeout(
+            cmd,
+            podman_start_timeout(container_name),
+            &format!("systemd-run --user --scope podman start {container_name}"),
+        )
+        .await;
+        if scoped.as_ref().is_ok_and(|out| out.status.success()) {
+            return scoped;
+        }
+        if let Err(err) = &scoped {
+            tracing::warn!(
+                container = %container_name,
+                error = %err,
+                "scoped podman start failed; falling back to direct podman start"
+            );
+        }
+    }
+    podman_with_timeout(
+        &["start", container_name],
+        podman_start_timeout(container_name),
+    )
+    .await
+}
+
 async fn do_orchestrator_package_stop(
     orchestrator: &dyn crate::container::traits::ContainerOrchestrator,
     containers: &[String],
 ) -> Result<()> {
     let mut errors = Vec::new();
-    for name in containers.iter().rev() {
+    for name in containers {
         match orchestrator.stop(name).await {
             Ok(()) => {}
             Err(e) if is_unknown_app_id_error(&e) => {
@@ -758,6 +988,44 @@ async fn do_orchestrator_package_stop(
     }
 }
 
+fn orchestrator_app_id(package_id: &str) -> &str {
+    match package_id {
+        "electrs" | "mempool-electrs" => "electrumx",
+        "home-assistant" => "homeassistant",
+        _ => package_id,
+    }
+}
+
+fn uses_single_orchestrator_app(package_id: &str) -> bool {
+    startup_order(package_id).is_empty()
+        && matches!(
+            package_id,
+            "bitcoin-ui"
+                | "electrs-ui"
+                | "lnd-ui"
+                | "bitcoin-core"
+                | "bitcoin-knots"
+                | "lnd"
+                | "fedimint"
+                | "fedimint-gateway"
+                | "filebrowser"
+                | "electrumx"
+                | "electrs"
+                | "mempool-electrs"
+                | "homeassistant"
+                | "home-assistant"
+                | "nextcloud"
+                | "vaultwarden"
+                | "jellyfin"
+                | "photoprism"
+                | "uptime-kuma"
+                | "gitea"
+                | "portainer"
+                | "meshtastic"
+                | "botfights"
+        )
+}
+
 async fn do_orchestrator_package_restart(
     orchestrator: &dyn crate::container::traits::ContainerOrchestrator,
     to_restart: &[String],
@@ -770,22 +1038,72 @@ async fn do_orchestrator_package_restart(
 async fn do_package_stop(containers: &[String]) -> Result<()> {
     let mut errors = Vec::new();
     for name in containers {
+        match inspect_runtime_container_state(name).await {
+            Ok(None) => {
+                tracing::debug!(container = %name, "container already absent during stop");
+                continue;
+            }
+            Ok(Some(state)) if matches!(state.as_str(), "exited" | "stopped" | "configured") => {
+                tracing::debug!(container = %name, state = %state, "container already stopped");
+                continue;
+            }
+            Ok(Some(_)) => {}
+            Err(e) => {
+                tracing::warn!(container = %name, error = %e, "failed to inspect before stop")
+            }
+        }
         tracing::info!(
             "Stopping container: {} (timeout: {}s)",
             name,
             stop_timeout_secs(name)
         );
-        let out = podman_control(&["stop", "-t", stop_timeout_secs(name), name])
-            .await
-            .context(format!("Failed to exec podman stop {}", name))?;
+        let out = match podman_control(&["stop", "-t", stop_timeout_secs(name), name]).await {
+            Ok(out) => out,
+            Err(e) => {
+                tracing::warn!(
+                        container = %name,
+                        error = %e,
+                    "podman stop errored, trying force stop"
+                );
+                match force_stop_runtime_container(name).await {
+                    Ok(()) => {
+                        tracing::info!(container = %name, "force stop after stop error succeeded");
+                        continue;
+                    }
+                    Err(force_err) => {
+                        tracing::error!(
+                            "Failed to stop {}: {}; force stop failed: {}",
+                            name,
+                            e,
+                            force_err
+                        );
+                        errors.push(format!("{}: {}; force stop failed: {}", name, e, force_err));
+                        continue;
+                    }
+                }
+            }
+        };
         if !out.status.success() {
             let stderr = String::from_utf8_lossy(&out.stderr).trim().to_string();
             if is_missing_companion_ok(name, &stderr) {
                 tracing::debug!(container = %name, "companion already absent during stop");
                 continue;
             }
-            tracing::error!("Failed to stop {}: {}", name, stderr);
-            errors.push(format!("{}: {}", name, stderr));
+            tracing::warn!("Failed to stop {}: {}, trying force stop", name, stderr);
+            match force_stop_runtime_container(name).await {
+                Ok(()) => {
+                    tracing::info!(container = %name, "force stop after stop failure succeeded")
+                }
+                Err(e) => {
+                    tracing::error!(
+                        "Failed to stop {}: {}; force stop failed: {}",
+                        name,
+                        stderr,
+                        e
+                    );
+                    errors.push(format!("{}: {}; force stop failed: {}", name, stderr, e));
+                }
+            }
         }
     }
     if !errors.is_empty() {
@@ -801,6 +1119,7 @@ async fn do_package_restart(containers: &[String]) -> Result<()> {
     for name in containers {
         tracing::info!("Restarting container: {}", name);
         repair_before_package_start(name).await;
+        wait_before_package_start(name).await;
         let out = podman_control(&["restart", "-t", stop_timeout_secs(name), name])
             .await
             .context(format!("Failed to exec podman restart {}", name))?;
@@ -818,7 +1137,8 @@ async fn do_package_restart(containers: &[String]) -> Result<()> {
             );
             // Fallback: stop then start
             let _ = podman_control(&["stop", "-t", stop_timeout_secs(name), name]).await;
-            let start_out = podman_control(&["start", name])
+            wait_before_package_start(name).await;
+            let start_out = podman_start_container(name)
                 .await
                 .context(format!("Failed to exec podman start {}", name))?;
             if !start_out.status.success() {
@@ -855,22 +1175,158 @@ fn is_unknown_app_id_error(err: &anyhow::Error) -> bool {
 async fn repair_before_package_start(container_name: &str) {
     match container_name {
         "btcpay-server" | "archy-nbxplorer" => repair_btcpay_dirs().await,
-        "indeedhub-postgres" | "indeedhub-redis" | "indeedhub-minio" | "indeedhub-relay"
-        | "indeedhub-api" | "indeedhub-ffmpeg" | "indeedhub" => repair_indeedhub_network().await,
+        "indeedhub" => repair_indeedhub_network().await,
+        "immich_server" => repair_immich_dirs().await,
+        "netbird" => repair_netbird_network().await,
         "grafana" => {
             repair_grafana_dirs().await;
-            cleanup_stale_pasta_port("3000").await;
         }
-        "vaultwarden" => cleanup_stale_pasta_port("8082").await,
-        "homeassistant" | "home-assistant" => cleanup_stale_pasta_port("8123").await,
         "nextcloud" => {
             repair_nextcloud_dirs().await;
-            cleanup_stale_pasta_port("8085").await;
         }
         "nginx-proxy-manager" => repair_nginx_proxy_manager_container().await,
-        "gitea" => cleanup_gitea_stale_ports().await,
         _ => {}
     }
+    cleanup_runtime_host_ports(container_name).await;
+}
+
+async fn wait_before_package_start(container_name: &str) {
+    match container_name {
+        "indeedhub" => wait_for_indeedhub_dependency_dns().await,
+        "immich_server" => wait_for_immich_dependencies().await,
+        "netbird" => wait_for_netbird_dependency_dns().await,
+        _ => {}
+    }
+}
+
+async fn wait_for_indeedhub_dependency_dns() {
+    for _ in 0..30 {
+        if indeedhub_frontend_dependencies_running().await {
+            super::stacks::repair_indeedhub_network_aliases().await;
+            break;
+        }
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+    }
+
+    for _ in 0..30 {
+        let ready = podman_with_timeout(
+            &["exec", "indeedhub-minio", "getent", "hosts", "minio"],
+            Duration::from_secs(5),
+        )
+        .await
+        .map(|out| out.status.success())
+        .unwrap_or(false);
+        if ready {
+            return;
+        }
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+    }
+}
+
+async fn indeedhub_frontend_dependencies_running() -> bool {
+    for container in ["indeedhub-minio", "indeedhub-redis", "indeedhub-api"] {
+        if !container_is_running(container).await {
+            return false;
+        }
+    }
+    true
+}
+
+async fn container_is_running(container: &str) -> bool {
+    let Ok(output) = podman_with_timeout(
+        &["inspect", container, "--format", "{{.State.Status}}"],
+        Duration::from_secs(5),
+    )
+    .await
+    else {
+        return false;
+    };
+
+    output.status.success() && String::from_utf8_lossy(&output.stdout).trim() == "running"
+}
+
+async fn wait_for_netbird_dependency_dns() {
+    for _ in 0..30 {
+        if container_is_running("netbird-server").await
+            && container_is_running("netbird-dashboard").await
+        {
+            super::stacks::repair_netbird_network_aliases().await;
+            tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+            return;
+        }
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+    }
+}
+
+async fn wait_for_immich_dependencies() {
+    for _ in 0..60 {
+        if immich_postgres_ready().await && immich_redis_ready().await {
+            return;
+        }
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+    }
+}
+
+async fn immich_postgres_ready() -> bool {
+    if container_health_is_healthy("immich_postgres").await {
+        return true;
+    }
+
+    let Ok(output) = podman_with_timeout(
+        &[
+            "exec",
+            "immich_postgres",
+            "pg_isready",
+            "-U",
+            "postgres",
+            "-d",
+            "immich",
+        ],
+        Duration::from_secs(5),
+    )
+    .await
+    else {
+        return false;
+    };
+    output.status.success()
+}
+
+async fn immich_redis_ready() -> bool {
+    if container_health_is_healthy("immich_redis").await {
+        return true;
+    }
+
+    let Ok(output) = podman_with_timeout(
+        &["exec", "immich_redis", "valkey-cli", "ping"],
+        Duration::from_secs(5),
+    )
+    .await
+    else {
+        return false;
+    };
+    output.status.success() && String::from_utf8_lossy(&output.stdout).contains("PONG")
+}
+
+async fn container_health_is_healthy(container: &str) -> bool {
+    let Ok(output) = podman_with_timeout(
+        &[
+            "inspect",
+            container,
+            "--format",
+            "{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}",
+        ],
+        Duration::from_secs(5),
+    )
+    .await
+    else {
+        return false;
+    };
+
+    output.status.success() && String::from_utf8_lossy(&output.stdout).trim() == "healthy"
+}
+
+async fn repair_netbird_network() {
+    super::stacks::repair_netbird_network_aliases().await;
 }
 
 async fn repair_nginx_proxy_manager_container() {
@@ -1009,11 +1465,11 @@ async fn recreate_nginx_proxy_manager_container() -> Result<()> {
 }
 
 async fn ensure_runtime_host_port_listener(container_name: &str) -> Result<()> {
-    let Some(port) = runtime_required_host_port(container_name) else {
+    let Some(port) = runtime_host_ports(container_name).into_iter().next() else {
         return Ok(());
     };
 
-    if wait_for_runtime_host_port(port, 10).await {
+    if wait_for_runtime_host_port(container_name, port, 10).await {
         return Ok(());
     }
 
@@ -1035,7 +1491,7 @@ async fn ensure_runtime_host_port_listener(container_name: &str) -> Result<()> {
         ));
     }
 
-    if wait_for_runtime_host_port(port, 60).await {
+    if wait_for_runtime_host_port(container_name, port, 60).await {
         install_log(&format!(
             "START REPAIR OK: {} — host port {} is listening after restart",
             container_name, port
@@ -1051,27 +1507,99 @@ async fn ensure_runtime_host_port_listener(container_name: &str) -> Result<()> {
     ))
 }
 
-fn runtime_required_host_port(container_name: &str) -> Option<u16> {
-    match container_name {
-        "grafana" => Some(3000),
-        "homeassistant" | "home-assistant" => Some(8123),
-        "searxng" => Some(8888),
-        "uptime-kuma" => Some(3002),
-        "vaultwarden" => Some(8082),
-        "gitea" => Some(3001),
-        "nextcloud" => Some(8085),
-        "nginx-proxy-manager" => Some(8081),
-        _ => None,
+fn runtime_host_ports(container_name: &str) -> Vec<u16> {
+    let manifest_ports = manifest_host_ports(container_name);
+    if !manifest_ports.is_empty() {
+        return with_legacy_extra_ports(container_name, manifest_ports);
+    }
+
+    let ports = match container_name {
+        "grafana" => vec![3000],
+        "homeassistant" | "home-assistant" => vec![8123],
+        "jellyfin" => vec![8096],
+        "searxng" => vec![8888],
+        "uptime-kuma" => vec![3002],
+        "vaultwarden" => vec![8082],
+        "gitea" => vec![3001, 2222, 3000],
+        "nextcloud" => vec![8085],
+        "nginx-proxy-manager" => vec![8081, 8084, 8444],
+        _ => Vec::new(),
+    };
+    ports
+}
+
+fn with_legacy_extra_ports(container_name: &str, mut ports: Vec<u16>) -> Vec<u16> {
+    if container_name == "gitea" && !ports.contains(&3000) {
+        ports.push(3000);
+    }
+    if container_name == "nginx-proxy-manager" {
+        for port in [8084, 8444] {
+            if !ports.contains(&port) {
+                ports.push(port);
+            }
+        }
+    }
+    ports
+}
+
+fn manifest_host_ports(container_name: &str) -> Vec<u16> {
+    for apps_dir in manifest_apps_dirs() {
+        let Ok(entries) = std::fs::read_dir(apps_dir) else {
+            continue;
+        };
+        for entry in entries.flatten() {
+            let path = entry.path().join("manifest.yml");
+            let Ok(contents) = std::fs::read_to_string(&path) else {
+                continue;
+            };
+            let Ok(manifest) = AppManifest::parse(&contents) else {
+                continue;
+            };
+            if manifest_container_name(&manifest) == container_name {
+                return manifest.app.ports.iter().map(|p| p.host).collect();
+            }
+        }
+    }
+    Vec::new()
+}
+
+fn manifest_apps_dirs() -> Vec<std::path::PathBuf> {
+    let mut dirs = Vec::new();
+    if let Ok(manifest_dir) = std::env::var("CARGO_MANIFEST_DIR") {
+        dirs.push(Path::new(&manifest_dir).join("../../apps"));
+    }
+    dirs.extend([
+        Path::new("apps").to_path_buf(),
+        Path::new("/opt/archipelago/apps").to_path_buf(),
+        Path::new("/opt/archipelago/web-ui/archipelago-runtime/apps").to_path_buf(),
+    ]);
+    dirs
+}
+
+fn manifest_container_name(manifest: &AppManifest) -> String {
+    if let Some(v) = manifest.app.extensions.get("container_name") {
+        if let Some(s) = v.as_str() {
+            if !s.is_empty() {
+                return s.to_string();
+            }
+        }
+    }
+    match manifest.app.id.as_str() {
+        "bitcoin-ui" | "electrs-ui" | "lnd-ui" => format!("archy-{}", manifest.app.id),
+        id => id.to_string(),
     }
 }
 
-async fn wait_for_runtime_host_port(port: u16, timeout_secs: u64) -> bool {
+async fn wait_for_runtime_host_port(container_name: &str, port: u16, timeout_secs: u64) -> bool {
     let deadline = std::time::Instant::now() + std::time::Duration::from_secs(timeout_secs);
     loop {
-        if tokio::net::TcpStream::connect(("127.0.0.1", port))
-            .await
-            .is_ok()
-        {
+        let ready = match container_name {
+            "uptime-kuma" => http_host_port_ready(port, "/").await,
+            _ => tokio::net::TcpStream::connect(("127.0.0.1", port))
+                .await
+                .is_ok(),
+        };
+        if ready {
             return true;
         }
 
@@ -1083,6 +1611,37 @@ async fn wait_for_runtime_host_port(port: u16, timeout_secs: u64) -> bool {
     }
 }
 
+async fn http_host_port_ready(port: u16, path: &str) -> bool {
+    let Ok(Ok(mut stream)) = tokio::time::timeout(
+        std::time::Duration::from_secs(3),
+        tokio::net::TcpStream::connect(("127.0.0.1", port)),
+    )
+    .await
+    else {
+        return false;
+    };
+
+    let request = format!("GET {path} HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n");
+    if stream.write_all(request.as_bytes()).await.is_err() {
+        return false;
+    }
+
+    let mut buf = [0u8; 128];
+    let Ok(Ok(n)) =
+        tokio::time::timeout(std::time::Duration::from_secs(3), stream.read(&mut buf)).await
+    else {
+        return false;
+    };
+    if n == 0 {
+        return false;
+    }
+    let head = String::from_utf8_lossy(&buf[..n]);
+    head.starts_with("HTTP/1.1 2")
+        || head.starts_with("HTTP/1.1 3")
+        || head.starts_with("HTTP/1.0 2")
+        || head.starts_with("HTTP/1.0 3")
+}
+
 async fn repair_btcpay_dirs() {
     let _ = tokio::process::Command::new("sudo")
         .args([
@@ -1157,6 +1716,27 @@ async fn repair_nextcloud_dirs() {
     }
 }
 
+async fn repair_immich_dirs() {
+    let _ = tokio::process::Command::new("sudo")
+        .args(["mkdir", "-p", "/var/lib/archipelago/immich"])
+        .output()
+        .await;
+    let podman_chown = podman_control(&[
+        "unshare",
+        "chown",
+        "-R",
+        "0:0",
+        "/var/lib/archipelago/immich",
+    ])
+    .await;
+    if !podman_chown.as_ref().is_ok_and(|o| o.status.success()) {
+        let _ = tokio::process::Command::new("sudo")
+            .args(["chown", "-R", "1000:1000", "/var/lib/archipelago/immich"])
+            .output()
+            .await;
+    }
+}
+
 async fn repair_btcpay_database_password() {
     let Ok(db_pass) =
         tokio::fs::read_to_string("/var/lib/archipelago/secrets/btcpay-db-password").await
@@ -1205,25 +1785,28 @@ async fn cleanup_start_conflict(container_name: &str, stderr: &str) {
         return;
     }
 
-    if container_name == "gitea" {
-        cleanup_gitea_stale_ports().await;
+    let ports = runtime_host_ports(container_name);
+    if !ports.is_empty() {
+        cleanup_ports(&ports).await;
         return;
     }
+}
 
-    match container_name {
-        "grafana" => cleanup_stale_pasta_port("3000").await,
-        "homeassistant" | "home-assistant" => cleanup_stale_pasta_port("8123").await,
-        "vaultwarden" => cleanup_stale_pasta_port("8082").await,
-        "nextcloud" => cleanup_stale_pasta_port("8085").await,
-        "nginx-proxy-manager" => cleanup_nginx_proxy_manager_ports().await,
-        _ => {}
+async fn cleanup_runtime_host_ports(container_name: &str) {
+    let ports = runtime_host_ports(container_name);
+    if !ports.is_empty() {
+        cleanup_ports(&ports).await;
     }
 }
 
 async fn cleanup_nginx_proxy_manager_ports() {
-    cleanup_stale_pasta_port("8081").await;
-    cleanup_stale_pasta_port("8084").await;
-    cleanup_stale_pasta_port("8444").await;
+    cleanup_ports(&[8081, 8084, 8444]).await;
+}
+
+async fn cleanup_ports(ports: &[u16]) {
+    for port in ports {
+        cleanup_stale_pasta_port(&port.to_string()).await;
+    }
 }
 
 async fn cleanup_stale_pasta_port(port: &str) {
@@ -1249,31 +1832,6 @@ async fn cleanup_stale_pasta_port(port: &str) {
     tokio::time::sleep(std::time::Duration::from_secs(1)).await;
 }
 
-async fn cleanup_gitea_stale_ports() {
-    for port in ["3001", "2222", "3000"] {
-        let kill_listener = format!(
-            "ss -ltnp 'sport = :{}' 2>/dev/null | sed -n 's/.*pid=\\([0-9]*\\).*/\\1/p' | xargs -r kill 2>/dev/null || true",
-            port
-        );
-        let _ = tokio::process::Command::new("sh")
-            .args(["-c", &kill_listener])
-            .output()
-            .await;
-
-        let pattern = format!("pasta.*{}", port);
-        let _ = tokio::process::Command::new("pkill")
-            .args(["-f", &pattern])
-            .output()
-            .await;
-        let pattern = format!("rootlessport.*{}", port);
-        let _ = tokio::process::Command::new("pkill")
-            .args(["-f", &pattern])
-            .output()
-            .await;
-    }
-    tokio::time::sleep(std::time::Duration::from_secs(1)).await;
-}
-
 pub(super) fn is_missing_companion_ok(name: &str, stderr: &str) -> bool {
     matches!(
         name,
@@ -1352,3 +1910,20 @@ pub(super) fn orchestrator_uninstall_app_ids(package_id: &str) -> Vec<String> {
         _ => vec![package_id.to_string()],
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn runtime_host_ports_are_manifest_derived_for_public_apps() {
+        assert_eq!(runtime_host_ports("photoprism"), vec![2342]);
+        assert_eq!(runtime_host_ports("jellyfin"), vec![8096]);
+        assert_eq!(runtime_host_ports("uptime-kuma"), vec![3002]);
+    }
+
+    #[test]
+    fn runtime_host_ports_preserve_legacy_extra_ports() {
+        assert_eq!(runtime_host_ports("gitea"), vec![3001, 2222, 3000]);
+    }
+}

core/archipelago/src/api/rpc/package/update.rs

@@ -16,6 +16,8 @@ use anyhow::{Context, Result};
 use tokio::io::{AsyncBufReadExt, BufReader};
 use tracing::{error, info, warn};
 
+const PODMAN_UPDATE_PULL_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(600);
+
 impl RpcHandler {
     /// Update a package to the version pinned in image-versions.sh.
     /// This is a manual operation — the user clicks "Update" in the UI.
@@ -327,6 +329,7 @@ impl RpcHandler {
         if archipelago_container::image_uses_insecure_registry(image) {
             cmd.arg("--tls-verify=false");
         }
+        cmd.kill_on_drop(true);
         let mut child = cmd
             .arg(image)
             .stdout(std::process::Stdio::piped())
@@ -334,23 +337,38 @@ impl RpcHandler {
             .spawn()
             .context("Failed to start image pull")?;
 
-        if let Some(stderr) = child.stderr.take() {
+        let progress_task = if let Some(stderr) = child.stderr.take() {
             let reader = BufReader::new(stderr);
             let mut lines = reader.lines();
             let pkg_id = package_id.to_string();
             let state_mgr = self.state_manager.clone();
 
-            while let Ok(Some(line)) = lines.next_line().await {
-                if let Some((downloaded, total)) = parse_pull_progress(&line) {
-                    Self::update_install_progress(&state_mgr, &pkg_id, downloaded, total).await;
+            Some(tokio::spawn(async move {
+                while let Ok(Some(line)) = lines.next_line().await {
+                    if let Some((downloaded, total)) = parse_pull_progress(&line) {
+                        Self::update_install_progress(&state_mgr, &pkg_id, downloaded, total).await;
+                    }
                 }
-            }
-        }
+            }))
+        } else {
+            None
+        };
 
-        let status = child
-            .wait()
-            .await
-            .context("Failed to wait for image pull")?;
+        let status = match tokio::time::timeout(PODMAN_UPDATE_PULL_TIMEOUT, child.wait()).await {
+            Ok(result) => result.context("Failed to wait for image pull")?,
+            Err(_) => {
+                let _ = child.kill().await;
+                return Err(anyhow::anyhow!(
+                    "podman pull {} timed out after {}s",
+                    image,
+                    PODMAN_UPDATE_PULL_TIMEOUT.as_secs()
+                ));
+            }
+        };
+
+        if let Some(task) = progress_task {
+            let _ = task.await;
+        }
         if !status.success() {
             return Err(anyhow::anyhow!("podman pull {} failed", image));
         }
@@ -430,7 +448,6 @@ fn should_try_orchestrator_update(package_id: &str, orchestrator_available: bool
 
 fn orchestrator_update_app_id(package_id: &str) -> &str {
     match package_id {
-        "bitcoin-knots" => "bitcoin-core",
         "electrs" | "mempool-electrs" => "electrumx",
         _ => package_id,
     }
@@ -459,8 +476,8 @@ fn candidate_app_ids_for_container(container_name: &str) -> Vec<String> {
 
     match container_name {
         "bitcoin-knots" | "bitcoin-core" => {
-            push("bitcoin-core");
             push("bitcoin-knots");
+            push("bitcoin-core");
         }
         "archy-bitcoin-ui" => push("bitcoin-ui"),
         "archy-lnd-ui" => push("lnd-ui"),
@@ -525,7 +542,7 @@ mod tests {
     fn container_name_candidates_cover_common_aliases() {
         assert_eq!(
             candidate_app_ids_for_container("bitcoin-knots"),
-            vec!["bitcoin-core", "bitcoin-knots"]
+            vec!["bitcoin-knots", "bitcoin-core"]
         );
         assert_eq!(
             candidate_app_ids_for_container("archy-bitcoin-ui"),
@@ -543,7 +560,8 @@ mod tests {
 
     #[test]
     fn update_aliases_map_to_manifest_app_ids() {
-        assert_eq!(orchestrator_update_app_id("bitcoin-knots"), "bitcoin-core");
+        assert_eq!(orchestrator_update_app_id("bitcoin-knots"), "bitcoin-knots");
+        assert_eq!(orchestrator_update_app_id("bitcoin-core"), "bitcoin-core");
         assert_eq!(orchestrator_update_app_id("electrs"), "electrumx");
         assert_eq!(orchestrator_update_app_id("mempool-electrs"), "electrumx");
         assert_eq!(orchestrator_update_app_id("fedimint"), "fedimint");

core/archipelago/src/api/rpc/system/handlers.rs

@@ -1,7 +1,7 @@
 use super::*;
 use crate::api::rpc::RpcHandler;
 use anyhow::{Context, Result};
-use tracing::{debug, info};
+use tracing::{debug, info, warn};
 
 impl RpcHandler {
     /// server.set-name — Rename the server (persisted to data_dir/server-name)
@@ -32,6 +32,21 @@ impl RpcHandler {
         data.server_info.name = Some(name.clone());
         self.state_manager.update_data(data).await;
 
+        let hostname = hostname_from_server_name(&name);
+        let hostname_result = set_system_hostname(&hostname).await;
+        let (hostname_updated, hostname_error) = match hostname_result {
+            Ok(()) => (true, None),
+            Err(e) => {
+                warn!(
+                    name = %name,
+                    hostname = %hostname,
+                    "Server name persisted but OS hostname update failed: {}",
+                    e
+                );
+                (false, Some(e.to_string()))
+            }
+        };
+
         info!("Server name updated to: {}", name);
 
         // Push the new name to federation peers in background
@@ -43,7 +58,12 @@ impl RpcHandler {
             }
         });
 
-        Ok(serde_json::json!({ "name": name }))
+        Ok(serde_json::json!({
+            "name": name,
+            "hostname": hostname,
+            "hostname_updated": hostname_updated,
+            "hostname_error": hostname_error,
+        }))
     }
 
     /// system.stats — CPU usage, RAM used/total, disk used/total, uptime, load average
@@ -155,21 +175,7 @@ impl RpcHandler {
         let mut freed_bytes: u64 = 0;
         let mut actions: Vec<String> = Vec::new();
 
-        // 1. Prune dangling container images
-        match prune_container_images().await {
-            Ok(bytes) => {
-                if bytes > 0 {
-                    freed_bytes += bytes;
-                    actions.push(format!(
-                        "Pruned dangling images: {} freed",
-                        format_bytes(bytes)
-                    ));
-                }
-            }
-            Err(e) => actions.push(format!("Image prune failed: {}", e)),
-        }
-
-        // 2. Clean old log files (> 30 days)
+        // 1. Clean old log files (> 30 days)
         match clean_old_logs(30).await {
             Ok(bytes) => {
                 if bytes > 0 {
@@ -180,7 +186,20 @@ impl RpcHandler {
             Err(e) => actions.push(format!("Log cleanup failed: {}", e)),
         }
 
-        // 3. Remove stale temp files
+        match vacuum_journal_logs("200M").await {
+            Ok(bytes) => {
+                if bytes > 0 {
+                    freed_bytes += bytes;
+                    actions.push(format!(
+                        "Vacuumed journal logs: {} freed",
+                        format_bytes(bytes)
+                    ));
+                }
+            }
+            Err(e) => actions.push(format!("Journal cleanup failed: {}", e)),
+        }
+
+        // 2. Remove stale temp files
         match clean_temp_files().await {
             Ok(bytes) => {
                 if bytes > 0 {
@@ -191,17 +210,53 @@ impl RpcHandler {
             Err(e) => actions.push(format!("Temp cleanup failed: {}", e)),
         }
 
-        // 4. Prune container build cache
-        match prune_build_cache().await {
+        // 3. Keep only the most recent backend deploy backups. These are useful
+        // for rollback, but a long-lived alpha node can accumulate gigabytes of
+        // old binaries under /usr/local/bin.
+        match clean_backend_backups(3).await {
             Ok(bytes) => {
                 if bytes > 0 {
                     freed_bytes += bytes;
-                    actions.push(format!("Pruned build cache: {} freed", format_bytes(bytes)));
+                    actions.push(format!(
+                        "Removed old backend backups: {} freed",
+                        format_bytes(bytes)
+                    ));
                 }
             }
-            Err(e) => actions.push(format!("Build cache prune failed: {}", e)),
+            Err(e) => actions.push(format!("Backend backup cleanup failed: {}", e)),
         }
 
+        match clean_legacy_backend_backups(3).await {
+            Ok(bytes) => {
+                if bytes > 0 {
+                    freed_bytes += bytes;
+                    actions.push(format!(
+                        "Removed old legacy backend backups: {} freed",
+                        format_bytes(bytes)
+                    ));
+                }
+            }
+            Err(e) => actions.push(format!("Legacy backend backup cleanup failed: {}", e)),
+        }
+
+        match clean_web_ui_backups(3).await {
+            Ok(bytes) => {
+                if bytes > 0 {
+                    freed_bytes += bytes;
+                    actions.push(format!(
+                        "Removed old web UI backups: {} freed",
+                        format_bytes(bytes)
+                    ));
+                }
+            }
+            Err(e) => actions.push(format!("Web UI backup cleanup failed: {}", e)),
+        }
+
+        actions.push(
+            "Skipped Podman image/volume prune: Podman store commands can block app health on busy nodes"
+                .to_string(),
+        );
+
         tracing::info!(
             "Disk cleanup complete: {} freed ({} actions)",
             format_bytes(freed_bytes),
@@ -216,6 +271,54 @@ impl RpcHandler {
     }
 }
 
+pub(super) fn hostname_from_server_name(name: &str) -> String {
+    let mut hostname = String::with_capacity(name.len());
+    let mut previous_dash = false;
+
+    for c in name.trim().chars().flat_map(char::to_lowercase) {
+        let valid = c.is_ascii_lowercase() || c.is_ascii_digit();
+        if valid {
+            hostname.push(c);
+            previous_dash = false;
+        } else if !previous_dash {
+            hostname.push('-');
+            previous_dash = true;
+        }
+        if hostname.len() >= 63 {
+            break;
+        }
+    }
+
+    let hostname = hostname.trim_matches('-').to_string();
+    if hostname.is_empty() {
+        "archipelago".to_string()
+    } else {
+        hostname
+    }
+}
+
+async fn set_system_hostname(hostname: &str) -> Result<()> {
+    let output = tokio::process::Command::new("/usr/bin/sudo")
+        .args(["-n", "/usr/bin/hostnamectl", "set-hostname", hostname])
+        .output()
+        .await
+        .context("Failed to run hostnamectl")?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+        anyhow::bail!(
+            "{}",
+            if stderr.is_empty() {
+                "hostnamectl failed".to_string()
+            } else {
+                stderr
+            }
+        );
+    }
+
+    Ok(())
+}
+
 impl RpcHandler {
     /// system.factory-reset — Wipe all user data, remove containers, and restart.
     /// Only preserves the data_dir itself (recreated empty on restart).

core/archipelago/src/api/rpc/system/mod.rs

@@ -1,6 +1,9 @@
 mod handlers;
 
+use crate::update::host_sudo;
 use anyhow::{Context, Result};
+use std::path::{Path, PathBuf};
+use std::time::SystemTime;
 use tracing::{debug, info};
 
 /// Push the server name to all federation peers by syncing state.
@@ -301,53 +304,12 @@ pub(super) async fn detect_usb_hardware_wallets() -> Result<Vec<serde_json::Valu
     Ok(devices)
 }
 
-/// Prune dangling container images via `podman image prune -f`.
-/// Returns estimated bytes freed.
-pub(super) async fn prune_container_images() -> Result<u64> {
-    let output = tokio::process::Command::new("podman")
-        .args(["image", "prune", "-f"])
-        .output()
-        .await
-        .context("Failed to run podman image prune")?;
-
-    if !output.status.success() {
-        anyhow::bail!(
-            "podman image prune failed: {}",
-            String::from_utf8_lossy(&output.stderr)
-        );
-    }
-
-    // Podman outputs image IDs, estimate ~100MB per pruned image
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    let pruned_count = stdout.lines().filter(|l| !l.trim().is_empty()).count();
-    Ok(pruned_count as u64 * 100_000_000) // rough estimate
-}
-
-/// Prune container build cache via `podman system prune -f`.
-pub(super) async fn prune_build_cache() -> Result<u64> {
-    // Just prune volumes and build cache (not containers or images — those are handled above)
-    let output = tokio::process::Command::new("podman")
-        .args(["volume", "prune", "-f"])
-        .output()
-        .await
-        .context("Failed to run podman volume prune")?;
-
-    if !output.status.success() {
-        anyhow::bail!(
-            "podman volume prune failed: {}",
-            String::from_utf8_lossy(&output.stderr)
-        );
-    }
-
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    let pruned_count = stdout.lines().filter(|l| !l.trim().is_empty()).count();
-    Ok(pruned_count as u64 * 10_000_000) // rough estimate per volume
-}
-
 /// Clean log files older than `max_age_days` from common log directories.
 pub(super) async fn clean_old_logs(max_age_days: u64) -> Result<u64> {
-    let output = tokio::process::Command::new("sudo")
+    let output = tokio::process::Command::new("timeout")
         .args([
+            "60s",
+            "sudo",
             "find",
             "/var/log",
             "-type",
@@ -366,8 +328,10 @@ pub(super) async fn clean_old_logs(max_age_days: u64) -> Result<u64> {
     let stdout = String::from_utf8_lossy(&output.stdout);
     let deleted_count = stdout.lines().filter(|l| !l.trim().is_empty()).count();
     // Also clean rotated/compressed logs
-    let _ = tokio::process::Command::new("sudo")
+    let _ = tokio::process::Command::new("timeout")
         .args([
+            "60s",
+            "sudo",
             "find",
             "/var/log",
             "-type",
@@ -384,14 +348,81 @@ pub(super) async fn clean_old_logs(max_age_days: u64) -> Result<u64> {
     Ok(deleted_count as u64 * 500_000) // rough estimate per log file
 }
 
+/// Vacuum systemd journals to a bounded size. Returns measured bytes freed.
+pub(super) async fn vacuum_journal_logs(max_size: &str) -> Result<u64> {
+    let before = journal_disk_usage().await.unwrap_or(0);
+    let output = tokio::process::Command::new("timeout")
+        .args(["60s", "sudo", "journalctl", "--vacuum-size", max_size])
+        .output()
+        .await
+        .context("Failed to run journal vacuum")?;
+
+    if !output.status.success() {
+        anyhow::bail!(
+            "journal vacuum failed: {}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+    }
+
+    let after = journal_disk_usage().await.unwrap_or(before);
+    Ok(before.saturating_sub(after))
+}
+
+async fn journal_disk_usage() -> Result<u64> {
+    let output = tokio::process::Command::new("sudo")
+        .args(["-n", "journalctl", "--disk-usage"])
+        .output()
+        .await
+        .context("Failed to read journal disk usage")?;
+
+    if !output.status.success() {
+        anyhow::bail!(
+            "journalctl --disk-usage failed: {}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+    }
+
+    parse_journal_disk_usage(&String::from_utf8_lossy(&output.stdout))
+        .ok_or_else(|| anyhow::anyhow!("could not parse journal disk usage"))
+}
+
+fn parse_journal_disk_usage(output: &str) -> Option<u64> {
+    let mut parts = output.split_whitespace();
+    while let Some(part) = parts.next() {
+        let (number, inline_unit) = split_number_unit(part);
+        let Ok(value) = number.parse::<f64>() else {
+            continue;
+        };
+        let unit = inline_unit.unwrap_or_else(|| parts.next().unwrap_or_default());
+        let multiplier = match unit {
+            "B" | "bytes" => 1.0,
+            "K" | "KB" | "KiB" => 1024.0,
+            "M" | "MB" | "MiB" => 1024.0 * 1024.0,
+            "G" | "GB" | "GiB" => 1024.0 * 1024.0 * 1024.0,
+            _ => continue,
+        };
+        return Some((value * multiplier) as u64);
+    }
+    None
+}
+
+fn split_number_unit(value: &str) -> (&str, Option<&str>) {
+    let split_at = value
+        .char_indices()
+        .find_map(|(idx, ch)| (!ch.is_ascii_digit() && ch != '.').then_some(idx))
+        .unwrap_or(value.len());
+    let (number, unit) = value.split_at(split_at);
+    (number, (!unit.is_empty()).then_some(unit))
+}
+
 /// Remove stale temp files from /tmp and /var/tmp.
 pub(super) async fn clean_temp_files() -> Result<u64> {
     let mut freed = 0u64;
 
     for dir in &["/tmp", "/var/tmp"] {
-        let output = tokio::process::Command::new("sudo")
+        let output = tokio::process::Command::new("timeout")
             .args([
-                "find", dir, "-type", "f", "-mtime", "+7", "-delete", "-print",
+                "45s", "sudo", "find", dir, "-type", "f", "-mtime", "+7", "-delete", "-print",
             ])
             .output()
             .await;
@@ -406,6 +437,177 @@ pub(super) async fn clean_temp_files() -> Result<u64> {
     Ok(freed)
 }
 
+/// Keep the newest timestamped backend backups and remove older ones.
+pub(super) async fn clean_backend_backups(keep: usize) -> Result<u64> {
+    clean_backend_backups_in(Path::new("/usr/local/bin"), keep).await
+}
+
+/// Keep the newest legacy backend backups and remove older alpha-era deploy artifacts.
+pub(super) async fn clean_legacy_backend_backups(keep: usize) -> Result<u64> {
+    clean_named_backups_in(
+        Path::new("/usr/local/bin"),
+        keep,
+        |name| name.starts_with("archipelago.bak") || name.starts_with("archipelago.before-"),
+        false,
+    )
+    .await
+}
+
+/// Keep the newest web UI rollback backups and remove older copies.
+pub(super) async fn clean_web_ui_backups(keep: usize) -> Result<u64> {
+    clean_named_backups_in(
+        Path::new("/opt/archipelago"),
+        keep,
+        |name| name.starts_with("web-ui.bak") || name == "web-ui.old",
+        true,
+    )
+    .await
+}
+
+async fn clean_backend_backups_in(dir: &Path, keep: usize) -> Result<u64> {
+    let mut backups = backend_backup_candidates(dir).await?;
+    remove_old_backups(&mut backups, keep, false).await
+}
+
+async fn clean_named_backups_in(
+    dir: &Path,
+    keep: usize,
+    matches_name: impl Fn(&str) -> bool,
+    allow_dirs: bool,
+) -> Result<u64> {
+    let mut backups = named_backup_candidates(dir, matches_name, allow_dirs).await?;
+    remove_old_backups(&mut backups, keep, allow_dirs).await
+}
+
+async fn remove_old_backups(
+    backups: &mut Vec<BackupArtifact>,
+    keep: usize,
+    allow_dirs: bool,
+) -> Result<u64> {
+    backups.sort_by(|a, b| {
+        b.modified
+            .cmp(&a.modified)
+            .then_with(|| b.name.cmp(&a.name))
+    });
+
+    let mut freed = 0u64;
+    for backup in backups.iter().skip(keep) {
+        let remove_result = if backup.is_dir && allow_dirs {
+            tokio::fs::remove_dir_all(&backup.path).await
+        } else {
+            tokio::fs::remove_file(&backup.path).await
+        };
+        match remove_result {
+            Ok(()) => freed += backup.size,
+            Err(_) => {
+                remove_path_with_sudo(&backup.path, backup.is_dir && allow_dirs).await?;
+                freed += backup.size;
+            }
+        }
+    }
+    Ok(freed)
+}
+
+async fn remove_path_with_sudo(path: &Path, recursive: bool) -> Result<()> {
+    let path = path.to_string_lossy();
+    let args = if recursive {
+        vec!["rm", "-rf", path.as_ref()]
+    } else {
+        vec!["rm", "-f", path.as_ref()]
+    };
+    let status = host_sudo(&args)
+        .await
+        .with_context(|| format!("removing {path} via sudo"))?;
+    if !status.success() {
+        anyhow::bail!(
+            "sudo rm {} {path} exited with {status}",
+            if recursive { "-rf" } else { "-f" }
+        );
+    }
+    Ok(())
+}
+
+#[derive(Debug)]
+struct BackupArtifact {
+    path: PathBuf,
+    name: String,
+    modified: SystemTime,
+    size: u64,
+    is_dir: bool,
+}
+
+async fn backend_backup_candidates(dir: &Path) -> Result<Vec<BackupArtifact>> {
+    named_backup_candidates(
+        dir,
+        |name| {
+            name.strip_prefix("archipelago.backup-")
+                .is_some_and(|suffix| !suffix.is_empty() && !suffix.contains('/'))
+        },
+        false,
+    )
+    .await
+}
+
+async fn named_backup_candidates(
+    dir: &Path,
+    matches_name: impl Fn(&str) -> bool,
+    allow_dirs: bool,
+) -> Result<Vec<BackupArtifact>> {
+    let mut backups = Vec::new();
+    let mut entries = match tokio::fs::read_dir(dir).await {
+        Ok(entries) => entries,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(backups),
+        Err(e) => return Err(e).with_context(|| format!("reading {}", dir.display())),
+    };
+
+    while let Some(entry) = entries.next_entry().await? {
+        let file_name = entry.file_name();
+        let name = file_name.to_string_lossy();
+        if !matches_name(&name) {
+            continue;
+        }
+
+        let meta = entry.metadata().await?;
+        if !meta.is_file() && !(allow_dirs && meta.is_dir()) {
+            continue;
+        }
+
+        backups.push(BackupArtifact {
+            path: entry.path(),
+            name: name.to_string(),
+            modified: meta.modified().unwrap_or(SystemTime::UNIX_EPOCH),
+            size: path_size(&entry.path(), &meta).await.unwrap_or(meta.len()),
+            is_dir: meta.is_dir(),
+        });
+    }
+    Ok(backups)
+}
+
+async fn path_size(path: &Path, meta: &std::fs::Metadata) -> Result<u64> {
+    if meta.is_file() {
+        return Ok(meta.len());
+    }
+    if !meta.is_dir() {
+        return Ok(0);
+    }
+
+    let output = tokio::process::Command::new("du")
+        .args(["-sb", &path.to_string_lossy()])
+        .output()
+        .await
+        .with_context(|| format!("du -sb {}", path.display()))?;
+    if !output.status.success() {
+        anyhow::bail!("du -sb {} failed", path.display());
+    }
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    stdout
+        .split_whitespace()
+        .next()
+        .ok_or_else(|| anyhow::anyhow!("du output missing size for {}", path.display()))?
+        .parse::<u64>()
+        .with_context(|| format!("parse du size for {}", path.display()))
+}
+
 pub(super) fn format_bytes(bytes: u64) -> String {
     const KB: u64 = 1024;
     const MB: u64 = KB * 1024;
@@ -422,6 +624,103 @@ pub(super) fn format_bytes(bytes: u64) -> String {
     }
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn backend_backup_cleanup_keeps_newest_files() {
+        let dir = tempfile::tempdir().unwrap();
+        for name in [
+            "archipelago.backup-20260501",
+            "archipelago.backup-20260502",
+            "archipelago.backup-20260503",
+            "archipelago.backup-20260504",
+            "archipelago.backup-20260505",
+            "archipelago.bak",
+            "archipelago",
+        ] {
+            tokio::fs::write(dir.path().join(name), b"12345")
+                .await
+                .unwrap();
+        }
+
+        let freed = clean_backend_backups_in(dir.path(), 3).await.unwrap();
+
+        assert_eq!(freed, 10);
+        assert!(!dir.path().join("archipelago.backup-20260501").exists());
+        assert!(!dir.path().join("archipelago.backup-20260502").exists());
+        assert!(dir.path().join("archipelago.backup-20260503").exists());
+        assert!(dir.path().join("archipelago.backup-20260504").exists());
+        assert!(dir.path().join("archipelago.backup-20260505").exists());
+        assert!(dir.path().join("archipelago.bak").exists());
+        assert!(dir.path().join("archipelago").exists());
+    }
+
+    #[tokio::test]
+    async fn legacy_backend_backup_cleanup_keeps_newest_matching_files() {
+        let dir = tempfile::tempdir().unwrap();
+        for name in [
+            "archipelago.bak-1",
+            "archipelago.bak-2",
+            "archipelago.before-3",
+            "archipelago.backup-keep-separate",
+            "archipelago",
+        ] {
+            tokio::fs::write(dir.path().join(name), b"12345")
+                .await
+                .unwrap();
+        }
+
+        let freed = clean_named_backups_in(
+            dir.path(),
+            1,
+            |name| name.starts_with("archipelago.bak") || name.starts_with("archipelago.before-"),
+            false,
+        )
+        .await
+        .unwrap();
+
+        assert_eq!(freed, 10);
+        assert_eq!(
+            [
+                "archipelago.bak-1",
+                "archipelago.bak-2",
+                "archipelago.before-3"
+            ]
+            .into_iter()
+            .filter(|name| dir.path().join(name).exists())
+            .count(),
+            1
+        );
+        assert!(dir.path().join("archipelago.backup-keep-separate").exists());
+        assert!(dir.path().join("archipelago").exists());
+    }
+
+    #[test]
+    fn hostname_from_server_name_derives_linux_safe_hostname() {
+        assert_eq!(
+            handlers::hostname_from_server_name("My Archipelago Node"),
+            "my-archipelago-node"
+        );
+        assert_eq!(
+            handlers::hostname_from_server_name("Kitchen_Node!! 01"),
+            "kitchen-node-01"
+        );
+        assert_eq!(handlers::hostname_from_server_name("!!!"), "archipelago");
+    }
+
+    #[test]
+    fn parses_journal_disk_usage() {
+        assert_eq!(
+            parse_journal_disk_usage(
+                "Archived and active journals take up 463.9M in the file system."
+            ),
+            Some(486_434_406)
+        );
+    }
+}
+
 /// Read temperatures from /sys/class/thermal/thermal_zone*/temp.
 pub(super) async fn read_temperatures() -> Result<Vec<serde_json::Value>> {
     let mut temps = Vec::new();