lfg2025/archy
1
0
Fork 0
Code Issues 24 Pull Requests 1 Actions Packages Projects Releases 64 Wiki Activity

feat(security): bind Bitcoin RPC/ZMQ publishes to loopback + archy-net gateway (§C)

Browse Source 
USER DECISION 2026-07-08: accept breaking external wallets pointed at
nodeIP:8332. The 0.0.0.0 publish exposed auth-only RPC (and unauthenticated
ZMQ 28332/28333 on the legacy path) to the whole LAN.

- New `bind` field on manifest port mappings (validated as an IP; the same
  host port may repeat with distinct binds). Rendered as
  PublishPort=<ip>:<host>:<container> in quadlet units and host_ip in the
  podman API create — unbound ports render byte-identical to before, so no
  fleet-wide false-drift wave.
- bitcoin-knots/-core manifests publish 8332 on 127.0.0.1 + 10.89.0.1 only.
  In-node consumers (lnd, fedimint-gateway, btcpay/nbxplorer) are unaffected:
  they dial host.archipelago / host.containers.internal, which the
  orchestrator pins to the archy-net gateway 10.89.0.1. P2P 8333 stays public.
- Legacy config.rs port strings get the same treatment incl. ZMQ.

Tests: new quadlet bind-render + manifest bind-validation tests;
container:: suite 167/167, archipelago-container 63/63.

DEPLOY NOTE: PublishPort strings change for bitcoin containers → one
planned recreate per node; restart lnd afterwards (it caches the backend
IP — see the backend-recreate cascade tracker item). Catalog manifests for
bitcoin apps must be regenerated + re-signed for catalog-covered nodes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
archipelago
2026-07-08 20:29:02 -04:00
co-authored by Claude Fable 5
parent 81743874a1
commit dd61a20413
8 changed files with 157 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/bitcoin-core/manifest.yml
+9
View File
@@ -71,9 +71,18 @@ app:
network_policy: isolated
ports:
# RPC is auth-only: publish host-local + the archy-net gateway
# (host.archipelago / host.containers.internal -> 10.89.0.1) so in-node
# consumers (lnd, fedimint-gateway, btcpay) keep their backend-agnostic
# endpoint - but the LAN can no longer reach nodeIP:8332. P2P stays public.
- host: 8332
container: 8332
protocol: tcp
bind: 127.0.0.1
- host: 8332
container: 8332
protocol: tcp
bind: 10.89.0.1
- host: 8333
container: 8333
protocol: tcp