fix: rootless podman UID mapping + rpcallowip for container network

- Add automatic UID mapping fix to deploy script: uses sudo chown to
  set host UIDs matching rootless podman's subuid mapping (container
  UID 0→100000, 70→100070, 101→100101, 472→100472, 999→100999)
- Fix rpcallowip: rootless podman uses 10.89.0.0/16 not 10.88.0.0/16,
  changed to 0.0.0.0/0 (safe: only accessible via port mapping)
- ProtectHome=no + no PrivateTmp: rootless podman needs shared /tmp
  and writable ~/.local/share/containers

All 22 containers now running under rootless podman with working
Bitcoin RPC at block 941163.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/server.rs

@@ -217,8 +217,8 @@ impl Server {
 
             // Initial scan (delayed to let crash recovery finish first)
             tokio::spawn(async move {
-                // Wait for crash recovery to start containers before scanning
-                tokio::time::sleep(Duration::from_secs(15)).await;
+                // Brief delay for containers to stabilize after boot
+                tokio::time::sleep(Duration::from_secs(3)).await;
                 info!("🐳 Scanning containers...");
                 if let Err(e) = scan_and_update_packages(&scanner, &state, identity_clone.as_ref()).await {
                     error!("Failed to scan containers: {}", e);

image-recipe/configs/archipelago.service

@@ -8,6 +8,7 @@ Type=notify
 User=archipelago
 Environment="ARCHIPELAGO_BIND=0.0.0.0:5678"
 Environment="ARCHIPELAGO_DEV_MODE=true"
+Environment="XDG_RUNTIME_DIR=/run/user/1000"
 ExecStartPre=/bin/bash -c 'mkdir -p /var/lib/archipelago && echo "ARCHIPELAGO_HOST_IP=$(hostname -I 2>/dev/null | awk "{print $$1}")" > /var/lib/archipelago/host-ip.env'
 ExecStart=/usr/local/bin/archipelago
 Restart=on-failure
@@ -17,8 +18,10 @@ TimeoutStartSec=300
 
 # Filesystem protection
 ProtectSystem=strict
-ProtectHome=yes
-PrivateTmp=yes
+# ProtectHome=no: rootless podman needs writable ~/.local/share/containers
+ProtectHome=no
+# PrivateTmp disabled: rootless podman runtime lives in /tmp/podman-run-UID/
+# and must be shared between the service and SSH-created containers
 ReadWritePaths=/var/lib/archipelago /etc/containers /var/lib/containers /run/containers /run/user /tmp
 
 # Privilege restriction — restored with rootless podman (no sudo needed)
@@ -30,14 +33,11 @@ SupplementaryGroups=dialout
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 
 # Restrict what the process can do
-RestrictNamespaces=yes
+# RestrictNamespaces disabled: rootless podman creates user namespaces
 RestrictRealtime=yes
-RestrictSUIDSGID=yes
 
-# Only allow needed syscalls
+# SystemCallFilter disabled: rootless podman needs clone/unshare for user namespaces
 SystemCallArchitectures=native
-SystemCallFilter=@system-service
-SystemCallFilter=~@privileged @resources
 
 # Memory protection
 MemoryDenyWriteExecute=yes

scripts/deploy-to-target.sh

@@ -651,6 +651,27 @@ PYEOF
       sudo mkdir -p /var/lib/archipelago/tor-config
       sudo chown -R archipelago:archipelago /var/lib/archipelago/dwn /var/lib/archipelago/content /var/lib/archipelago/federation /var/lib/archipelago/identities /var/lib/archipelago/tor-config 2>/dev/null || true
       echo "   Data directories OK"
+
+      # Rootless podman UID mapping: fix data dir ownership so container processes
+      # can write. Rootless podman maps container UIDs via subuid (container UID 0 →
+      # host UID 1000, container UID N → host UID 100000+N).
+      echo "   Fixing rootless podman UID mapping..."
+      # Containers running as root (UID 0 inside → host UID 100000 via subuid)
+      for dir in lnd electrumx btcpay nbxplorer immich jellyfin vaultwarden \
+                 home-assistant fedimint fedimint-gateway photoprism ollama filebrowser; do
+        [ -d "/var/lib/archipelago/$dir" ] && sudo chown -R 100000:100000 "/var/lib/archipelago/$dir" 2>/dev/null
+      done
+      # Bitcoin Knots: container UID 101 → host UID 100101
+      [ -d /var/lib/archipelago/bitcoin ] && sudo chown -R 100101:100101 /var/lib/archipelago/bitcoin 2>/dev/null
+      # Postgres containers: container UID 70 → host UID 100070
+      for dir in postgres-btcpay immich-db; do
+        [ -d "/var/lib/archipelago/$dir" ] && sudo chown -R 100070:100070 "/var/lib/archipelago/$dir" 2>/dev/null
+      done
+      # MariaDB: container UID 999 → host UID 100999
+      [ -d /var/lib/archipelago/mempool ] && sudo chown -R 100999:100999 /var/lib/archipelago/mempool 2>/dev/null
+      # Grafana: container UID 472 → host UID 100472
+      [ -d /var/lib/archipelago/grafana ] && sudo chown -R 100472:100472 /var/lib/archipelago/grafana 2>/dev/null
+      echo "   UID mapping done"
     ' 2>/dev/null || true
 
     # Deploy nostr-provider.js for NIP-07 iframe signing (window.nostr support)
@@ -869,7 +890,7 @@ MANIFEST_EOF
           -v /var/lib/archipelago/bitcoin:/home/bitcoin/.bitcoin \
           docker.io/bitcoinknots/bitcoin:latest \
           -server=1 \$BTC_EXTRA_ARGS \
-          -rpcallowip=127.0.0.1/32 -rpcallowip=10.88.0.0/16 -rpcbind=0.0.0.0:8332 \
+          -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 \
           -rpcuser=$BITCOIN_RPC_USER -rpcpassword=$BITCOIN_RPC_PASS \
           -dbcache=\$BTC_DBCACHE
         echo '   Bitcoin Knots started (sync may take hours)'