From d0d9c032decc29359a43cce791b8e6cfe1401057 Mon Sep 17 00:00:00 2001 From: archipelago Date: Wed, 5 Aug 2026 21:22:07 -0400 Subject: [PATCH] fix(apps): session_passthrough on companion UI ports; indeedhub-redis caps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - lnd-ui/bitcoin-ui/electrs-ui/fips-ui declare session_passthrough: true on their gated ports — their nginx forwards the browser's node session to the daemon's authenticated endpoints, which the gate's cookie strip was discarding (every data call 401'd behind the gate). - indeedhub-redis gains CHOWN + DAC_OVERRIDE: the alpine entrypoint runs as capability-stripped container-root and could not traverse the 0700 appendonlydir owned by the redis uid — crash-looped ~4k restarts on archi-dev-box under the quadlet migration. These reach nodes via the signed catalog re-sign (manifest overlay). Co-Authored-By: Claude Fable 5 --- apps/bitcoin-ui/manifest.yml | 4 ++++ apps/electrs-ui/manifest.yml | 4 ++++ apps/fips-ui/manifest.yml | 4 ++++ apps/indeedhub-redis/manifest.yml | 8 +++++++- apps/lnd-ui/manifest.yml | 4 ++++ 5 files changed, 23 insertions(+), 1 deletion(-) diff --git a/apps/bitcoin-ui/manifest.yml b/apps/bitcoin-ui/manifest.yml index 6fb05656..fc96095b 100644 --- a/apps/bitcoin-ui/manifest.yml +++ b/apps/bitcoin-ui/manifest.yml @@ -43,6 +43,10 @@ app: protocol: tcp bind: 127.0.0.1 auth: gated + # First-party companion UI: its nginx forwards the node session cookie + # to the daemon's authenticated endpoints; without passthrough the gate + # strips it and every data call 401s while the page shell renders. + session_passthrough: true volumes: # Bind-mount the rendered nginx.conf read-only. The prod orchestrator diff --git a/apps/electrs-ui/manifest.yml b/apps/electrs-ui/manifest.yml index 4f224565..d1bff168 100644 --- a/apps/electrs-ui/manifest.yml +++ b/apps/electrs-ui/manifest.yml @@ -35,6 +35,10 @@ app: protocol: tcp bind: 127.0.0.1 auth: gated + # First-party companion UI: its nginx forwards the node session cookie + # to the daemon's authenticated endpoints; without passthrough the gate + # strips it and every data call 401s while the page shell renders. + session_passthrough: true volumes: [] diff --git a/apps/fips-ui/manifest.yml b/apps/fips-ui/manifest.yml index e16c49f9..c4c8474a 100644 --- a/apps/fips-ui/manifest.yml +++ b/apps/fips-ui/manifest.yml @@ -39,6 +39,10 @@ app: protocol: tcp bind: 127.0.0.1 auth: gated + # First-party companion UI: its nginx forwards the node session cookie + # to the daemon's authenticated endpoints; without passthrough the gate + # strips it and every data call 401s while the page shell renders. + session_passthrough: true volumes: [] diff --git a/apps/indeedhub-redis/manifest.yml b/apps/indeedhub-redis/manifest.yml index c9997b0a..a2b84c29 100644 --- a/apps/indeedhub-redis/manifest.yml +++ b/apps/indeedhub-redis/manifest.yml @@ -22,7 +22,13 @@ app: memory_limit: 256Mi security: - capabilities: [SETGID, SETUID] + # The alpine entrypoint runs as container-root, `find`s /data to chown + # anything not owned by the redis user, then su-execs to it. Under the + # orchestrator's --cap-drop=ALL, root cannot traverse the 0700 + # appendonlydir owned by uid 999 without DAC_OVERRIDE (observed + # crash-looping ~4k restarts on archi-dev-box) — CHOWN is what the find's + # -exec chown needs on adopted legacy data. + capabilities: [CHOWN, DAC_OVERRIDE, SETGID, SETUID] readonly_root: false network_policy: isolated diff --git a/apps/lnd-ui/manifest.yml b/apps/lnd-ui/manifest.yml index cf186bcf..397f1b0b 100644 --- a/apps/lnd-ui/manifest.yml +++ b/apps/lnd-ui/manifest.yml @@ -47,6 +47,10 @@ app: protocol: tcp bind: 127.0.0.1 auth: gated + # First-party companion UI: its nginx forwards the node session cookie + # to the daemon's authenticated endpoints; without passthrough the gate + # strips it and every data call 401s while the page shell renders. + session_passthrough: true volumes: []