fix(cuprate): front the restricted RPC port with a Tor onion

The restricted-RPC port (18090) was `auth: none`, which the app gate
treats as fully exempt — no onion, no takeover, LAN/Tailscale IP only.
Flip it to `auth: open`: the gate still binds the external addresses
and fronts a Tor onion for the port, just without a dashboard login
challenge, since Monero wallet clients (Feather, monero-wallet-rpc,
GUI) speak plain HTTP JSON-RPC and can't hold a session cookie.

P2P (18183) stays `none` — no reason to Tor-front raw gossip.

Regenerated releases/app-catalog.json (unsigned) to embed the updated
manifest; needs scripts/sign-catalog.sh before it takes effect on any
node, since origin (catalog) wins over disk for catalog-covered apps.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NZnsiMtyJxiJBuvv7yLPUF

apps/cuprate/manifest.yml

@@ -45,7 +45,12 @@ app:
 
   resources:
     cpu_limit: 0
-    memory_limit: 4Gi
+    # Raised from 4Gi alongside target_max_memory below (see files[] comment)
+    # — 2026-09-03 incident: a 4Gi/3GB-cache config starved
+    # cuprated's DB cache into constant eviction/flush, driving 45% sustained
+    # CPU and ~595GB/24h of block I/O on a fully-synced node. 10Gi leaves
+    # headroom above the 8GiB cache for the process itself.
+    memory_limit: 10Gi
     disk_limit: 300Gi
 
   security:
@@ -82,17 +87,21 @@ app:
     # bind without an explicit i_know_what_im_doing override.
     # Restricted RPC: Monero's own purpose-built safe-for-public subset —
     # what wallets use when connecting to a "remote node". Disabled by
-    # cuprated's own default; enabled via files[] below. A dashboard login
-    # would break wallet clients connecting programmatically, same
-    # reasoning as electrumx's port. The daemon still uses its canonical
-    # container port 18089, but Penpot already owns host port 18089, so this
-    # maps the public host port to the free 18090 instead.
+    # cuprated's own default; enabled via files[] below. `open`, not `gated`:
+    # the gate still takes the port over (loopback pin, external binds,
+    # fronts the Tor onion) but skips the dashboard login challenge, same
+    # reasoning as electrumx's port — wallet clients (Feather,
+    # monero-wallet-rpc, GUI) speak plain HTTP JSON-RPC programmatically and
+    # cannot complete a browser login or hold a session cookie. The daemon
+    # still uses its canonical container port 18089, but Penpot already owns
+    # host port 18089, so this maps the public host port to the free 18090
+    # instead.
     - host: 18090
       container: 18089
       protocol: tcp
-      auth: none
+      auth: open
       auth_rationale: >-
-        Monero restricted RPC — the subset upstream considers safe for public/remote-node use. Wallets (Feather, monero-wallet-rpc, GUI) connect directly over plain HTTP JSON-RPC and cannot hold a dashboard session cookie.
+        Monero restricted RPC — the subset upstream considers safe for public/remote-node use. Wallets (Feather, monero-wallet-rpc, GUI) connect directly over plain HTTP JSON-RPC and cannot complete a browser login or hold a dashboard session cookie.
 
   volumes:
     - type: bind
@@ -103,11 +112,23 @@ app:
   # Settings that need to differ from cuprated's own documented defaults
   # (verified against `cuprated --generate-config` and `--dry-run` locally,
   # 2026-08-21):
+  #   - fast_sync: cuprated's own default is false, which performs full
+  #     cryptographic verification (ring signatures + RandomX PoW) on every
+  #     incoming block instead of trusting checkpointed history. Root-caused
+  #     2026-09-03 as the dominant cause of a sustained 45% CPU node,
+  #     vs. 2.8% on a reference node with fast_sync = true — same chain height, same
+  #     block rate. Set explicitly rather than relying on the binary
+  #     default so fresh deploys don't silently regress into full-verify.
   #   - target_max_memory: cuprated's own default auto-detects total *host*
   #     RAM via sysinfo, which inside a memory-limited container would let
   #     it size caches far past what resources.memory_limit above actually
   #     grants — same class of problem bitcoin-knots' -dbcache sizing
-  #     comment addresses. Set explicitly, comfortably under the 4Gi limit.
+  #     comment addresses. Set explicitly, comfortably under the 10Gi limit.
+  #     Previously 3000000000 (~2.8GiB); that starved the DB cache and
+  #     forced constant eviction/flush (595GB/24h block I/O on a node just
+  #     appending ~2MB blocks every 2 minutes) — raised to 8GiB, matching
+  #     the healthy reference node, and
+  #     resources.memory_limit above raised in step to keep headroom above it.
   #   - rpc.restricted.enable: cuprated ships this off by default; flip on
   #     so the auth:none host port above actually serves something instead
   #     of refusing every connection. port stays at its documented default
@@ -128,21 +149,21 @@ app:
   #   - tracing.stdout.level / tracing.file.{level,max_log_files}: an
   #     operator reading Cuprated.toml on disk should be able to see and
   #     tune the log level directly instead of the file silently omitting
-  #     the whole [tracing] table (verified live on amishparadise
+  #     the whole [tracing] table (verified live on the affected node
   #     2026-09-01: the deployed file had no [tracing] section at all, and
   #     the level was only discoverable by running `cuprated
   #     --generate-config` and diffing). file.level is set to "info", NOT
   #     cuprated's own raw default of "debug" — matches the reference dev
-  #     config this app was built and tested against
-  #     (ssmithx@archy-dev-pa:/home/ssmithx/cuprate/Cuprated.toml,
-  #     verified 2026-09-01), which deliberately runs file logging quieter
+  #     config this app was built and tested against (verified 2026-09-01),
+  #     which deliberately runs file logging quieter
   #     than the binary default. max_log_files similarly follows that
   #     reference (14, not the binary default of 7).
   files:
     - path: /var/lib/archipelago/cuprate/Cuprated.toml
       content: |
         network = "Mainnet"
-        target_max_memory = 3000000000
+        fast_sync = true
+        target_max_memory = 8589934592
 
         [rpc.restricted]
         enable = true

docs/README.md

@@ -10,7 +10,6 @@ disagree, the code wins and the doc is a bug.
 - [Talking to your node](COMMANDS.md) — the conversational command surface
 - [Seed Verification](SEED-VERIFICATION.md) — independently verify your 24-word backup
 - [Troubleshooting](troubleshooting.md) — common problems and how to resolve them
-- [OpenWrt Gateway Setup](openwrt-gateway-setup.md) — pairing an OpenWrt router and provisioning TollGate pay-as-you-go WiFi
 - [Gamepad / Controller Navigation](GAMEPAD-NAV.md) — driving the UI from a controller
 - [Pine voice commands](pine-voice-commands.md) — the voice-satellite phrase surface
 

docs/openwrt-gateway-setup.md

@@ -1,232 +0,0 @@
-# OpenWrt Gateway Setup
-
-How to connect an OpenWrt router to an Archipelago node and, optionally, turn
-it into a pay-as-you-go WiFi gateway with **TollGate**. Written for a node
-operator following the UI; a developer-facing RPC/architecture reference is
-at the bottom.
-
-This feature manages a **separate physical (or virtual) router** running
-OpenWrt over SSH/UCI — it is not a containerized app. Archipelago itself does
-not flash or install OpenWrt; you bring a router that already runs it.
-
-## What you get
-
-- **Status dashboard**: hostname, uptime, firmware release, WiFi interfaces,
-  WAN state — polled live from the router.
-- **WAN/WISP wizard**: point the router's radio at an upstream WiFi network
-  (turns it into a wireless bridge/repeater) with DHCP + NAT configured for
-  you.
-- **TollGate provisioning** (optional): installs the
-  [TollGate](https://tollgate.me) captive-portal package
-  (`tollgate-module-basic-go`) and stands up an `archipelago` SSID that
-  sells timed internet access for sats, settled against this node's local
-  Cashu mint.
-
-## Prerequisites
-
-1. **A router already flashed with OpenWrt.** Check the
-   [OpenWrt Table of Hardware](https://openwrt.org/toh/start) for your model
-   and follow OpenWrt's own install/flashing instructions — that part is
-   outside Archipelago's scope. See below for a worked example (GL.iNet
-   AX3000).
-2. **SSH reachable.** Fresh OpenWrt images enable `dropbear` (SSH) on LAN by
-   default, listening as `root` with no password (or the password you set
-   during OpenWrt's first-boot wizard at `192.168.1.1`). Archipelago
-   connects with `ssh2` over a password (key-based auth is supported at the
-   library level but the UI only offers password so far).
-3. **Same LAN as the Archipelago node**, at least for setup — plug the
-   router's LAN port into the same switch/network segment the node is on.
-4. **For TollGate**: a running Cashu mint app (`nutshell`/`cashu-mint`) on
-   this node — provisioning defaults `mint_url` to
-   `http://<node-ip>:3338` and TollGate customers must be able to reach that
-   URL from outside the node's loopback.
-
-## Worked example: flashing a GL.iNet AX3000 to stock OpenWrt
-
-GL.iNet's "AX3000" travel router is the **Beryl AX (GL-MT3000)** —
-MediaTek MT7981B (Cortex-A53), OpenWrt target `mediatek/filogic`. It ships
-running a GL.iNet fork of OpenWrt with its own web UI and LuCI already
-enabled, but the steps below replace that with stock/vanilla OpenWrt so it
-matches the prebuilt TollGate `.ipk` architectures exactly
-(`aarch64_cortex-a53`).
-
-1. **Download the sysupgrade image** for the current stable release from
-   `https://downloads.openwrt.org/releases/<version>/targets/mediatek/filogic/`
-   — the file you want is
-   `openwrt-<version>-mediatek-filogic-glinet_gl-mt3000-squashfs-sysupgrade.bin`.
-2. **Verify the checksum** against the `sha256sums` file in that same
-   directory before flashing anything.
-3. **Flash from the GL.iNet UI**: on the router's default address
-   (`192.168.8.1`), go to **More Settings → Upgrade → Local Upgrade**, or
-   open **Advanced → LuCI** and use **System → Backup / Flash Firmware →
-   Flash new firmware image**.
-4. Upload the `.bin` file. **Uncheck "Keep Settings"** — going from the
-   GL.iNet fork to stock OpenWrt needs a clean reset, not a config carry-over.
-5. Confirm and wait ~3–5 minutes without power-cycling the router.
-6. **After it reboots** you're on stock OpenWrt: LAN at `192.168.1.1`, DHCP
-   on, SSH (dropbear) open as `root` with **no password set yet** — set one
-   via LuCI at `192.168.1.1` or `passwd` over SSH before doing anything else.
-   From here, continue with the Prerequisites/Step 2 flow above to connect
-   it to the Archipelago node.
-
-**If the flash fails / the router doesn't come back**: filogic devices
-don't use a reset-button recovery. Instead, connect to the router's LAN
-port and, during boot, press a key within the first ~2 seconds to enter
-U-Boot; per the OpenWrt wiki, typing `gl` then `httpd` at the U-Boot prompt
-brings up a recovery web UI at `192.168.1.2` that accepts a firmware image.
-
-## Step 1: Open the OpenWrt Gateway panel
-
-1. In the Archipelago UI, go to **Server**.
-2. Under the network status list, click **OpenWrt Gateway**
-   (`/dashboard/server/openwrt`).
-
-If no router has been connected before, you'll land on the connect form.
-
-## Step 2: Connect the router
-
-You have two options:
-
-- **Detect**: click **Detect** — this reads the node's own active wired
-  Ethernet interface, derives its subnet, and probes every host on it for
-  `TCP/22` + a valid `/etc/openwrt_release`. If it finds exactly one router
-  it fills in the host automatically; if it finds several you pick from the
-  list. A `/24` scan can take up to ~2 minutes (255 sequential probes at
-  500 ms each on hosts that don't respond).
-- **Manual**: type the router's LAN IP (commonly `192.168.1.1` on a router
-  freshly bridged in, or whatever address it has on your network) plus the
-  SSH username (default `root`) and password.
-
-Click **Connect**. On success the panel switches to the status dashboard and
-the connection (host + credentials) is persisted server-side — you won't
-need to re-enter them on future visits or from other views (e.g. the Home
-dashboard's network tile also polls this without prompting again).
-
-> Credentials are stored in `router_config.json` under the node's data
-> directory alongside other node config. There's no separate secrets
-> vault entry for this yet — treat the router's SSH password like any other
-> node-local config.
-
-## Step 3: (Optional) Configure WAN/WISP
-
-Use this to make the OpenWrt router pull its internet connection from an
-upstream WiFi network instead of a wired uplink — useful for a
-battery/off-grid TollGate node or extending coverage from an existing
-network.
-
-1. From the status dashboard, start the **WAN setup** wizard.
-2. **Scan** — the router's radio scans for visible networks (a few seconds
-   of SSH round-trips).
-3. **Select network** — pick the upstream SSID from the list.
-4. **Password** — enter the upstream network's WiFi password (encryption
-   defaults to `psk2`; leave blank only for open networks).
-5. **DHCP / NAT** — review the LAN DHCP pool (default `.100`–`.249`) and
-   whether to enable NAT/masquerade on the WAN zone (leave this on unless
-   you have a specific reason not to).
-6. **Connect** — this writes a `wwan` STA `wifi-iface` + `network` interface
-   over UCI, enables the radio if it was disabled (OpenWrt ships with
-   `radio0.disabled=1` on a fresh flash), and adds `wwan` to the WAN
-   firewall zone.
-
-The dashboard's WAN panel shows the resulting association state, assigned
-IP, and whether the router currently has internet reachability.
-
-## Step 4: (Optional) Install TollGate
-
-Once connected (and with a local Cashu mint app running), the dashboard
-shows a **TollGate: not installed** panel with a single **Install TollGate**
-button — there's no config form at this stage, it installs with defaults.
-The panel itself warns: *"Router needs internet access to install TollGate
-— configure WAN above first"* (Step 3), since the router has to reach the
-internet to download the package.
-
-1. Click **Install TollGate**. The button relabels to *"Installing… this
-   may take a few minutes"* while it works.
-2. Under the hood this installs `tollgate-module-basic-go` on the router
-   (via `opkg` on OpenWrt ≤24.x, or a manual `.ipk` extract on 25.x images
-   where `opkg` isn't available), writes `/etc/tollgate/config.json`, and
-   creates the `archipelago` SSID — all with default pricing (10 sats per
-   1-minute step, minimum 1 step, `mint_url` auto-filled to
-   `http://<node-ip>:3338`, enabled).
-3. On success you'll see *"TollGate provisioned successfully"* and the
-   panel switches to the installed view (Enabled/Disabled badge, current
-   price/step/mint).
-
-### Configuring price, step size, or mint (after install)
-
-The installed-state panel has an **Edit** button — this is the only place
-you set price/step/mint, and it only appears once TollGate is already
-installed:
-
-1. Click **Edit**.
-2. Set **Price** (sats), **Step size** (minutes — billed as `step_size_ms`
-   under the hood), **Minimum steps** a customer must buy at once, **Mint
-   URL** (leave as the auto-filled node URL unless pointing at an external
-   mint), and the **Enable TollGate** toggle.
-3. Click **Save**. Changes are pushed to `/etc/tollgate/config.json` and the
-   daemon is restarted to pick them up — it does not hot-reload.
-
-Anyone who joins the `archipelago` SSID sees TollGate's captive portal and
-pays sats (via the configured Cashu mint) for timed access.
-
-## Reconfiguring or moving to a different router
-
-Use **Disconnect** on the status dashboard to return to the connect form —
-this only clears the panel's client-side state, it doesn't delete the
-persisted `router_config.json`, so reconnecting to the same router needs no
-re-entry. To point at a *different* router, disconnect and connect with a
-new host/credentials; the newly connected router becomes the persisted one.
-
-## Troubleshooting
-
-- **"No router configured"**: nothing has been connected yet, or the saved
-  config didn't include a host — go through Step 2 again.
-- **Connect hangs or times out**: the router isn't reachable on `TCP/22`
-  from the node's network, or SSH auth failed. Confirm you can `ssh
-  root@<router-ip>` manually from the node (or a machine on the same LAN)
-  with the same credentials.
-- **Router "moved networks" / stale saved host**: SSH/status calls are
-  bounded (5s TCP connect, 30s read/write) precisely so an unreachable
-  saved router can't stall other RPCs — but the dashboard will show a
-  connection error until you reconnect with the router's current address.
-- **TollGate provision fails with "No pre-built TollGate package for
-  architecture..."**: your router's SoC isn't one of the prebuilt
-  `.ipk` targets (`mips_24kc`, `mipsel_24kc`, `aarch64_cortex-a53`,
-  `aarch64_cortex-a72`, `arm_cortex-a7`). You'll need a custom opkg feed or
-  to build `tollgate-module-basic-go` from source for your architecture.
-- **TollGate download looks like it succeeded but provisioning still
-  fails**: the node sanity-checks the downloaded `.ipk` is at least 50 KB —
-  a smaller file usually means `wget` captured an HTML error page instead
-  (no internet access from the router, or a bad release URL).
-
----
-
-## Developer reference
-
-Backend crate: `core/openwrt` (`archipelago-openwrt`) — SSH/UCI plumbing,
-WAN/WISP config, WiFi scanning, and TollGate install/config. See
-[`architecture.md`](architecture.md) for where it sits in the workspace.
-
-RPC methods (`core/archipelago/src/api/rpc/openwrt.rs`, dispatched in
-`core/archipelago/src/api/rpc/dispatcher.rs`):
-
-| Method | Purpose |
-|---|---|
-| `openwrt.scan` | Probe a subnet for OpenWrt routers (`subnet`, `prefix`, `ssh_user`, `ssh_password`) |
-| `openwrt.get-status` | Full status: release, WiFi interfaces, WAN, TollGate state. No params → uses saved `router_config.json`; params with `host` also persist the connection |
-| `openwrt.configure-wan` | Write WISP/WAN config (`ssid`, `password`, `encryption`, `dhcp_start`, `dhcp_limit`, `masq`) |
-| `openwrt.scan-wifi` | Radio scan for visible upstream networks |
-| `openwrt.provision-tollgate` | Install/reconfigure TollGate (`price_sats`, `step_size_ms`, `min_steps`, `mint_url`, `enabled`) |
-
-Note: these are distinct from the unrelated `router.*` methods
-(`router.discover`, `router.configure`, `router.list-forwards`, ...), which
-handle UPnP/NAT-PMP port forwarding on the node's own upstream home router —
-not the OpenWrt gateway feature described here.
-
-Frontend: `neode-ui/src/views/server/OpenWrtGateway.vue`, routed at
-`server/openwrt` (`neode-ui/src/router/index.ts`), linked from
-`neode-ui/src/views/Server.vue`.
-
-Persisted connection state: `router_config.json` in the node's data
-directory (`core/archipelago/src/network/router.rs`:
-`load_router_config`/`save_router_config`).