feat(apps): complete the manifest platform — convert the last five stragglers

Nginx Proxy Manager, Tailscale, Ollama, CryptPad, and AdGuard Home now carry full manifests: the app gate fronts their web ports (TLS on the same port, node login where appropriate), installs run through the orchestrator, and pins live in the signed catalog. Tailscale mirrors its legacy shape exactly (userspace networking, web console on 8240, plain HTTP for the gate to front). Ollama stays loopback-only — the assistant's local model backend, not a web app. Retires the four already-removed apps for good (FIPS, Nostr VPN, Routstr, Penpot pins dropped from image-versions.sh, the generator map, and image_versions.rs), fixes Cuprate's duplicated metadata block that strict YAML parsers reject, and updates the port-inventory review gates for the new open (3 own-login consoles) and exempt (2 DNS) ports.
2026-08-31 18:40:39 -04:00
parent 3ed75c328d
commit fc68c5b680
13 changed files with 4778 additions and 3966 deletions
@@ -0,0 +1,67 @@
+app:
+  id: cryptpad
+  name: CryptPad
+  version: 2024.12.0
+  upstream:
+    kind: github
+    repo: cryptpad/cryptpad
+  description: End-to-end encrypted documents, spreadsheets, and presentations. Zero-knowledge collaboration.
+
+  container:
+    image: source.archipelago-foundation.org/lfg2025/cryptpad:2024.12.0
+    pull_policy: if-not-present
+    network: pasta
+
+  dependencies:
+    - storage: 5Gi
+
+  resources:
+    memory_limit: 1Gi
+    disk_limit: 5Gi
+
+  security:
+    capabilities: []
+    readonly_root: false
+    no_new_privileges: true
+    network_policy: isolated
+
+  ports:
+    - host: 3000
+      container: 3000
+      protocol: tcp
+      bind: 127.0.0.1
+      # gated: CryptPad is browser-only (its own per-user accounts sit on top
+      # of the node login, exactly like Vaultwarden), so the gate's session
+      # challenge costs nothing and keeps the pads behind the node login.
+      auth: gated
+
+  volumes:
+    - type: bind
+      source: /var/lib/archipelago/cryptpad
+      target: /cryptpad/data
+      options: [rw]
+
+  environment: []
+
+  health_check:
+    type: tcp
+    endpoint: localhost:3000
+    interval: 30s
+    timeout: 5s
+    retries: 3
+
+  interfaces:
+    main:
+      name: CryptPad
+      description: Encrypted collaboration suite
+      type: ui
+      port: 3000
+      protocol: http
+      path: /
+
+  metadata:
+    author: XWiki SAS
+    category: data
+    icon: /assets/icon/favico-black-v2.svg
+    repo: https://github.com/cryptpad/cryptpad
+    tier: optional