Merge PR #157: Cuprate disk gate and companion dashboard

core/archipelago/src/api/rpc/package/async_lifecycle.rs

@@ -55,6 +55,7 @@ impl RpcHandler {
             .to_string();
         super::validation::validate_app_id(&package_id)?;
         super::dependencies::check_bitcoin_pruning_compatibility(&package_id).await?;
+        super::dependencies::check_cuprate_disk_compatibility(&package_id).await?;
 
         // Reject if already in a transitional lifecycle (prevents double-click
         // queuing two installs on the same package).
@@ -294,6 +295,12 @@ impl RpcHandler {
             .ok_or_else(|| anyhow::anyhow!("Missing package id"))?
             .to_string();
         super::validation::validate_app_id(&package_id)?;
+        // Update is stop → pull → remove → recreate, i.e. a fresh start by
+        // another name: on a disk that shrank since install it would resume
+        // cuprate's unprunable sync unchecked. Same gate as install and
+        // start, run BEFORE the Updating flip so a refusal leaves the app
+        // cleanly in its previous state.
+        super::dependencies::check_cuprate_disk_compatibility(&package_id).await?;
 
         // Reject if already in a transitional lifecycle.
         {

core/archipelago/src/api/rpc/package/dependencies.rs

@@ -670,6 +670,50 @@ async fn detect_disk_gb() -> u64 {
         .unwrap_or(u64::MAX)
 }
 
+/// Smallest disk (GB, total) a cuprate node can live on. The value and its
+/// rationale live in ONE place — `crate::constants::CUPRATE_MIN_DISK_GB` —
+/// shared with the boot reconciler so install/start and boot can never
+/// disagree about where cuprate may run.
+use crate::constants::CUPRATE_MIN_DISK_GB;
+
+/// The bitcoin apps pick `-prune` automatically when disk is scarce, because
+/// bitcoind supports pruning. Cuprate CANNOT: upstream has no pruning config
+/// at all (the `pruning` crate in its workspace is Monero's p2p *protocol*
+/// pruning, not on-disk pruning), so the disk-scarce equivalent is to refuse
+/// to run cuprate at all rather than let it sync until the filesystem fills —
+/// which took Archipelago itself down on nodes with too little disk.
+fn cuprate_insufficient_disk_message(disk_gb: u64) -> String {
+    format!(
+        "Cuprate needs a disk of at least {} GB and this node has {} GB. \
+         A Monero node cannot run pruned — upstream cuprate has no pruning \
+         support — so the chain (~250 GB and growing) would fill the disk and \
+         take Archipelago down with it. Attach a larger disk (or move \
+         /var/lib/archipelago to one) and try again. Bitcoin apps CAN run \
+         pruned on smaller disks; Monero currently cannot.",
+        CUPRATE_MIN_DISK_GB, disk_gb
+    )
+}
+
+/// Pure decision half of the cuprate disk gate — testable without df.
+pub(super) fn cuprate_disk_gate(disk_gb: u64) -> Option<String> {
+    (disk_gb < CUPRATE_MIN_DISK_GB).then(|| cuprate_insufficient_disk_message(disk_gb))
+}
+
+/// Install/start-time pre-check: refuse cuprate on disks too small to hold
+/// the Monero chain. Mirrors `check_bitcoin_pruning_compatibility`'s
+/// fail-open-on-unknown-disk behaviour (`detect_disk_gb` returns u64::MAX
+/// when df fails, so an unreadable disk never blocks an install).
+pub(super) async fn check_cuprate_disk_compatibility(package_id: &str) -> Result<()> {
+    if package_id != "cuprate" {
+        return Ok(());
+    }
+    let disk_gb = detect_disk_gb().await;
+    if let Some(message) = cuprate_disk_gate(disk_gb) {
+        anyhow::bail!(message);
+    }
+    Ok(())
+}
+
 /// Log informational messages about optional dependencies.
 pub(super) fn log_optional_dep_info(package_id: &str, deps: &RunningDeps) {
     if matches!(package_id, "btcpay-server" | "btcpayserver") && !deps.has_lnd {
@@ -873,9 +917,9 @@ pub(super) fn configure_fedimint_lnd(
 #[cfg(test)]
 mod tests {
     use super::{
-        bitcoin_is_warming_up, dependency_list_declares_archival_bitcoin,
+        bitcoin_is_warming_up, cuprate_disk_gate, dependency_list_declares_archival_bitcoin,
         manifest_declares_archival_bitcoin, order_present_containers, requires_unpruned_bitcoin,
-        startup_order, BITCOIN_WARMUP_BUDGET,
+        startup_order, BITCOIN_WARMUP_BUDGET, CUPRATE_MIN_DISK_GB,
     };
     use archipelago_container::Dependency;
 
@@ -1017,6 +1061,37 @@ mod tests {
         assert!(!manifest_declares_archival_bitcoin("does-not-exist"));
     }
 
+    #[test]
+    fn cuprate_disk_gate_refuses_disks_too_small_for_the_monero_chain() {
+        // 250 GB VPS class: the ~250 GiB chain does not fit, full stop.
+        assert!(cuprate_disk_gate(0).is_some());
+        assert!(cuprate_disk_gate(250).is_some());
+        assert!(cuprate_disk_gate(CUPRATE_MIN_DISK_GB - 1).is_some());
+        assert!(cuprate_disk_gate(CUPRATE_MIN_DISK_GB).is_none());
+        assert!(cuprate_disk_gate(1000).is_none());
+        // df failure reads as u64::MAX — an unreadable disk must not block.
+        assert!(cuprate_disk_gate(u64::MAX).is_none());
+    }
+
+    #[test]
+    fn cuprate_disk_gate_message_names_the_fix_not_just_the_problem() {
+        let msg = cuprate_disk_gate(250).expect("250 GB must be refused");
+        assert!(msg.contains("cannot run pruned"), "{msg}");
+        assert!(msg.contains("larger disk"), "{msg}");
+        assert!(msg.contains("250 GB"), "{msg}");
+    }
+
+    #[tokio::test]
+    async fn cuprate_disk_gate_only_applies_to_cuprate() {
+        // Every other package passes regardless of disk — including the
+        // bitcoin apps, which self-prune via their manifest entrypoint.
+        for package_id in ["bitcoin-knots", "bitcoin-core", "electrumx", "mempool"] {
+            super::check_cuprate_disk_compatibility(package_id)
+                .await
+                .expect("non-cuprate installs must not be gated here");
+        }
+    }
+
     mod dep_wait {
         use super::super::{wait_for_install_deps, DepProbe, DependencyGateError, RunningDeps};
         use std::sync::atomic::{AtomicU32, Ordering};

core/archipelago/src/api/rpc/package/install.rs

@@ -3,10 +3,10 @@ use super::config::{
     is_readonly_compatible, is_valid_docker_image,
 };
 use super::dependencies::{
-    check_bitcoin_pruning_compatibility, configure_fedimint_lnd, detect_existing_containers,
-    detect_running_deps, detect_running_deps_from_package_data, log_optional_dep_info,
-    needs_archy_net, wait_for_install_deps, DepProbe, RunningDeps, DEP_WAIT_INTERVAL,
-    DEP_WAIT_MAX_ATTEMPTS,
+    check_bitcoin_pruning_compatibility, check_cuprate_disk_compatibility, configure_fedimint_lnd,
+    detect_existing_containers, detect_running_deps, detect_running_deps_from_package_data,
+    log_optional_dep_info, needs_archy_net, wait_for_install_deps, DepProbe, RunningDeps,
+    DEP_WAIT_INTERVAL, DEP_WAIT_MAX_ATTEMPTS,
 };
 use super::progress::parse_pull_progress;
 use super::validation::validate_app_id;
@@ -374,6 +374,7 @@ impl RpcHandler {
         // failing instantly.
         let deps = self.gate_install_deps(package_id).await?;
         check_bitcoin_pruning_compatibility(package_id).await?;
+        check_cuprate_disk_compatibility(package_id).await?;
         log_optional_dep_info(package_id, &deps);
         if matches!(package_id, "bitcoin" | "bitcoin-core" | "bitcoin-knots") {
             // Materialise the RPC password file before any install path

core/archipelago/src/api/rpc/package/runtime.rs

@@ -60,6 +60,12 @@ impl RpcHandler {
             .and_then(|v| v.as_str())
             .ok_or_else(|| anyhow::anyhow!("Missing package id"))?;
         validate_app_id(package_id)?;
+        // A cuprate node that starts on a too-small disk fills it and takes
+        // Archipelago down with it (no upstream pruning — see
+        // dependencies::check_cuprate_disk_compatibility). Fail the start
+        // before clearing user-stopped or flipping state, so the app stays
+        // cleanly stopped and the error carries the actionable message.
+        super::dependencies::check_cuprate_disk_compatibility(package_id).await?;
 
         let to_start = if self.orchestrator.is_some() && uses_single_orchestrator_app(package_id) {
             vec![orchestrator_app_id(package_id).to_string()]
@@ -251,6 +257,11 @@ impl RpcHandler {
             .and_then(|v| v.as_str())
             .ok_or_else(|| anyhow::anyhow!("Missing package id"))?;
         validate_app_id(package_id)?;
+        // Restart is stop + recreate, so on a disk that shrank below the cuprate
+        // minimum after install it resumes the doomed unprunable sync just like
+        // start would — same gate, same "fail before clearing user-stopped /
+        // flipping state" contract (see handle_package_start).
+        super::dependencies::check_cuprate_disk_compatibility(package_id).await?;
 
         let single_orchestrator_app =
             self.orchestrator.is_some() && uses_single_orchestrator_app(package_id);