20 HTTP UIs move to bind: 127.0.0.1 + auth: gated (the daemon owns their
external addresses and authenticates every connection); 5 loopback-only
backends declare auth: local so the gate keeps its hands off. Protocol
ports (LND, bitcoin p2p, electrum, CLN, gitea SSH, Wyoming, mDNS/SSDP)
were already declared auth: none with rationales in earlier commits.
Inert until the catalog is re-signed: nodes act only on declared fields
delivered via the signed catalog, and the catalog overlay overrides these
disk manifests everywhere they are installed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two btcpay-server manifest gaps found on shorty-s (2026-07-10):
- BTCPAY_PLUGINDIR=/datadir/Plugins: the image default is container-local,
so every container recreate silently wiped installed plugins (the
reinstall-the-nostr-plugin-after-every-restart symptom, plus a soft-restart
loop while an install was pending).
- BTCPAY_BTCLIGHTNING via optional secret_env btcpay-lnd-connection: the
manifest never wired the internal LND node. The secret is generated by the
daemon (see previous commit); nodes without LND skip it.
releases/app-catalog.json regenerated (embeds the manifest; origin-wins
overlay means nodes only pick this up from the published catalog). Signature
stripped by regeneration — run scripts/sign-catalog.sh before publishing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Added no_new_privileges: true, user: 1000, and seccomp_profile: default
to all app manifests. Created community app review checklist.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
