feat(apps): complete the manifest platform — convert the last five stragglers
Demo images / Build & push demo images (push) Failing after 36s
Demo images / Build & push demo images (push) Failing after 36s
Nginx Proxy Manager, Tailscale, Ollama, CryptPad, and AdGuard Home now carry full manifests: the app gate fronts their web ports (TLS on the same port, node login where appropriate), installs run through the orchestrator, and pins live in the signed catalog. Tailscale mirrors its legacy shape exactly (userspace networking, web console on 8240, plain HTTP for the gate to front). Ollama stays loopback-only — the assistant's local model backend, not a web app. Retires the four already-removed apps for good (FIPS, Nostr VPN, Routstr, Penpot pins dropped from image-versions.sh, the generator map, and image_versions.rs), fixes Cuprate's duplicated metadata block that strict YAML parsers reject, and updates the port-inventory review gates for the new open (3 own-login consoles) and exempt (2 DNS) ports.
This commit is contained in:
archipelago
@@ -0,0 +1,88 @@
|
||||
app:
|
||||
id: adguardhome
|
||||
name: AdGuard Home
|
||||
version: v0.107.55
|
||||
upstream:
|
||||
kind: github
|
||||
repo: AdguardTeam/AdGuardHome
|
||||
description: >-
|
||||
Network-wide ad and tracker blocking: a DNS server that filters every
|
||||
device on your LAN, with a web console for rules and client management.
|
||||
|
||||
container:
|
||||
image: source.archipelago-foundation.org/lfg2025/adguardhome:v0.107.55
|
||||
pull_policy: if-not-present
|
||||
network: pasta
|
||||
|
||||
dependencies:
|
||||
- storage: 1Gi
|
||||
|
||||
resources:
|
||||
memory_limit: 512Mi
|
||||
disk_limit: 1Gi
|
||||
|
||||
security:
|
||||
capabilities: [NET_BIND_SERVICE]
|
||||
readonly_root: false
|
||||
no_new_privileges: true
|
||||
network_policy: isolated
|
||||
|
||||
ports:
|
||||
- host: 3000
|
||||
container: 3000
|
||||
protocol: tcp
|
||||
bind: 127.0.0.1
|
||||
# open: the setup wizard and admin console carry AdGuard Home's own
|
||||
# login; the gate fronts the port (TLS, header fixes) without a
|
||||
# second cookie challenge.
|
||||
auth: open
|
||||
auth_rationale: >-
|
||||
AdGuard Home enforces its own admin login on the console, and the
|
||||
first-run wizard must answer before any account exists.
|
||||
- host: 53
|
||||
container: 53
|
||||
protocol: udp
|
||||
# none: plain DNS must answer every unauthenticated query from LAN
|
||||
# devices — a login page in front of :53 breaks every client on the
|
||||
# network by design.
|
||||
auth: none
|
||||
auth_rationale: >-
|
||||
Plain DNS answers unauthenticated by protocol: resolvers and clients
|
||||
send queries directly; a login challenge would make DNS unreachable.
|
||||
- host: 53
|
||||
container: 53
|
||||
protocol: tcp
|
||||
auth: none
|
||||
auth_rationale: >-
|
||||
DNS-over-TCP fallback (truncated responses, zone transfers); same
|
||||
protocol-level requirement as the UDP port.
|
||||
|
||||
volumes:
|
||||
- type: bind
|
||||
source: /var/lib/archipelago/adguardhome
|
||||
target: /opt/adguardhome
|
||||
options: [rw]
|
||||
|
||||
environment: []
|
||||
|
||||
health_check:
|
||||
type: tcp
|
||||
endpoint: localhost:3000
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
|
||||
interfaces:
|
||||
main:
|
||||
name: Admin console
|
||||
description: AdGuard Home web console
|
||||
type: ui
|
||||
port: 3000
|
||||
protocol: http
|
||||
path: /
|
||||
|
||||
metadata:
|
||||
author: AdGuard
|
||||
category: networking
|
||||
repo: https://github.com/AdguardTeam/AdGuardHome
|
||||
tier: optional
|
||||
@@ -0,0 +1,67 @@
|
||||
app:
|
||||
id: cryptpad
|
||||
name: CryptPad
|
||||
version: 2024.12.0
|
||||
upstream:
|
||||
kind: github
|
||||
repo: cryptpad/cryptpad
|
||||
description: End-to-end encrypted documents, spreadsheets, and presentations. Zero-knowledge collaboration.
|
||||
|
||||
container:
|
||||
image: source.archipelago-foundation.org/lfg2025/cryptpad:2024.12.0
|
||||
pull_policy: if-not-present
|
||||
network: pasta
|
||||
|
||||
dependencies:
|
||||
- storage: 5Gi
|
||||
|
||||
resources:
|
||||
memory_limit: 1Gi
|
||||
disk_limit: 5Gi
|
||||
|
||||
security:
|
||||
capabilities: []
|
||||
readonly_root: false
|
||||
no_new_privileges: true
|
||||
network_policy: isolated
|
||||
|
||||
ports:
|
||||
- host: 3000
|
||||
container: 3000
|
||||
protocol: tcp
|
||||
bind: 127.0.0.1
|
||||
# gated: CryptPad is browser-only (its own per-user accounts sit on top
|
||||
# of the node login, exactly like Vaultwarden), so the gate's session
|
||||
# challenge costs nothing and keeps the pads behind the node login.
|
||||
auth: gated
|
||||
|
||||
volumes:
|
||||
- type: bind
|
||||
source: /var/lib/archipelago/cryptpad
|
||||
target: /cryptpad/data
|
||||
options: [rw]
|
||||
|
||||
environment: []
|
||||
|
||||
health_check:
|
||||
type: tcp
|
||||
endpoint: localhost:3000
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
|
||||
interfaces:
|
||||
main:
|
||||
name: CryptPad
|
||||
description: Encrypted collaboration suite
|
||||
type: ui
|
||||
port: 3000
|
||||
protocol: http
|
||||
path: /
|
||||
|
||||
metadata:
|
||||
author: XWiki SAS
|
||||
category: data
|
||||
icon: /assets/icon/favico-black-v2.svg
|
||||
repo: https://github.com/cryptpad/cryptpad
|
||||
tier: optional
|
||||
@@ -15,11 +15,6 @@ app:
|
||||
description: Alternative Monero node implementation in Rust. Independently validates Monero consensus rules, providing a layer of security and redundancy for the network.
|
||||
category: money
|
||||
|
||||
metadata:
|
||||
icon: /assets/img/app-icons/cuprate.svg
|
||||
repo: https://github.com/Cuprate/cuprate
|
||||
tier: optional
|
||||
|
||||
container:
|
||||
# Built from the upstream Dockerfile at the tip of main, 18 commits past
|
||||
# the cuprated-0.1.0-preview tag (commit 618ff14, 2026-08-19) — there is
|
||||
|
||||
@@ -0,0 +1,74 @@
|
||||
app:
|
||||
id: nginx-proxy-manager
|
||||
name: Nginx Proxy Manager
|
||||
version: 2.12.1
|
||||
upstream:
|
||||
kind: github
|
||||
repo: NginxProxyManager/nginx-proxy-manager
|
||||
description: >-
|
||||
Reverse proxy with SSL. Beautiful web interface for managing proxies.
|
||||
On a node, this manages its admin UI and upstream configuration — the
|
||||
proxy's own :80/:443 listeners are not published (the node's web server
|
||||
owns those ports).
|
||||
|
||||
container:
|
||||
image: source.archipelago-foundation.org/lfg2025/nginx-proxy-manager:latest
|
||||
pull_policy: if-not-present
|
||||
network: pasta
|
||||
|
||||
dependencies:
|
||||
- storage: 1Gi
|
||||
|
||||
resources:
|
||||
memory_limit: 512Mi
|
||||
disk_limit: 1Gi
|
||||
|
||||
security:
|
||||
capabilities: [CHOWN, SETUID, SETGID, DAC_OVERRIDE]
|
||||
readonly_root: false
|
||||
no_new_privileges: true
|
||||
network_policy: isolated
|
||||
|
||||
ports:
|
||||
- host: 8081
|
||||
container: 81
|
||||
protocol: tcp
|
||||
bind: 127.0.0.1
|
||||
# open, not gated: NPM carries a complete admin login of its own. The
|
||||
# gate still fronts the port (TLS on the same port, header fixes, retry
|
||||
# page, Tor) without putting a cookie challenge in front of it.
|
||||
auth: open
|
||||
auth_rationale: >-
|
||||
Nginx Proxy Manager enforces its own admin account on every page;
|
||||
the initial setup wizard also has to answer before any account exists.
|
||||
|
||||
volumes:
|
||||
- type: bind
|
||||
source: /var/lib/archipelago/nginx-proxy-manager
|
||||
target: /data
|
||||
options: [rw]
|
||||
|
||||
environment: []
|
||||
|
||||
health_check:
|
||||
type: tcp
|
||||
endpoint: localhost:81
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
|
||||
interfaces:
|
||||
main:
|
||||
name: Admin UI
|
||||
description: Nginx Proxy Manager admin interface
|
||||
type: ui
|
||||
port: 8081
|
||||
protocol: http
|
||||
path: /
|
||||
|
||||
metadata:
|
||||
author: Nginx Proxy Manager
|
||||
category: networking
|
||||
icon: /assets/img/app-icons/nginx.svg
|
||||
repo: https://github.com/NginxProxyManager/nginx-proxy-manager
|
||||
tier: optional
|
||||
@@ -0,0 +1,62 @@
|
||||
app:
|
||||
id: ollama
|
||||
name: Ollama
|
||||
version: 0.5.4
|
||||
upstream:
|
||||
kind: github
|
||||
repo: ollama/ollama
|
||||
description: >-
|
||||
Run large language models locally. Download and run AI models like
|
||||
Llama, Mistral on your own hardware — served on the node's loopback for
|
||||
the AI assistant (Settings → Claude Auth → model backend), never exposed
|
||||
to the network.
|
||||
|
||||
container:
|
||||
image: source.archipelago-foundation.org/lfg2025/ollama:latest
|
||||
pull_policy: if-not-present
|
||||
network: pasta
|
||||
|
||||
dependencies:
|
||||
- storage: 50Gi
|
||||
|
||||
resources:
|
||||
memory_limit: 0
|
||||
disk_limit: 50Gi
|
||||
|
||||
security:
|
||||
capabilities: []
|
||||
readonly_root: false
|
||||
no_new_privileges: true
|
||||
network_policy: isolated
|
||||
|
||||
ports:
|
||||
- host: 11434
|
||||
container: 11434
|
||||
protocol: tcp
|
||||
# local: Ollama's REST API is consumed by the node's own assistant over
|
||||
# loopback — never externally reachable, so no gate, no TLS, and no
|
||||
# login surface exist at all.
|
||||
bind: 127.0.0.1
|
||||
auth: local
|
||||
|
||||
volumes:
|
||||
- type: bind
|
||||
source: /var/lib/archipelago/ollama
|
||||
target: /root/.ollama
|
||||
options: [rw]
|
||||
|
||||
environment: []
|
||||
|
||||
health_check:
|
||||
type: tcp
|
||||
endpoint: localhost:11434
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
|
||||
metadata:
|
||||
author: Ollama
|
||||
category: community
|
||||
icon: /assets/img/app-icons/ollama.png
|
||||
repo: https://github.com/ollama/ollama
|
||||
tier: optional
|
||||
@@ -0,0 +1,78 @@
|
||||
app:
|
||||
id: tailscale
|
||||
name: Tailscale
|
||||
version: 1.78.0
|
||||
upstream:
|
||||
kind: github
|
||||
repo: tailscale/tailscale
|
||||
description: Zero-config VPN with WireGuard mesh networking.
|
||||
|
||||
container:
|
||||
image: source.archipelago-foundation.org/lfg2025/tailscale:stable
|
||||
pull_policy: if-not-present
|
||||
network: pasta
|
||||
# Mirrors the legacy curated install exactly: tailscaled in userspace
|
||||
# networking (no host TUN device needed — the rootless container cannot
|
||||
# have one anyway), then `tailscale web` serving the console on :8240 as
|
||||
# plain HTTP the app gate can front (TLS on the same port via the node
|
||||
# certificate, framing-header fixes, retry page, Tor).
|
||||
entrypoint: ["sh", "-c", "tailscaled --tun=userspace-networking & for i in $(seq 1 30); do [ -S /var/run/tailscale/tailscaled.sock ] && break; sleep 1; done; tailscale web --listen 0.0.0.0:8240 & wait"]
|
||||
|
||||
dependencies:
|
||||
- storage: 1Gi
|
||||
|
||||
resources:
|
||||
memory_limit: 512Mi
|
||||
disk_limit: 1Gi
|
||||
|
||||
security:
|
||||
capabilities: []
|
||||
readonly_root: false
|
||||
no_new_privileges: true
|
||||
network_policy: isolated
|
||||
|
||||
ports:
|
||||
- host: 8240
|
||||
container: 8240
|
||||
protocol: tcp
|
||||
bind: 127.0.0.1
|
||||
# open, not gated: the web console requires the tailnet's own login for
|
||||
# every administrative action — the gate fronts the port without adding
|
||||
# a second login in front of it.
|
||||
auth: open
|
||||
auth_rationale: >-
|
||||
Tailscale's web console authenticates against the tailnet account for
|
||||
all administrative actions; the node's cookie challenge would be a
|
||||
second, redundant login.
|
||||
|
||||
volumes:
|
||||
- type: bind
|
||||
source: /var/lib/archipelago/tailscale
|
||||
target: /var/lib/tailscale
|
||||
options: [rw]
|
||||
|
||||
environment:
|
||||
- TS_STATE_DIR=/var/lib/tailscale
|
||||
|
||||
health_check:
|
||||
type: tcp
|
||||
endpoint: localhost:8240
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
|
||||
interfaces:
|
||||
main:
|
||||
name: Web console
|
||||
description: Tailscale web console
|
||||
type: ui
|
||||
port: 8240
|
||||
protocol: http
|
||||
path: /
|
||||
|
||||
metadata:
|
||||
author: Tailscale
|
||||
category: networking
|
||||
icon: /assets/img/app-icons/tailscale.webp
|
||||
repo: https://github.com/tailscale/tailscale
|
||||
tier: recommended
|
||||
Reference in New Issue
Block a user