feat(release): stage GitWorkshop and next node updates

apps/PORTS.md

@@ -25,6 +25,7 @@ This document lists all port assignments for Archipelago apps.
 | did-wallet | 8083 | TCP | Web UI | 18083 |
 | router | 8084, 5353, 1900 | TCP/UDP | Web UI, mDNS, SSDP | 18084, 15353, 11900 |
 | meshtastic | 4403, 1883 | TCP | HTTP API, MQTT | 14403, 11883 |
+| archipelago-source | 8337 | TCP | Authenticated source UI | 18337 |
 
 ## Development Ports (Offset: +10000)
 
@@ -53,6 +54,7 @@ In development mode, all ports are offset by 10000 to avoid conflicts with produ
 | DID Wallet | http://localhost:18083 |
 | Router | http://localhost:18084 |
 | Meshtastic | http://localhost:14403 |
+| GitWorkshop | http://localhost:18337 |
 
 ## Port Conflict Resolution
 

apps/archipelago-source/manifest.yml

@@ -0,0 +1,80 @@
+app:
+  id: archipelago-source
+  name: GitWorkshop
+  version: 0.4.0
+  upstream:
+    kind: github
+    repo: DanConwayDev/gitworkshop
+  description: >-
+    Get Archipelago's source, clone it with ngit, and contribute issues,
+    patches, and reviews over Nostr using the upstream GitWorkshop client.
+  category: development
+
+  container:
+    build:
+      context: /opt/archipelago/docker/archipelago-source
+      dockerfile: Dockerfile
+      tag: localhost/archipelago-source:local
+
+  resources:
+    cpu_limit: 1
+    memory_limit: 64Mi
+    disk_limit: 64Mi
+
+  security:
+    capabilities: []
+    readonly_root: true
+    no_new_privileges: true
+    network_policy: host
+
+  ports:
+    - host: 8337
+      container: 8337
+      protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
+      session_passthrough: true
+
+  volumes:
+    - type: tmpfs
+      target: /tmp
+      tmpfs_options: rw,noexec,nosuid,size=16m,mode=1777
+
+  environment: []
+
+  health_check:
+    type: http
+    endpoint: http://127.0.0.1:8337
+    path: /healthz
+    interval: 30s
+    timeout: 5s
+    retries: 3
+
+  interfaces:
+    main:
+      name: GitWorkshop
+      description: NIP-34 repository browser, issues, pull requests, and review
+      type: ui
+      port: 8337
+      protocol: http
+      path: /
+
+  metadata:
+    # Versioned filename deliberately invalidates dashboard/browser icon caches
+    # when the Source prototype is replaced by the upstream GitWorkshop mark.
+    icon: /assets/img/app-icons/gitworkshop-dc36db6.svg
+    author: GitWorkshop contributors
+    repo: https://github.com/DanConwayDev/gitworkshop
+    maintainer_npub: npub1w3sqdkrhn0gyuvsex32effzgnfpyde6qrrc4u467flg5e9txh4wsfn5vjg
+    tier: optional
+    launch:
+      # GitWorkshop is top-level in Companion's native in-app WebView. Its
+      # injected NIP-07 provider creates the authenticated dashboard-origin
+      # signer broker itself, so no dashboard parent frame is required.
+      requires_host_frame: false
+    features:
+      - NIP-34 repository discovery and browsing
+      - Bandwidth-efficient Git explorer over GRASP
+      - Nostr issues, pull requests, and code review
+      - NIP-07 extension and NIP-46 remote-signer support
+      - Archipelago node identity through explicit signing consent

apps/gitea/manifest.yml

@@ -16,11 +16,13 @@ app:
     pull_policy: if-not-present
 
   dependencies:
-    - storage: 500Mi
+    # Source history, LFS objects, release artifacts and OCI layers all share
+    # this persistent store. 500Mi was only suitable for an empty demo node.
+    - storage: 50Gi
 
   resources:
     memory_limit: 256Mi
-    disk_limit: 500Mi
+    disk_limit: 50Gi
 
   security:
     capabilities: [CHOWN, FOWNER, SETUID, SETGID, DAC_OVERRIDE, NET_BIND_SERVICE]
@@ -66,6 +68,12 @@ app:
     - GITEA__server__SSH_LISTEN_PORT=22
     - GITEA__server__LFS_START_SERVER=true
     - GITEA__packages__ENABLED=true
+    # Package/LFS storage remains bounded by the node's disk, not an arbitrary
+    # per-owner quota. Release artifacts allow installer/OTA images up to 10GiB.
+    - GITEA__packages__LIMIT_TOTAL_OWNER_SIZE=-1
+    - GITEA__packages__LIMIT_SIZE_CONTAINER=-1
+    - GITEA__repository_0x2Erelease__FILE_MAX_SIZE=10240
+    - GITEA__repository_0x2Erelease__MAX_FILES=20
     - GITEA__repository__ENABLE_PUSH_CREATE_USER=true
     - GITEA__repository__ENABLE_PUSH_CREATE_ORG=true
 

apps/indeedhub/manifest.yml

@@ -69,7 +69,10 @@ app:
       - copy_from_host:
           src: "web-ui/nostr-provider.js"
           dest: "/usr/share/nginx/html/nostr-provider.js"
+      - exec: ["sh", "-c", "grep -qF 'location = /nostr-provider.js {' /etc/nginx/conf.d/default.conf || sed -i '/location = \/sw.js {/i\\    location = /nostr-provider.js {\\n        add_header Cache-Control \"no-cache, no-store, must-revalidate\";\\n        expires off;\\n    }\\n' /etc/nginx/conf.d/default.conf"]
       - exec: ["sh", "-c", "grep -q nostr-provider /etc/nginx/conf.d/default.conf || sed -i 's#</head>#<script src=\"/nostr-provider.js\"></script></head>#' /etc/nginx/conf.d/default.conf"]
+      - exec: ["sed", "-i", "s#tab-signer-v2#tab-signer-v4#g; s#tab-signer-v3#tab-signer-v4#g", "/etc/nginx/conf.d/default.conf"]
+      - exec: ["sed", "-i", "s#src=\"/nostr-provider.js\"#src=\"/nostr-provider.js?v=tab-signer-v4\"#g", "/etc/nginx/conf.d/default.conf"]
       - exec: ["nginx", "-s", "reload"]
 
   # TCP liveness on the nginx port, NOT an http GET of /. nginx binds 7777 at