release(v1.7.37-alpha): bitcoin-core install fixes + dynamic node UI + full-archive default
Install flow - api/rpc/package/install.rs: always append the literal image URL as a last-resort pull candidate in do_pull_image, so images not carried by any configured mirror (docker.io/bitcoin/bitcoin:28.4) still install instead of masquerading as a generic pull failure across every mirror. - api/rpc/package/install.rs: write_bitcoin_conf now skips on any stat error, not just "file exists". Once bitcoin-knots' first-boot chowns /var/lib/archipelago/bitcoin into the container's user namespace (700 perms, UID 100100/100101), the archipelago daemon can't even traverse in — try_exists returns Err which unwrap_or(false) treated as "not present" and drove a doomed write. Now errors out of the directory traversal are treated as "conf already owned by container user" and the write is skipped. Mirrors the lnd.conf pattern. - api/rpc/package/install.rs: drop the hardcoded `prune=550` from the conf default. Operators with multi-TB drives shouldn't be silently pruned; users who want a pruned node can set it in bitcoin.conf themselves. Full archive is the only honest default. - api/rpc/package/config.rs: bitcoin-core now passes explicit -server/-rpcbind/-rpcallowip/-rpcport/-printtoconsole/-datadir CLI args. Vanilla bitcoin/bitcoin:28.4 has no entrypoint wrapper and reads conf + argv only; without these the RPC listens on 127.0.0.1 inside the container and rootlessport can't reach it, so the bitcoin-ui companion gets 502 on every /bitcoin-rpc/ call. Bitcoin Knots keeps its own entrypoint-driven defaults. - container/docker_packages.rs: split bitcoin-core out of the shared AppMetadata arm. bitcoin-core now surfaces as "Bitcoin Core" with bitcoin-core.svg and a Reference-implementation description; the bitcoin + bitcoin-knots ids keep the Knots branding. Fixes the home card showing "Bitcoin Knots" for a Core install. Bitcoin node UI (docker/bitcoin-ui) - index.html: impl name/tagline/logo now dynamic. applyImplBranding() reads subversion from getnetworkinfo — /Satoshi:X/Knots:Y/ resolves to Bitcoin Knots, plain /Satoshi:X/ resolves to Bitcoin Core. Both get their own icon and subtitle. Settings modal replaced its hardcoded Regtest/txindex=1/port-18443 placeholders with live values from getblockchaininfo + getindexinfo + getzmqnotifications. - index.html: new Storage info card (Full Archive · X GB / Pruned · X GB from blockchainInfo.pruned + size_on_disk) visible on the main dashboard, same level as Network. Settings modal mirrors it with the prune height when applicable. - Dockerfile + assets/: bitcoin-core.svg, bitcoin-knots.webp, and the bg-network.jpg used by the dashboard are now COPY'd into the image under /usr/share/nginx/html/assets. Previously the <img src> pointed at paths that 404'd into the SPA fallback and the onerror handler hid the broken logo silently. Frontend - appSession/appSessionConfig.ts: add bitcoin-core to APP_PORTS (8334), HTTPS_PROXY_PATHS (/app/bitcoin-ui/), and APP_TITLES (Bitcoin Core). Without these the AppSessionFrame showed "No URL found for bitcoin-core" and the home/app-list title fell through to the raw id. - settings/AccountInfoSection.vue: backfill What's New entries for v1.7.31 through v1.7.37 that had been missed in earlier cuts. Release plumbing - releases/v1.7.37-alpha/: binary + frontend tarball. - releases/manifest.json: v1.7.37-alpha, sha256/size refreshed. - Cargo.toml / package.json: version bumps. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Dorian
co-authored by
Claude Opus 4.7
Claude Opus 4.7
parent
e206e1fc94
commit
cfc98c600e
@@ -1,15 +1,18 @@
|
||||
//! Bootstrap host-side doctor artifacts on every archipelago startup.
|
||||
//! Bootstrap host-side artifacts on every archipelago startup.
|
||||
//!
|
||||
//! The update pipeline swaps the archipelago binary but does not touch
|
||||
//! scripts or systemd units — those are installed once by the ISO builder.
|
||||
//! Without this module, changes to `container-doctor.sh` or the doctor
|
||||
//! service/timer never reach boxes installed before the change.
|
||||
//! scripts, systemd units, or nginx configuration — those are installed
|
||||
//! once by the ISO builder. Without this module, changes to
|
||||
//! `container-doctor.sh`, the doctor service/timer, or the nginx config
|
||||
//! never reach boxes installed before the change.
|
||||
//!
|
||||
//! On startup we compare three embedded files against their on-disk
|
||||
//! copies and rewrite any that differ, then enable the doctor timer if
|
||||
//! it isn't already. Idempotent: no-ops on boxes that match the
|
||||
//! embedded version. All work is best-effort — failures are logged but
|
||||
//! never abort the backend.
|
||||
//! Two things are synced on startup:
|
||||
//! 1. Doctor artifacts (container-doctor.sh + service + timer).
|
||||
//! 2. An nginx `location /api/app-catalog` proxy block — required for
|
||||
//! the App Store catalog proxy to actually reach the backend.
|
||||
//!
|
||||
//! Idempotent: no-ops on boxes that are already in sync. All work is
|
||||
//! best-effort — failures are logged but never abort the backend.
|
||||
|
||||
use anyhow::{Context, Result};
|
||||
use std::path::Path;
|
||||
@@ -28,14 +31,26 @@ const DOCTOR_SH_PATH: &str = "/home/archipelago/archy/scripts/container-doctor.s
|
||||
const DOCTOR_SERVICE_PATH: &str = "/etc/systemd/system/archipelago-doctor.service";
|
||||
const DOCTOR_TIMER_PATH: &str = "/etc/systemd/system/archipelago-doctor.timer";
|
||||
|
||||
const NGINX_CONF_PATH: &str = "/etc/nginx/sites-available/archipelago";
|
||||
|
||||
/// Inserted into every server block of the nginx config that lacks the
|
||||
/// `/api/app-catalog` proxy. Kept in sync with the canonical block in
|
||||
/// image-recipe/configs/nginx-archipelago.conf.
|
||||
const NGINX_APP_CATALOG_BLOCK: &str = "\n # App Store catalog proxy — backend fetches from configured registries\n # so the browser doesn't hit CORS/CSP. Without this block nginx falls\n # through to the SPA index.html and the frontend gets HTML back instead\n # of JSON.\n location /api/app-catalog {\n proxy_pass http://127.0.0.1:5678;\n proxy_http_version 1.1;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header Cookie $http_cookie;\n proxy_connect_timeout 15s;\n proxy_read_timeout 30s;\n proxy_send_timeout 15s;\n error_page 502 503 = @backend_unavailable;\n error_page 504 = @backend_timeout;\n }\n\n";
|
||||
|
||||
/// Entry point called from main startup. Never returns an error to the caller —
|
||||
/// failing to bootstrap the doctor must not prevent the backend from serving.
|
||||
/// failing to bootstrap host artifacts must not prevent the backend from serving.
|
||||
pub async fn ensure_doctor_installed() {
|
||||
match run().await {
|
||||
Ok(changed) if changed => info!("Doctor artifacts synchronized with binary"),
|
||||
Ok(_) => debug!("Doctor artifacts already in sync"),
|
||||
Err(e) => warn!("Doctor bootstrap failed (non-fatal): {:#}", e),
|
||||
}
|
||||
match run_nginx().await {
|
||||
Ok(true) => info!("Patched nginx config to proxy /api/app-catalog"),
|
||||
Ok(false) => debug!("Nginx already has /api/app-catalog block"),
|
||||
Err(e) => warn!("Nginx bootstrap failed (non-fatal): {:#}", e),
|
||||
}
|
||||
}
|
||||
|
||||
async fn run() -> Result<bool> {
|
||||
@@ -150,3 +165,100 @@ async fn is_timer_enabled() -> bool {
|
||||
.map(|s| s.success())
|
||||
.unwrap_or(false)
|
||||
}
|
||||
|
||||
/// Patch the nginx site config to add a `/api/app-catalog` proxy block if
|
||||
/// it's missing. The original ISO shipped individual per-endpoint `location`
|
||||
/// blocks and no catch-all `/api/`, so `/api/app-catalog` silently fell
|
||||
/// through to the SPA `index.html` and the frontend got HTML instead of
|
||||
/// JSON. We anchor the insert to the DWN comment that already sits right
|
||||
/// after the `/api/blob` block, so the new block lands in both the HTTP
|
||||
/// and HTTPS server blocks.
|
||||
///
|
||||
/// Validates via `nginx -t` before reloading. On failure the patch is
|
||||
/// rolled back from a backup written just before the write.
|
||||
async fn run_nginx() -> Result<bool> {
|
||||
// Skip on dev symlinks — we don't want to touch `/etc/nginx` on laptops.
|
||||
let home_archy = Path::new("/home/archipelago/archy");
|
||||
if fs::symlink_metadata(home_archy)
|
||||
.await
|
||||
.map(|m| m.file_type().is_symlink())
|
||||
.unwrap_or(false)
|
||||
{
|
||||
return Ok(false);
|
||||
}
|
||||
|
||||
if !Path::new(NGINX_CONF_PATH).exists() {
|
||||
debug!(
|
||||
"{} missing — skipping nginx bootstrap",
|
||||
NGINX_CONF_PATH
|
||||
);
|
||||
return Ok(false);
|
||||
}
|
||||
|
||||
let content = fs::read_to_string(NGINX_CONF_PATH)
|
||||
.await
|
||||
.with_context(|| format!("read {}", NGINX_CONF_PATH))?;
|
||||
if content.contains("location /api/app-catalog") {
|
||||
return Ok(false);
|
||||
}
|
||||
|
||||
// The DWN comment sits at the same indent right after the `/api/blob`
|
||||
// block in both server blocks — a stable anchor that existed on every
|
||||
// ISO shipped to date. If it's absent (config got heavily customized),
|
||||
// we bail rather than guess where to splice.
|
||||
let anchor = " # DWN endpoints — peer access over Tor (no auth)";
|
||||
if !content.contains(anchor) {
|
||||
warn!("nginx conf missing DWN anchor — skipping /api/app-catalog patch");
|
||||
return Ok(false);
|
||||
}
|
||||
|
||||
let replacement = format!("{}{}", NGINX_APP_CATALOG_BLOCK, anchor);
|
||||
let patched = content.replace(anchor, &replacement);
|
||||
|
||||
// Write patched config via a user-owned tmp + sudo mv, after stashing
|
||||
// a backup so we can revert if `nginx -t` hates what we produced.
|
||||
let pid = std::process::id();
|
||||
let tmp = format!("/tmp/archipelago-nginx-{}.conf", pid);
|
||||
fs::write(&tmp, &patched)
|
||||
.await
|
||||
.with_context(|| format!("write {}", tmp))?;
|
||||
|
||||
let backup = format!("/tmp/archipelago-nginx-backup-{}.conf", pid);
|
||||
if let Err(e) = host_sudo(&["cp", NGINX_CONF_PATH, &backup]).await {
|
||||
let _ = fs::remove_file(&tmp).await;
|
||||
return Err(e.context("backup nginx conf"));
|
||||
}
|
||||
|
||||
let mv = host_sudo(&["mv", &tmp, NGINX_CONF_PATH]).await;
|
||||
match mv {
|
||||
Ok(s) if s.success() => {}
|
||||
Ok(s) => {
|
||||
let _ = fs::remove_file(&tmp).await;
|
||||
anyhow::bail!("sudo mv nginx conf exited with {}", s);
|
||||
}
|
||||
Err(e) => {
|
||||
let _ = fs::remove_file(&tmp).await;
|
||||
return Err(e.context("mv tmp -> nginx conf"));
|
||||
}
|
||||
}
|
||||
|
||||
// Validate.
|
||||
let test = host_sudo(&["nginx", "-t"]).await;
|
||||
let valid = matches!(&test, Ok(s) if s.success());
|
||||
if !valid {
|
||||
warn!("nginx -t failed after patch — reverting");
|
||||
let _ = host_sudo(&["mv", &backup, NGINX_CONF_PATH]).await;
|
||||
if let Err(e) = test {
|
||||
return Err(e.context("nginx -t"));
|
||||
}
|
||||
anyhow::bail!("nginx config invalid after patch — reverted");
|
||||
}
|
||||
|
||||
// Reload nginx so the new block takes effect immediately. Reload (not
|
||||
// restart) keeps in-flight connections alive.
|
||||
if let Err(e) = host_sudo(&["systemctl", "reload", "nginx"]).await {
|
||||
warn!("nginx reload failed (non-fatal): {:#}", e);
|
||||
}
|
||||
let _ = host_sudo(&["rm", "-f", &backup]).await;
|
||||
Ok(true)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user