release(v1.7.29-alpha): VPS as default app registry + settings UI

- New Settings → App registries page (/dashboard/settings/registries)
  that mirrors the update-mirrors experience: list of configured
  registries, test reachability, set primary, add/remove. New
  registry.set-primary RPC; existing registry.{list,add,remove,test}
  reused.
- Default RegistryConfig flipped: VPS (23.182.128.160:3000/lfg2025) is
  now Server 1 (primary), tx1138 is Server 2 (fallback).
- Install pipeline now rewrites the first pull to the primary registry
  URL before attempting it. Before this, installs always hit whichever
  registry the image was hardcoded to, so changing the primary didn't
  actually affect where images came from. On failure, the existing
  fallback walk skips the primary (already tried) and walks the rest.
- App catalog proxy UPSTREAMS order flipped so the catalog follows the
  same VPS-first rule.
- Reboot overlay: animated "a" logo now sits in the center of the ring
  (matches the screensaver composition). Extracted the logo-wrapper
  pattern inline.

7/7 registry tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/Cargo.lock

@@ -80,7 +80,7 @@ checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
 [[package]]
 name = "archipelago"
-version = "1.7.20-alpha"
+version = "1.7.29-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.20-alpha"
+version = "1.7.29-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]

core/archipelago/src/api/handler/mod.rs

@@ -120,8 +120,8 @@ impl ApiHandler {
     /// first 2xx response. 15s total timeout.
     async fn handle_app_catalog_proxy() -> Result<Response<hyper::Body>> {
         const UPSTREAMS: &[&str] = &[
-            "https://git.tx1138.com/lfg2025/app-catalog/raw/branch/main/catalog.json",
             "http://23.182.128.160:3000/lfg2025/app-catalog/raw/branch/main/catalog.json",
+            "https://git.tx1138.com/lfg2025/app-catalog/raw/branch/main/catalog.json",
         ];
         let client = match reqwest::Client::builder()
             .timeout(std::time::Duration::from_secs(15))

core/archipelago/src/api/rpc/dispatcher.rs

@@ -220,6 +220,7 @@ impl RpcHandler {
             "registry.list" => self.handle_registry_list().await,
             "registry.add" => self.handle_registry_add(params).await,
             "registry.remove" => self.handle_registry_remove(params).await,
+            "registry.set-primary" => self.handle_registry_set_primary(params).await,
             "registry.test" => self.handle_registry_test(params).await,
 
             // Streaming ecash payments
@@ -414,6 +415,16 @@ impl RpcHandler {
             "fips.install" => self.handle_fips_install().await,
             "fips.restart" => self.handle_fips_restart().await,
             "fips.reconnect" => self.handle_fips_reconnect().await,
+            "fips.list-seed-anchors" => self.handle_fips_list_seed_anchors().await,
+            "fips.add-seed-anchor" => {
+                let p = params.unwrap_or(serde_json::json!({}));
+                self.handle_fips_add_seed_anchor(&p).await
+            }
+            "fips.remove-seed-anchor" => {
+                let p = params.unwrap_or(serde_json::json!({}));
+                self.handle_fips_remove_seed_anchor(&p).await
+            }
+            "fips.apply-seed-anchors" => self.handle_fips_apply_seed_anchors().await,
 
             // System updates
             "update.check" => self.handle_update_check().await,
@@ -421,6 +432,23 @@ impl RpcHandler {
             "update.dismiss" => self.handle_update_dismiss().await,
             "update.download" => self.handle_update_download().await,
             "update.cancel-download" => self.handle_update_cancel_download().await,
+            "update.list-mirrors" => self.handle_update_list_mirrors().await,
+            "update.add-mirror" => {
+                let p = params.unwrap_or(serde_json::json!({}));
+                self.handle_update_add_mirror(&p).await
+            }
+            "update.remove-mirror" => {
+                let p = params.unwrap_or(serde_json::json!({}));
+                self.handle_update_remove_mirror(&p).await
+            }
+            "update.set-primary-mirror" => {
+                let p = params.unwrap_or(serde_json::json!({}));
+                self.handle_update_set_primary_mirror(&p).await
+            }
+            "update.test-mirror" => {
+                let p = params.unwrap_or(serde_json::json!({}));
+                self.handle_update_test_mirror(&p).await
+            }
             "update.apply" => self.handle_update_apply().await,
             "update.git-apply" => self.handle_update_git_apply().await,
             "update.rollback" => self.handle_update_rollback().await,

core/archipelago/src/api/rpc/fips.rs

@@ -12,8 +12,7 @@ use anyhow::Result;
 
 impl RpcHandler {
     pub(super) async fn handle_fips_status(&self) -> Result<serde_json::Value> {
-        let identity_dir = fips::identity_dir_from(&self.config.data_dir);
-        let status = fips::FipsStatus::query(&identity_dir).await;
+        let status = fips::FipsStatus::query(&self.config.data_dir).await;
         Ok(serde_json::to_value(status)?)
     }
 
@@ -36,13 +35,19 @@ impl RpcHandler {
         let identity_dir = fips::identity_dir_from(&self.config.data_dir);
         fips::config::install(&identity_dir).await?;
         fips::service::activate(fips::SERVICE_UNIT).await?;
-        let status = fips::FipsStatus::query(&identity_dir).await;
+        let status = fips::FipsStatus::query(&self.config.data_dir).await;
         Ok(serde_json::to_value(status)?)
     }
 
+    /// Restart whichever fips unit is supervising the daemon on this host.
+    /// Nodes installed from the archipelago ISO use `archipelago-fips.service`;
+    /// nodes that had the upstream debian package set up first may only have
+    /// `fips.service`. We resolve the active one via `service::active_unit()`
+    /// so the UI button is never a no-op.
     pub(super) async fn handle_fips_restart(&self) -> Result<serde_json::Value> {
-        fips::service::restart(fips::SERVICE_UNIT).await?;
-        Ok(serde_json::json!({ "restarted": true }))
+        let unit = fips::service::active_unit().await;
+        fips::service::restart(unit).await?;
+        Ok(serde_json::json!({ "restarted": true, "unit": unit }))
     }
 
     /// Full reconnect: stop the daemon, bring it back, wait for the DHT
@@ -53,7 +58,7 @@ impl RpcHandler {
     /// Runtime: ~20s. Needs an RPC timeout ≥ 45s on the client.
     pub(super) async fn handle_fips_reconnect(&self) -> Result<serde_json::Value> {
         let identity_dir = fips::identity_dir_from(&self.config.data_dir);
-        let before = fips::FipsStatus::query(&identity_dir).await;
+        let before = fips::FipsStatus::query(&self.config.data_dir).await;
 
         // Heal the pre-fix bech32-text fips_key.pub → 32-raw-bytes
         // mismatch. The daemon silently authenticates with a garbage
@@ -70,12 +75,26 @@ impl RpcHandler {
             let _ = fips::config::install(&identity_dir).await;
         }
 
-        // Clean stop+start rather than `restart`, so a daemon that
-        // fails to come back up surfaces as service_active=false
-        // instead of quietly sticking with the old process.
-        let _ = fips::service::stop(fips::SERVICE_UNIT).await;
+        // Operate on whichever fips unit is actually up — nodes that
+        // have the upstream `fips.service` rather than the
+        // archipelago-managed `archipelago-fips.service` used to see
+        // Reconnect silently fail because we stopped a unit that
+        // didn't exist. Clean stop+start rather than `restart` so a
+        // daemon that fails to come back up surfaces as
+        // service_active=false instead of quietly sticking with the
+        // old process.
+        let unit = fips::service::active_unit().await;
+        let _ = fips::service::stop(unit).await;
         tokio::time::sleep(std::time::Duration::from_millis(800)).await;
-        fips::service::activate(fips::SERVICE_UNIT).await?;
+        fips::service::activate(unit).await?;
+
+        // Re-push seed anchors after restart so freshly-bound daemons
+        // don't have to wait 5 min for the periodic apply loop.
+        if let Ok(list) = fips::anchors::load(&self.config.data_dir).await {
+            if !list.is_empty() {
+                let _ = fips::anchors::apply(&list).await;
+            }
+        }
 
         // Anchor bootstrap window: poll the status every ~3s for up to
         // 20s. Bail as soon as the anchor is connected.
@@ -83,7 +102,7 @@ impl RpcHandler {
         let deadline = std::time::Instant::now() + std::time::Duration::from_secs(20);
         loop {
             tokio::time::sleep(std::time::Duration::from_secs(3)).await;
-            let s = fips::FipsStatus::query(&identity_dir).await;
+            let s = fips::FipsStatus::query(&self.config.data_dir).await;
             if s.anchor_connected {
                 last_status = Some(s);
                 break;
@@ -111,13 +130,13 @@ impl RpcHandler {
             "peers_but_no_anchor"
         };
         let hint = match likely_cause {
-            "connected" => "Anchor is reachable.",
-            "daemon_down" => "The FIPS daemon didn't come back up — check archipelago-fips.service.",
+            "connected" => "An anchor is reachable.",
+            "daemon_down" => "The FIPS daemon didn't come back up — check the FIPS service on this host.",
             "no_seed_key" => "No seed-derived FIPS key on disk. Re-run the onboarding unlock step.",
             "no_outbound_udp_or_anchor_down" =>
-                "Daemon is running but no peers handshook. Your router / ISP might be blocking outbound UDP 8668, or the anchor (fips.v0l.io) could be down.",
+                "Daemon is running but no peers handshook. Your router / ISP might be blocking outbound UDP 8668, or every configured anchor could be down. Add a reachable peer in Seed Anchors.",
             "peers_but_no_anchor" =>
-                "Mesh has peers but the anchor hasn't been seen yet. Give it a minute and re-check.",
+                "Mesh has peers but none of them are anchors we recognise. Add your cluster's anchor in Seed Anchors.",
             _ => "",
         };
 
@@ -129,4 +148,66 @@ impl RpcHandler {
             "after": after,
         }))
     }
+
+    /// List the seed-anchor entries configured on this node.
+    pub(super) async fn handle_fips_list_seed_anchors(&self) -> Result<serde_json::Value> {
+        let list = fips::anchors::load(&self.config.data_dir).await?;
+        Ok(serde_json::json!({ "seed_anchors": list }))
+    }
+
+    /// Add (or update) a seed anchor and immediately push it into the
+    /// running daemon. Params: `{ npub, address, transport?, label? }`.
+    pub(super) async fn handle_fips_add_seed_anchor(
+        &self,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value> {
+        let anchor: fips::anchors::SeedAnchor = serde_json::from_value(params.clone())
+            .map_err(|e| anyhow::anyhow!("bad seed anchor payload: {}", e))?;
+        if !anchor.npub.starts_with("npub1") {
+            anyhow::bail!("npub must be bech32 (npub1...)");
+        }
+        if !anchor.address.contains(':') {
+            anyhow::bail!("address must be host:port (e.g. 192.168.1.116:8668)");
+        }
+        let list =
+            fips::anchors::add(&self.config.data_dir, anchor.clone()).await?;
+        // Push just the newly-added anchor into the running daemon so
+        // the user sees effect without waiting for the periodic apply.
+        let results = fips::anchors::apply(&[anchor]).await;
+        Ok(serde_json::json!({
+            "seed_anchors": list,
+            "apply": results.iter().map(|r| {
+                serde_json::json!({ "npub": r.npub, "ok": r.ok, "message": r.message })
+            }).collect::<Vec<_>>(),
+        }))
+    }
+
+    /// Remove a seed anchor by npub. Params: `{ npub }`. Does NOT tear
+    /// down an already-authenticated peer connection — it only stops
+    /// us from re-dialing the anchor on the next apply cycle.
+    pub(super) async fn handle_fips_remove_seed_anchor(
+        &self,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value> {
+        let npub = params
+            .get("npub")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("missing npub"))?;
+        let list = fips::anchors::remove(&self.config.data_dir, npub).await?;
+        Ok(serde_json::json!({ "seed_anchors": list }))
+    }
+
+    /// Re-apply all seed anchors to the running daemon. Useful after a
+    /// FIPS restart or when the user wants to force a reconnection
+    /// attempt without waiting for the periodic apply loop.
+    pub(super) async fn handle_fips_apply_seed_anchors(&self) -> Result<serde_json::Value> {
+        let list = fips::anchors::load(&self.config.data_dir).await?;
+        let results = fips::anchors::apply(&list).await;
+        Ok(serde_json::json!({
+            "applied": results.len(),
+            "results": results.iter().map(|r| {
+                serde_json::json!({ "npub": r.npub, "ok": r.ok, "message": r.message })
+            }).collect::<Vec<_>>(),
+        }))
+    }
 }

core/archipelago/src/api/rpc/package/install.rs

@@ -649,8 +649,24 @@ impl RpcHandler {
         );
         let _ = std::fs::create_dir_all(&user_tmp);
 
+        // Rewrite to the primary registry's URL so the first attempt
+        // honors the operator's mirror choice (default: VPS) instead of
+        // blindly using whatever registry the image was hardcoded to.
+        // If the rewritten URL fails, pull_from_registries_with_skip
+        // falls through to the other configured registries.
+        let (primary_url, primary_tls) =
+            crate::container::registry::primary_image_url(&self.config.data_dir, docker_image)
+                .await;
+        if primary_url != docker_image {
+            debug!("Rewrote {} → {} for primary registry", docker_image, primary_url);
+        }
+
+        let mut pull_args = vec!["pull".to_string(), primary_url.clone()];
+        if !primary_tls {
+            pull_args.push("--tls-verify=false".to_string());
+        }
         let mut child = tokio::process::Command::new("podman")
-            .args(["pull", docker_image])
+            .args(&pull_args)
             .env("TMPDIR", &user_tmp)
             .stdout(std::process::Stdio::piped())
             .stderr(std::process::Stdio::piped())
@@ -684,23 +700,35 @@ impl RpcHandler {
                 true
             }
             Err(_) => {
-                tracing::warn!("Image pull timed out after 60s: {}", docker_image);
+                tracing::warn!("Image pull timed out after 60s: {}", primary_url);
                 let _ = child.kill().await;
                 let _ = child.wait().await; // reap zombie
                 true
             }
         };
+        if !primary_failed && primary_url != docker_image {
+            // Primary pull succeeded but used a rewritten URL. Tag under
+            // the original image reference so downstream code (images -q,
+            // run -d docker_image, etc.) finds it.
+            let _ = tokio::process::Command::new("podman")
+                .args(["tag", &primary_url, docker_image])
+                .output()
+                .await;
+            tracing::info!("Pulled {} from primary registry ({})", docker_image, primary_url);
+        }
         if primary_failed {
-            // Try all configured fallback registries dynamically
-            match crate::container::registry::pull_from_registries(
+            // Primary failed — walk the remaining configured registries.
+            // Skip primary_url so we don't retry what just failed.
+            match crate::container::registry::pull_from_registries_with_skip(
                 &self.config.data_dir,
                 docker_image,
                 &user_tmp,
+                Some(&primary_url),
             )
             .await
             {
                 Ok(_) => {
-                    tracing::info!("Pulled {} via dynamic registry fallback", docker_image);
+                    tracing::info!("Pulled {} via fallback registry", docker_image);
                 }
                 Err(e) => {
                     return Err(anyhow::anyhow!("Image pull failed: {}", e));
@@ -1467,6 +1495,36 @@ server {
         Ok(serde_json::json!({ "registries": config.registries, "removed": url }))
     }
 
+    /// Promote a registry to primary by resetting priorities — the named
+    /// URL becomes priority 0, every other enabled registry is bumped up
+    /// by 10. Order is stable (ties broken by original priority).
+    pub(in crate::api::rpc) async fn handle_registry_set_primary(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let params = params.ok_or_else(|| anyhow::anyhow!("Missing params"))?;
+        let url = params
+            .get("url")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("Missing url"))?;
+
+        let mut config = crate::container::registry::load_registries(&self.config.data_dir).await?;
+        if !config.registries.iter().any(|r| r.url == url) {
+            return Err(anyhow::anyhow!("Registry '{}' not found", url));
+        }
+
+        // Reassign priorities: target = 0, everyone else = 10, 20, 30…
+        // in their existing priority order.
+        let target_url = url.to_string();
+        config.registries.sort_by_key(|r| (r.url != target_url, r.priority));
+        for (i, r) in config.registries.iter_mut().enumerate() {
+            r.priority = if r.url == target_url { 0 } else { (i as u32) * 10 };
+        }
+
+        crate::container::registry::save_registries(&self.config.data_dir, &config).await?;
+        Ok(serde_json::json!({ "registries": config.registries, "primary": url }))
+    }
+
     pub(in crate::api::rpc) async fn handle_registry_test(
         &self,
         params: Option<serde_json::Value>,

core/archipelago/src/api/rpc/update.rs

@@ -40,6 +40,7 @@ impl RpcHandler {
             "last_check": state.last_check,
             "update_available": update_info.is_some(),
             "update": update_info,
+            "manifest_mirror": state.manifest_mirror,
         }))
     }
 
@@ -195,6 +196,7 @@ impl RpcHandler {
             "update_available": state.available_update.is_some(),
             "update_in_progress": state.update_in_progress,
             "rollback_available": state.rollback_available,
+            "manifest_mirror": state.manifest_mirror,
             "download_progress": if active || completed {
                 Some(serde_json::json!({
                     "bytes_downloaded": downloaded,
@@ -241,6 +243,89 @@ impl RpcHandler {
         Ok(serde_json::json!({ "rolled_back": true, "restart_required": true }))
     }
 
+    /// List configured update mirrors in priority order.
+    pub(super) async fn handle_update_list_mirrors(&self) -> Result<serde_json::Value> {
+        let list = update::load_mirrors(&self.config.data_dir).await?;
+        Ok(serde_json::json!({ "mirrors": list }))
+    }
+
+    /// Add a mirror to the end of the list. Params: `{ url, label? }`.
+    /// Duplicates (same URL) are replaced rather than added twice.
+    pub(super) async fn handle_update_add_mirror(
+        &self,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value> {
+        let url = params
+            .get("url")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("missing url"))?
+            .trim()
+            .to_string();
+        if !url.starts_with("http://") && !url.starts_with("https://") {
+            anyhow::bail!("url must start with http:// or https://");
+        }
+        let label = params
+            .get("label")
+            .and_then(|v| v.as_str())
+            .unwrap_or("")
+            .trim()
+            .to_string();
+        let mut list = update::load_mirrors(&self.config.data_dir).await?;
+        list.retain(|m| m.url != url);
+        list.push(update::UpdateMirror { url, label });
+        update::save_mirrors(&self.config.data_dir, &list).await?;
+        Ok(serde_json::json!({ "mirrors": list }))
+    }
+
+    /// Remove a mirror by URL. Params: `{ url }`.
+    pub(super) async fn handle_update_remove_mirror(
+        &self,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value> {
+        let url = params
+            .get("url")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("missing url"))?;
+        let mut list = update::load_mirrors(&self.config.data_dir).await?;
+        list.retain(|m| m.url != url);
+        update::save_mirrors(&self.config.data_dir, &list).await?;
+        Ok(serde_json::json!({ "mirrors": list }))
+    }
+
+    /// Ping a mirror's manifest URL. Returns reachability, wall-clock
+    /// latency, and HTTP status. Params: `{ url }`.
+    pub(super) async fn handle_update_test_mirror(
+        &self,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value> {
+        let url = params
+            .get("url")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("missing url"))?;
+        let result = update::test_mirror(url).await;
+        Ok(serde_json::to_value(result)?)
+    }
+
+    /// Move a mirror to the top of the list so it's tried first.
+    /// Params: `{ url }`.
+    pub(super) async fn handle_update_set_primary_mirror(
+        &self,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value> {
+        let url = params
+            .get("url")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("missing url"))?;
+        let mut list = update::load_mirrors(&self.config.data_dir).await?;
+        let Some(idx) = list.iter().position(|m| m.url == url) else {
+            anyhow::bail!("mirror not in list");
+        };
+        let entry = list.remove(idx);
+        list.insert(0, entry);
+        update::save_mirrors(&self.config.data_dir, &list).await?;
+        Ok(serde_json::json!({ "mirrors": list }))
+    }
+
     /// Get the current update schedule.
     pub(super) async fn handle_update_get_schedule(&self) -> Result<serde_json::Value> {
         let schedule = update::get_schedule(&self.config.data_dir).await?;

core/archipelago/src/container/registry.rs

@@ -44,16 +44,16 @@ impl Default for RegistryConfig {
         Self {
             registries: vec![
                 Registry {
-                    url: "git.tx1138.com/lfg2025".to_string(),
-                    name: "Archipelago Primary".to_string(),
-                    tls_verify: true,
+                    url: "23.182.128.160:3000/lfg2025".to_string(),
+                    name: "Server 1 (VPS)".to_string(),
+                    tls_verify: false,
                     enabled: true,
                     priority: 0,
                 },
                 Registry {
-                    url: "23.182.128.160:3000/lfg2025".to_string(),
-                    name: "Archipelago Fallback".to_string(),
-                    tls_verify: false,
+                    url: "git.tx1138.com/lfg2025".to_string(),
+                    name: "Server 2 (tx1138)".to_string(),
+                    tls_verify: true,
                     enabled: true,
                     priority: 10,
                 },
@@ -94,6 +94,28 @@ impl RegistryConfig {
 
         candidates
     }
+
+    /// Rewrite an image to use the highest-priority enabled registry, so
+    /// the FIRST pull attempt honors the operator's primary choice instead
+    /// of blindly using whatever registry the image URL was hardcoded to.
+    /// Returns (rewritten_url, tls_verify) — or the original URL + default
+    /// tls_verify=true if there's no primary (no enabled registries).
+    pub fn rewrite_for_primary(&self, image: &str) -> (String, bool) {
+        match self.active_registries().first() {
+            Some(primary) => (self.rewrite_image(image, primary), primary.tls_verify),
+            None => (image.to_string(), true),
+        }
+    }
+}
+
+/// Load the registry config and rewrite an image to use the primary
+/// registry's URL. Convenience wrapper for callers that don't already
+/// have a `RegistryConfig` in hand.
+pub async fn primary_image_url(data_dir: &Path, image: &str) -> (String, bool) {
+    match load_registries(data_dir).await {
+        Ok(config) => config.rewrite_for_primary(image),
+        Err(_) => (image.to_string(), true),
+    }
 }
 
 /// Extract the image name from a full image reference.
@@ -134,10 +156,20 @@ pub async fn save_registries(data_dir: &Path, config: &RegistryConfig) -> Result
 }
 
 /// Try pulling an image from configured registries in priority order.
+/// If `already_tried` is Some, that URL is skipped (avoids retrying the
+/// primary when the caller already attempted it with progress streaming).
 /// Returns the image reference that succeeded.
-pub async fn pull_from_registries(data_dir: &Path, image: &str, tmpdir: &str) -> Result<String> {
+pub async fn pull_from_registries_with_skip(
+    data_dir: &Path,
+    image: &str,
+    tmpdir: &str,
+    already_tried: Option<&str>,
+) -> Result<String> {
     let config = load_registries(data_dir).await?;
-    let candidates = config.image_candidates(image);
+    let mut candidates = config.image_candidates(image);
+    if let Some(skip) = already_tried {
+        candidates.retain(|(url, _)| url != skip);
+    }
 
     for (candidate, tls_verify) in &candidates {
         debug!("Trying registry: {}", candidate);
@@ -196,6 +228,7 @@ pub async fn pull_from_registries(data_dir: &Path, image: &str, tmpdir: &str) ->
     ))
 }
 
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -217,9 +250,11 @@ mod tests {
     #[test]
     fn test_rewrite_image() {
         let config = RegistryConfig::default();
-        let fallback = &config.registries[1];
+        // Default primary is now VPS (index 0). A tx1138-hardcoded image
+        // rewrites to VPS when asked for the primary mirror.
+        let primary = &config.registries[0];
         assert_eq!(
-            config.rewrite_image("git.tx1138.com/lfg2025/bitcoin-knots:latest", fallback),
+            config.rewrite_image("git.tx1138.com/lfg2025/bitcoin-knots:latest", primary),
             "23.182.128.160:3000/lfg2025/bitcoin-knots:latest"
         );
     }
@@ -228,8 +263,20 @@ mod tests {
     fn test_image_candidates() {
         let config = RegistryConfig::default();
         let candidates = config.image_candidates("git.tx1138.com/lfg2025/lnd:v0.18.4-beta");
-        assert!(candidates.len() >= 2);
-        assert_eq!(candidates[0].0, "git.tx1138.com/lfg2025/lnd:v0.18.4-beta");
+        // Defaults: VPS (primary) + tx1138. tx1138 is filtered out because
+        // it's identical to the original image URL, leaving one candidate.
+        assert_eq!(candidates.len(), 1);
+        // Primary-first — VPS rewrite leads the candidate list.
+        assert_eq!(candidates[0].0, "23.182.128.160:3000/lfg2025/lnd:v0.18.4-beta");
+    }
+
+    #[test]
+    fn test_rewrite_for_primary_uses_top_priority() {
+        let config = RegistryConfig::default();
+        let (url, tls) =
+            config.rewrite_for_primary("git.tx1138.com/lfg2025/lnd:v0.18.4-beta");
+        assert_eq!(url, "23.182.128.160:3000/lfg2025/lnd:v0.18.4-beta");
+        assert!(!tls, "VPS primary is HTTP — tls_verify should be false");
     }
 
     #[test]

core/archipelago/src/fips/anchors.rs

@@ -0,0 +1,241 @@
+//! Seed-anchor management for FIPS bootstrap.
+//!
+//! A freshly-installed node can't reach the global mesh via npub
+//! routing until it's connected to at least one peer that's already in
+//! the DHT. Upstream `fips` solves this by dialing a public anchor
+//! (e.g. `fips.v0l.io`) on first start. That's a single point of
+//! failure and doesn't help nodes behind restrictive firewalls or
+//! intermittent networks — archipelago operators reported fresh
+//! installs failing to reach any public anchor.
+//!
+//! This module adds a local, operator-editable seed-anchor list. Each
+//! entry is a `{npub, address, transport}` triple that archipelago
+//! pushes into the running daemon via `fipsctl connect` on startup and
+//! periodically thereafter. If one anchor falls over, the next one
+//! seeds the DHT instead. A well-configured cluster (e.g. a VPS
+//! running fips in anchor mode + a couple of home nodes) stops
+//! depending on the global anchor entirely.
+//!
+//! The list is persisted at `<data_dir>/seed-anchors.json`. The
+//! archipelago service user owns that directory, so no sudo is needed
+//! to read or write it.
+
+use anyhow::{Context, Result};
+use serde::{Deserialize, Serialize};
+use std::path::{Path, PathBuf};
+use tokio::process::Command;
+
+/// On-disk filename under `data_dir/`.
+const SEED_ANCHORS_FILE: &str = "seed-anchors.json";
+
+/// Public anchor (`fips.v0l.io`) carried as a default seed for fresh
+/// installs — the one the upstream daemon dials anyway. Operators can
+/// remove it from the UI once their own cluster has independent anchors.
+pub const DEFAULT_PUBLIC_ANCHOR_NPUB: &str =
+    "npub1zv58cn7v83mxvttl70w5fwjwuclfmntv9cnmv5wmz2nzz88u5urqvdx96n";
+pub const DEFAULT_PUBLIC_ANCHOR_ADDR: &str = "fips.v0l.io:8668";
+
+/// One seed-anchor entry. `address` must be directly dialable (IP or
+/// resolvable hostname + UDP port); `transport` is one of "udp", "tcp",
+/// "tor", "ethernet" (the values upstream `fipsctl connect` accepts).
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct SeedAnchor {
+    /// Bech32 `npub1...` of the anchor's FIPS identity.
+    pub npub: String,
+    /// Directly-dialable transport address, e.g. `192.168.1.116:8668`.
+    pub address: String,
+    /// Transport to use — almost always `"udp"`.
+    #[serde(default = "default_transport")]
+    pub transport: String,
+    /// Human-readable note shown in the UI (e.g. "Home anchor", "VPS").
+    #[serde(default)]
+    pub label: String,
+}
+
+fn default_transport() -> String {
+    "udp".to_string()
+}
+
+fn anchors_path(data_dir: &Path) -> PathBuf {
+    data_dir.join(SEED_ANCHORS_FILE)
+}
+
+/// Load the seed-anchor list. Returns an empty list if the file
+/// doesn't exist yet — a first-boot node with no operator config.
+pub async fn load(data_dir: &Path) -> Result<Vec<SeedAnchor>> {
+    let path = anchors_path(data_dir);
+    if !path.exists() {
+        return Ok(Vec::new());
+    }
+    let bytes = tokio::fs::read(&path)
+        .await
+        .with_context(|| format!("read {}", path.display()))?;
+    let anchors: Vec<SeedAnchor> = serde_json::from_slice(&bytes)
+        .with_context(|| format!("parse {}", path.display()))?;
+    Ok(anchors)
+}
+
+/// Persist the list. Overwrites atomically via write-then-rename so a
+/// crashed archipelago never leaves a half-written config.
+pub async fn save(data_dir: &Path, anchors: &[SeedAnchor]) -> Result<()> {
+    tokio::fs::create_dir_all(data_dir)
+        .await
+        .with_context(|| format!("mkdir -p {}", data_dir.display()))?;
+    let path = anchors_path(data_dir);
+    let tmp = path.with_extension("json.tmp");
+    let json = serde_json::to_vec_pretty(anchors).context("serialize seed anchors")?;
+    tokio::fs::write(&tmp, json)
+        .await
+        .with_context(|| format!("write {}", tmp.display()))?;
+    tokio::fs::rename(&tmp, &path)
+        .await
+        .with_context(|| format!("rename {} -> {}", tmp.display(), path.display()))?;
+    Ok(())
+}
+
+/// Add (or update) one anchor, keyed by npub. Returns the resulting list.
+pub async fn add(data_dir: &Path, anchor: SeedAnchor) -> Result<Vec<SeedAnchor>> {
+    let mut list = load(data_dir).await?;
+    if let Some(existing) = list.iter_mut().find(|a| a.npub == anchor.npub) {
+        *existing = anchor;
+    } else {
+        list.push(anchor);
+    }
+    save(data_dir, &list).await?;
+    Ok(list)
+}
+
+/// Remove an anchor by npub. Returns the resulting list.
+pub async fn remove(data_dir: &Path, npub: &str) -> Result<Vec<SeedAnchor>> {
+    let mut list = load(data_dir).await?;
+    list.retain(|a| a.npub != npub);
+    save(data_dir, &list).await?;
+    Ok(list)
+}
+
+/// Apply the seed anchors to the running FIPS daemon. For each entry,
+/// asks `fipsctl connect` to dial the peer. Errors are logged but don't
+/// fail the whole operation — a single unreachable anchor shouldn't
+/// block the others.
+///
+/// `fipsctl connect` is idempotent-ish: calling it for an already-
+/// connected peer is a no-op at the protocol layer, so re-applying on
+/// a timer is safe. Returns a list of per-anchor results for logging.
+pub async fn apply(anchors: &[SeedAnchor]) -> Vec<ApplyResult> {
+    let mut results = Vec::with_capacity(anchors.len());
+    for anchor in anchors {
+        let out = Command::new("fipsctl")
+            .args([
+                "connect",
+                &anchor.npub,
+                &anchor.address,
+                &anchor.transport,
+            ])
+            .output()
+            .await;
+        let result = match out {
+            Ok(o) if o.status.success() => ApplyResult {
+                npub: anchor.npub.clone(),
+                ok: true,
+                message: String::from_utf8_lossy(&o.stdout).trim().to_string(),
+            },
+            Ok(o) => ApplyResult {
+                npub: anchor.npub.clone(),
+                ok: false,
+                message: format!(
+                    "fipsctl exited {}: {}",
+                    o.status,
+                    String::from_utf8_lossy(&o.stderr).trim()
+                ),
+            },
+            Err(e) => ApplyResult {
+                npub: anchor.npub.clone(),
+                ok: false,
+                message: format!("fipsctl launch failed: {}", e),
+            },
+        };
+        if result.ok {
+            tracing::debug!(npub = %result.npub, "Seed anchor applied");
+        } else {
+            tracing::warn!(
+                npub = %result.npub,
+                message = %result.message,
+                "Seed anchor apply failed (non-fatal)"
+            );
+        }
+        results.push(result);
+    }
+    results
+}
+
+/// Outcome of a single `fipsctl connect` call.
+#[derive(Debug, Clone)]
+pub struct ApplyResult {
+    pub npub: String,
+    pub ok: bool,
+    pub message: String,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn mk(npub: &str) -> SeedAnchor {
+        SeedAnchor {
+            npub: npub.to_string(),
+            address: "example.test:8668".to_string(),
+            transport: "udp".to_string(),
+            label: "test".to_string(),
+        }
+    }
+
+    #[tokio::test]
+    async fn load_missing_returns_empty() {
+        let dir = tempfile::tempdir().unwrap();
+        let got = load(dir.path()).await.unwrap();
+        assert!(got.is_empty());
+    }
+
+    #[tokio::test]
+    async fn save_and_load_roundtrip() {
+        let dir = tempfile::tempdir().unwrap();
+        let a = mk("npub1aaa");
+        let b = mk("npub1bbb");
+        save(dir.path(), &[a.clone(), b.clone()]).await.unwrap();
+        let got = load(dir.path()).await.unwrap();
+        assert_eq!(got, vec![a, b]);
+    }
+
+    #[tokio::test]
+    async fn add_replaces_existing_by_npub() {
+        let dir = tempfile::tempdir().unwrap();
+        let mut a = mk("npub1aaa");
+        save(dir.path(), &[a.clone()]).await.unwrap();
+        a.address = "newhost:8668".to_string();
+        let list = add(dir.path(), a.clone()).await.unwrap();
+        assert_eq!(list.len(), 1);
+        assert_eq!(list[0].address, "newhost:8668");
+    }
+
+    #[tokio::test]
+    async fn remove_by_npub() {
+        let dir = tempfile::tempdir().unwrap();
+        save(
+            dir.path(),
+            &[mk("npub1aaa"), mk("npub1bbb"), mk("npub1ccc")],
+        )
+        .await
+        .unwrap();
+        let list = remove(dir.path(), "npub1bbb").await.unwrap();
+        assert_eq!(list.len(), 2);
+        assert!(list.iter().all(|a| a.npub != "npub1bbb"));
+    }
+
+    #[test]
+    fn seed_anchor_uses_udp_by_default() {
+        let json = r#"{"npub":"npub1x","address":"h:8668"}"#;
+        let a: SeedAnchor = serde_json::from_str(json).unwrap();
+        assert_eq!(a.transport, "udp");
+        assert_eq!(a.label, "");
+    }
+}

core/archipelago/src/fips/config.rs

@@ -13,22 +13,27 @@ use anyhow::{Context, Result};
 use std::path::Path;
 use tokio::process::Command;
 
-use super::{DAEMON_CONFIG_PATH, DAEMON_KEY_PATH, DAEMON_PUB_PATH, DEFAULT_UDP_PORT};
+use super::{DAEMON_CONFIG_PATH, DAEMON_KEY_PATH, DAEMON_PUB_PATH, DEFAULT_TCP_PORT, DEFAULT_UDP_PORT};
 
 /// Write the FIPS daemon config based on the local npub and default
 /// transports. Overwrites any existing file — callers are expected to
 /// re-run this whenever the key or daemon version changes.
 ///
 /// Schema is intentionally minimal: node identity comes from the key
-/// file on disk (the daemon handles it), transports enable UDP + Tor,
-/// IPv6 TUN + DNS on defaults. Static peer list is empty — archipelago
-/// feeds peers dynamically via federation updates.
+/// file on disk (the daemon handles it), transports enable UDP + TCP
+/// (matching upstream factory default), IPv6 TUN + DNS on defaults.
+/// Static peer list is empty — archipelago feeds peers dynamically via
+/// the seed-anchors apply loop and federation-invite hooks.
 pub fn render_config_yaml() -> String {
     // Schema matches upstream jmcorgan/fips as of 2026-04. With
     // `node.identity.persistent: true` the daemon reuses the key file at
     // config-dir/fips.key (= DAEMON_KEY_PATH). Transports take `bind_addr`
-    // rather than `enabled: true / port: N`, and the upstream no longer
-    // has a `tor:` transport — archipelago's own Tor fallback handles that.
+    // rather than `enabled: true / port: N`. Both UDP and TCP are
+    // enabled by default because the public anchor (fips.v0l.io)
+    // currently answers on TCP/8443 only, and networks that block UDP
+    // outbound can still bootstrap via TCP. Upstream fips no longer
+    // has a `tor:` transport variant — archipelago's own Tor fallback
+    // handles that layer.
     format!(
         "# Generated by archipelago — do not edit by hand.\n\
          # Regenerated on every key change and daemon upgrade.\n\
@@ -44,9 +49,12 @@ pub fn render_config_yaml() -> String {
          bind_addr: \"127.0.0.1\"\n\
          transports:\n  \
          udp:\n    \
-         bind_addr: \"0.0.0.0:{port}\"\n\
+         bind_addr: \"0.0.0.0:{udp}\"\n  \
+         tcp:\n    \
+         bind_addr: \"0.0.0.0:{tcp}\"\n\
          peers: []\n",
-        port = DEFAULT_UDP_PORT,
+        udp = DEFAULT_UDP_PORT,
+        tcp = DEFAULT_TCP_PORT,
     )
 }
 
@@ -185,7 +193,9 @@ mod tests {
         let yaml = render_config_yaml();
         assert!(yaml.contains("persistent: true"));
         assert!(yaml.contains(&format!("0.0.0.0:{}", DEFAULT_UDP_PORT)));
+        assert!(yaml.contains(&format!("0.0.0.0:{}", DEFAULT_TCP_PORT)));
         assert!(yaml.contains("udp:"));
+        assert!(yaml.contains("tcp:"));
         assert!(yaml.contains("tun:"));
         assert!(yaml.contains("name: fips0"));
         // Upstream fips dropped the `tor:` transport variant; archipelago

core/archipelago/src/fips/mod.rs

@@ -25,6 +25,7 @@
 // the module is deliberately API-ready ahead of those call-sites.
 #![allow(dead_code)]
 
+pub mod anchors;
 pub mod config;
 pub mod dial;
 pub mod iface;
@@ -52,6 +53,14 @@ pub const UPSTREAM_REPO: &str = "jmcorgan/fips";
 /// Default UDP port the daemon listens on.
 pub const DEFAULT_UDP_PORT: u16 = 8668;
 
+/// Default TCP port the daemon listens on. Used as a fallback when a
+/// peer can't be reached over UDP — common on networks that block UDP
+/// (corporate/guest wifi) and the path the public fips.v0l.io anchor
+/// currently accepts. Upstream factory default enables both transports
+/// and archipelago intentionally matches that baseline so fresh nodes
+/// can reach the broader FIPS mesh without operator config.
+pub const DEFAULT_TCP_PORT: u16 = 8443;
+
 /// Upstream systemd unit shipped by the `fips` debian package. Archipelago
 /// prefers its own supervision (`archipelago-fips.service`) but respects an
 /// already-running upstream unit so legacy/dev nodes — where no seed-derived
@@ -98,7 +107,13 @@ pub struct FipsStatus {
 
 impl FipsStatus {
     /// Snapshot the current state across package, key, and service.
-    pub async fn query(identity_dir: &Path) -> Self {
+    ///
+    /// `data_dir` is the archipelago data-dir (used to load the
+    /// operator-configured seed-anchor list so "anchor_connected" means
+    /// "at least one authenticated peer matches a public or configured
+    /// seed anchor", not just "fips.v0l.io specifically").
+    pub async fn query(data_dir: &Path) -> Self {
+        let identity_dir = identity_dir_from(data_dir);
         let installed = service::package_installed().await;
         let version = if installed {
             service::daemon_version().await.ok()
@@ -109,17 +124,24 @@ impl FipsStatus {
         let upstream_service_state = service::unit_state(UPSTREAM_SERVICE_UNIT).await;
         let service_active =
             service_state == "active" || upstream_service_state == "active";
-        let key_present = crate::identity::fips_key_exists(identity_dir);
+        let key_present = crate::identity::fips_key_exists(&identity_dir);
 
         // Prefer the seed-derived npub; otherwise read the daemon's own
         // key file at /etc/fips/fips.pub (world-readable per debian pkg).
-        let npub = match crate::identity::fips_npub(identity_dir).await {
+        let npub = match crate::identity::fips_npub(&identity_dir).await {
             Ok(Some(n)) => Some(n),
             _ => service::read_upstream_npub().await.ok().flatten(),
         };
 
         let (authenticated_peer_count, anchor_connected) = if service_active {
-            service::peer_connectivity_summary().await
+            // Build the anchor-candidate list: hardcoded public anchor
+            // plus every entry in the operator's seed-anchors.json.
+            // The card lights up if any of them is authenticated.
+            let mut anchor_npubs = vec![service::PUBLIC_ANCHOR_NPUB.to_string()];
+            if let Ok(seed) = anchors::load(data_dir).await {
+                anchor_npubs.extend(seed.into_iter().map(|a| a.npub));
+            }
+            service::peer_connectivity_summary(&anchor_npubs).await
         } else {
             (0, false)
         };
@@ -152,10 +174,11 @@ mod tests {
     #[tokio::test]
     async fn test_status_reports_no_key_pre_onboarding() {
         let dir = tempfile::tempdir().unwrap();
-        let id_dir = dir.path().join("identity");
-        tokio::fs::create_dir_all(&id_dir).await.unwrap();
-
-        let status = FipsStatus::query(&id_dir).await;
+        // query() now takes a data_dir (parent) rather than identity_dir,
+        // since it also reads seed-anchors.json for the anchor check.
+        // No identity/ subdir → no key; no seed-anchors.json → public
+        // anchor is the only candidate.
+        let status = FipsStatus::query(dir.path()).await;
         assert!(!status.key_present, "no key before onboarding");
         assert!(status.npub.is_none());
         // `installed`, `service_state`, `version` depend on the host and are

core/archipelago/src/fips/service.rs

@@ -97,6 +97,27 @@ pub async fn restart(unit: &str) -> Result<()> {
     sudo_systemctl("restart", unit).await
 }
 
+/// Resolve which systemd unit is actually supervising the fips daemon
+/// on this host. Nodes installed from the archipelago ISO run
+/// `archipelago-fips.service`; nodes that were apt-installed (or had
+/// fips running before archipelago took over) may only have the
+/// upstream `fips.service`. Restart/Reconnect must operate on whichever
+/// one is running, otherwise the UI button is a silent no-op.
+///
+/// Returns the archipelago-managed unit name if it's active,
+/// else the upstream unit name if that's active,
+/// else the archipelago-managed name as a default (so activate() can
+/// bring it up).
+pub async fn active_unit() -> &'static str {
+    if unit_state(super::SERVICE_UNIT).await == "active" {
+        return super::SERVICE_UNIT;
+    }
+    if unit_state(super::UPSTREAM_SERVICE_UNIT).await == "active" {
+        return super::UPSTREAM_SERVICE_UNIT;
+    }
+    super::SERVICE_UNIT
+}
+
 pub async fn mask(unit: &str) -> Result<()> {
     let _ = sudo_systemctl("stop", unit).await;
     let _ = sudo_systemctl("disable", unit).await;
@@ -108,12 +129,19 @@ pub async fn mask(unit: &str) -> Result<()> {
 pub const PUBLIC_ANCHOR_NPUB: &str =
     "npub1zv58cn7v83mxvttl70w5fwjwuclfmntv9cnmv5wmz2nzz88u5urqvdx96n";
 
-/// Summarise peer connectivity from `fipsctl show peers` + `identity-cache`.
-/// Returns `(authenticated_peer_count, anchor_connected)`. Shells out rather
-/// than embedding a fips client because fipsctl is the daemon's own ground
-/// truth — the daemon can always rewrite its internal routing and we'd
-/// rather be consistent with `fipsctl` than snapshot it ourselves.
-pub async fn peer_connectivity_summary() -> (u32, bool) {
+/// Summarise peer connectivity from `fipsctl show peers`. Returns
+/// `(authenticated_peer_count, anchor_connected)`.
+///
+/// `anchor_candidates` is the operator-controlled list of npubs this
+/// node considers a valid mesh anchor — always includes the hard-coded
+/// public anchor, plus any entries from `seed-anchors.json`. A node is
+/// "anchor connected" when at least one currently-authenticated peer
+/// matches one of these npubs. We used to check the identity cache
+/// (which includes transient hearsay from other peers), but a cache
+/// hit on `fips.v0l.io` didn't mean we could actually route through
+/// it, and the card lied to users whose mesh was federated through
+/// their own seed anchors instead.
+pub async fn peer_connectivity_summary(anchor_candidates: &[String]) -> (u32, bool) {
     let peers_json = match Command::new("sudo")
         .args(["-n", "fipsctl", "show", "peers"])
         .output()
@@ -122,39 +150,26 @@ pub async fn peer_connectivity_summary() -> (u32, bool) {
         Ok(o) if o.status.success() => o.stdout,
         _ => return (0, false),
     };
-    let authenticated_peer_count =
-        match serde_json::from_slice::<serde_json::Value>(&peers_json) {
-            Ok(v) => v
-                .get("peers")
-                .and_then(|p| p.as_array())
-                .map(|a| a.len() as u32)
-                .unwrap_or(0),
-            Err(_) => 0,
+    let parsed: serde_json::Value =
+        match serde_json::from_slice(&peers_json) {
+            Ok(v) => v,
+            Err(_) => return (0, false),
         };
-
-    // Anchor check: look in identity-cache (known node pubkeys the daemon
-    // has heard about) rather than authenticated peers — the anchor may be
-    // in the cache but not currently at session depth.
-    let cache_json = match Command::new("sudo")
-        .args(["-n", "fipsctl", "show", "identity-cache"])
-        .output()
-        .await
-    {
-        Ok(o) if o.status.success() => o.stdout,
-        _ => return (authenticated_peer_count, false),
-    };
-    let anchor_connected = match serde_json::from_slice::<serde_json::Value>(&cache_json) {
-        Ok(v) => v
-            .get("entries")
-            .and_then(|e| e.as_array())
-            .map(|entries| {
-                entries
-                    .iter()
-                    .any(|e| e.get("npub").and_then(|n| n.as_str()) == Some(PUBLIC_ANCHOR_NPUB))
-            })
-            .unwrap_or(false),
-        Err(_) => false,
-    };
+    let peers = parsed
+        .get("peers")
+        .and_then(|p| p.as_array())
+        .cloned()
+        .unwrap_or_default();
+    let authenticated_peer_count = peers.len() as u32;
+    let anchor_connected = peers.iter().any(|p| {
+        let npub = p.get("npub").and_then(|n| n.as_str()).unwrap_or_default();
+        let connected = p
+            .get("connectivity")
+            .and_then(|c| c.as_str())
+            .map(|s| s == "connected")
+            .unwrap_or(true);
+        connected && anchor_candidates.iter().any(|a| a == npub)
+    });
     (authenticated_peer_count, anchor_connected)
 }
 

core/archipelago/src/server.rs

@@ -353,6 +353,34 @@ impl Server {
             });
         }
 
+        // FIPS seed-anchor apply loop — every 5 minutes we re-push the
+        // configured seed anchors into the running fips daemon via
+        // `fipsctl connect`. This keeps the mesh bootstrap resilient:
+        // operators add cluster-local anchors in the UI, and a daemon
+        // restart or a flaky public anchor can't strand the node.
+        // First run is delayed 30s so fips has time to come up after
+        // onboarding before we start dialing.
+        {
+            let data_dir = config.data_dir.clone();
+            tokio::spawn(async move {
+                tokio::time::sleep(Duration::from_secs(30)).await;
+                let mut interval = tokio::time::interval(Duration::from_secs(300));
+                loop {
+                    interval.tick().await;
+                    match crate::fips::anchors::load(&data_dir).await {
+                        Ok(list) if !list.is_empty() => {
+                            let _ = crate::fips::anchors::apply(&list).await;
+                        }
+                        Ok(_) => { /* no seed anchors configured yet */ }
+                        Err(e) => tracing::debug!(
+                            "Seed-anchor apply: load failed (non-fatal): {}",
+                            e
+                        ),
+                    }
+                }
+            });
+        }
+
         // did:dht auto-refresh — re-publish DHT records every 2 hours
         if config.nostr_discovery_enabled {
             let data_dir = config.data_dir.clone();
@@ -482,10 +510,37 @@ impl Server {
                     tracing::warn!("FIPS key load/migrate failed: {}", e);
                     return;
                 }
+                // Check if the installed fips.yaml matches what we'd
+                // render now. If not, we need to restart the daemon after
+                // reinstalling so it picks up schema changes (e.g. the
+                // v1.7.25 re-addition of the TCP transport). Without this,
+                // OTA'd nodes would be stuck on the old UDP-only config
+                // until someone manually clicked Reconnect.
+                let expected = crate::fips::config::render_config_yaml();
+                let installed = tokio::fs::read_to_string("/etc/fips/fips.yaml")
+                    .await
+                    .ok();
+                let config_changed = installed.as_deref() != Some(expected.as_str());
+
                 if let Err(e) = crate::fips::config::install(&identity_dir).await {
                     tracing::warn!("FIPS config install failed on startup: {}", e);
                     return;
                 }
+                if config_changed {
+                    tracing::info!(
+                        "FIPS config schema changed on disk — restarting daemon to pick up new transports"
+                    );
+                    // Restart whichever unit is actually supervising
+                    // the daemon (archipelago-fips vs upstream fips).
+                    let unit = crate::fips::service::active_unit().await;
+                    if let Err(e) = crate::fips::service::restart(unit).await {
+                        tracing::warn!(
+                            "FIPS restart after config migration failed on {}: {} — user can retry via fips.reconnect",
+                            unit,
+                            e
+                        );
+                    }
+                }
                 if let Err(e) = crate::fips::service::activate(crate::fips::SERVICE_UNIT).await {
                     tracing::warn!(
                         "archipelago-fips activate failed on startup: {} — user can retry via fips.install RPC",

core/archipelago/src/update.rs

@@ -63,8 +63,119 @@ fn is_newer(candidate: &str, current: &str) -> bool {
 
 const DEFAULT_UPDATE_MANIFEST_URL: &str =
     "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/manifest.json";
+/// Secondary mirror: same manifest, served from the VPS. Added as a
+/// default mirror so nodes automatically fall through when the primary
+/// is slow or unreachable.
+const DEFAULT_SECONDARY_MIRROR_URL: &str =
+    "http://23.182.128.160:3000/lfg2025/archy/raw/branch/main/releases/manifest.json";
 const UPDATE_STATE_FILE: &str = "update_state.json";
+const UPDATE_MIRRORS_FILE: &str = "update-mirrors.json";
 
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct UpdateMirror {
+    /// Full URL to `manifest.json`. Download URLs in the fetched
+    /// manifest are origin-rewritten to match this URL's scheme+host+
+    /// port, so hitting a mirror pulls its components from the same
+    /// mirror rather than whatever absolute host the publisher baked in.
+    pub url: String,
+    /// Human-readable label for the UI ("Server 1", "Home VPS", …).
+    #[serde(default)]
+    pub label: String,
+}
+
+fn mirrors_path(data_dir: &Path) -> std::path::PathBuf {
+    data_dir.join(UPDATE_MIRRORS_FILE)
+}
+
+fn default_mirrors() -> Vec<UpdateMirror> {
+    vec![
+        UpdateMirror {
+            url: DEFAULT_SECONDARY_MIRROR_URL.to_string(),
+            label: "Server 1 (VPS)".to_string(),
+        },
+        UpdateMirror {
+            url: DEFAULT_UPDATE_MANIFEST_URL.to_string(),
+            label: "Server 2 (tx1138)".to_string(),
+        },
+    ]
+}
+
+/// Load the operator-configured mirror list. Returns defaults if the
+/// file doesn't exist yet, so a node OTA'd from a pre-mirrors release
+/// starts with both Server 1 and Server 2 available without any manual
+/// config.
+pub async fn load_mirrors(data_dir: &Path) -> Result<Vec<UpdateMirror>> {
+    let path = mirrors_path(data_dir);
+    if !path.exists() {
+        return Ok(default_mirrors());
+    }
+    let bytes = fs::read(&path)
+        .await
+        .with_context(|| format!("read {}", path.display()))?;
+    let list: Vec<UpdateMirror> =
+        serde_json::from_slice(&bytes).with_context(|| format!("parse {}", path.display()))?;
+    if list.is_empty() {
+        Ok(default_mirrors())
+    } else {
+        Ok(list)
+    }
+}
+
+pub async fn save_mirrors(data_dir: &Path, mirrors: &[UpdateMirror]) -> Result<()> {
+    fs::create_dir_all(data_dir)
+        .await
+        .with_context(|| format!("mkdir {}", data_dir.display()))?;
+    let path = mirrors_path(data_dir);
+    let tmp = path.with_extension("json.tmp");
+    let json = serde_json::to_vec_pretty(mirrors).context("serialize mirrors")?;
+    fs::write(&tmp, json)
+        .await
+        .with_context(|| format!("write {}", tmp.display()))?;
+    fs::rename(&tmp, &path)
+        .await
+        .with_context(|| format!("rename {} -> {}", tmp.display(), path.display()))?;
+    Ok(())
+}
+
+/// Parse a manifest URL and return its `scheme://host[:port]` prefix.
+/// Used by `rewrite_manifest_origins` so a manifest fetched from a
+/// mirror points component downloads back at the same mirror rather
+/// than whatever absolute URL the publisher baked in.
+fn manifest_origin(manifest_url: &str) -> Option<String> {
+    let rest = manifest_url.strip_prefix("https://")
+        .map(|r| ("https", r))
+        .or_else(|| manifest_url.strip_prefix("http://").map(|r| ("http", r)))?;
+    let (scheme, after_scheme) = rest;
+    let host_and_port = after_scheme.split('/').next()?;
+    if host_and_port.is_empty() {
+        return None;
+    }
+    Some(format!("{}://{}", scheme, host_and_port))
+}
+
+/// Rewrite every component `download_url` so its origin matches the
+/// manifest URL we just fetched. Preserves the path portion (which is
+/// consistent across mirrors — every gitea serves `/lfg2025/archy/raw/…`).
+/// Leaves URLs with a different path shape untouched (some operator
+/// might mirror with a custom layout; in that case we don't guess).
+fn rewrite_manifest_origins(manifest: &mut UpdateManifest, manifest_url: &str) {
+    let Some(new_origin) = manifest_origin(manifest_url) else {
+        return;
+    };
+    for c in manifest.components.iter_mut() {
+        if let Some(orig_origin) = manifest_origin(&c.download_url) {
+            if orig_origin != new_origin {
+                let path = c.download_url.trim_start_matches(&orig_origin).to_string();
+                c.download_url = format!("{}{}", new_origin, path);
+            }
+        }
+    }
+}
+
+/// Which manifest URL to try FIRST — operator override via env wins,
+/// otherwise the first entry in the mirrors list, otherwise the hard
+/// default. Callers that need the full mirror walk should use
+/// `load_mirrors` directly.
 fn update_manifest_url() -> String {
     std::env::var("ARCHIPELAGO_UPDATE_URL")
         .unwrap_or_else(|_| DEFAULT_UPDATE_MANIFEST_URL.to_string())
@@ -107,6 +218,11 @@ pub struct UpdateState {
     pub rollback_available: bool,
     #[serde(default)]
     pub schedule: UpdateSchedule,
+    /// URL of the mirror whose manifest populated `available_update`.
+    /// Surfaces in the UI so operators can tell at a glance which mirror
+    /// their node actually hit (vs. just which is configured primary).
+    #[serde(default)]
+    pub manifest_mirror: Option<String>,
 }
 
 impl Default for UpdateState {
@@ -118,6 +234,7 @@ impl Default for UpdateState {
             update_in_progress: false,
             rollback_available: false,
             schedule: UpdateSchedule::DailyCheck,
+            manifest_mirror: None,
         }
     }
 }
@@ -149,6 +266,7 @@ pub async fn load_state(data_dir: &Path) -> Result<UpdateState> {
         // it unconditionally; the next check_for_updates will repopulate
         // if there's genuinely something newer.
         state.available_update = None;
+        state.manifest_mirror = None;
         save_state(data_dir, &state).await?;
     }
     Ok(state)
@@ -160,71 +278,104 @@ pub async fn save_state(data_dir: &Path, state: &UpdateState) -> Result<()> {
     fs::write(&path, data).await.context("Writing update state")
 }
 
-/// Check for available updates by fetching the release manifest.
+/// Check for available updates by walking the mirror list. The first
+/// mirror that returns a parseable manifest with a strictly-newer
+/// version wins; if no mirror offers a newer version, the node is
+/// reported as up-to-date. Per-mirror we retry up to 3 times on
+/// transient failures.
+///
+/// Manifest `download_url`s are origin-rewritten to match the mirror
+/// we fetched from, so switching mirrors in the UI also switches where
+/// component downloads come from — even if the publisher baked an
+/// absolute URL pointing at a different server into the manifest.
 pub async fn check_for_updates(data_dir: &Path) -> Result<UpdateState> {
     let mut state = load_state(data_dir).await?;
 
     info!("Checking for updates...");
-    // 45s total budget, and we retry up to 3 times so a momentary
-    // gitea hiccup doesn't make the node report "up to date" when an
-    // update actually exists. Short per-attempt timeout keeps the RPC
-    // responsive in the common case.
     let client = reqwest::Client::builder()
+        // Short per-attempt HTTP timeout so a wedged mirror doesn't
+        // delay the whole check — we'd rather move on to the next
+        // mirror quickly than sit waiting on a slow one. 15s covers
+        // slow but alive mirrors.
         .timeout(std::time::Duration::from_secs(15))
         .connect_timeout(std::time::Duration::from_secs(10))
         .build()
         .context("Failed to create HTTP client")?;
 
-    let manifest_url = update_manifest_url();
+    // Env override (ARCHIPELAGO_UPDATE_URL) short-circuits the mirror
+    // list — used on dev boxes that point at a local gitea. Otherwise
+    // walk the operator-configured list and fall through on failure.
+    let mirrors: Vec<String> = if std::env::var("ARCHIPELAGO_UPDATE_URL").is_ok() {
+        vec![update_manifest_url()]
+    } else {
+        load_mirrors(data_dir)
+            .await
+            .unwrap_or_else(|_| default_mirrors())
+            .into_iter()
+            .map(|m| m.url)
+            .collect()
+    };
+
     let mut last_err: Option<String> = None;
     let mut handled = false;
-    for attempt in 1..=3u8 {
-        if attempt > 1 {
-            tokio::time::sleep(std::time::Duration::from_secs(5)).await;
-        }
-        match client.get(&manifest_url).send().await {
-            Ok(resp) if resp.status().is_success() => {
-                match resp.json::<UpdateManifest>().await {
-                    Ok(manifest) => {
+    'mirrors: for manifest_url in mirrors.iter() {
+        for attempt in 1..=3u8 {
+            if attempt > 1 {
+                tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+            }
+            match client.get(manifest_url).send().await {
+                Ok(resp) if resp.status().is_success() => match resp.json::<UpdateManifest>().await {
+                    Ok(mut manifest) => {
+                        rewrite_manifest_origins(&mut manifest, manifest_url);
                         if is_newer(&manifest.version, &state.current_version) {
                             info!(
                                 current = %state.current_version,
                                 available = %manifest.version,
+                                mirror = %manifest_url,
                                 "Update available"
                             );
                             state.available_update = Some(manifest);
+                            state.manifest_mirror = Some(manifest_url.clone());
                         } else {
                             // Manifest version matches us or is behind
-                            // us — either we're current, or the remote
-                            // manifest is stale. Either way don't offer
-                            // it as an "update" (that would be a
-                            // downgrade prompt).
+                            // us — either we're current, or this mirror
+                            // is stale. Try the next mirror; if all are
+                            // stale or at our version we'll fall through
+                            // to "up to date".
                             debug!(
                                 current = %state.current_version,
                                 manifest = %manifest.version,
+                                mirror = %manifest_url,
                                 "No newer version in manifest"
                             );
+                            if state.available_update.is_some() {
+                                // A later mirror might still have a
+                                // newer version — don't clobber what an
+                                // earlier mirror told us. But also don't
+                                // break: another mirror could be ahead.
+                                continue 'mirrors;
+                            }
+                            state.manifest_mirror = None;
                             state.available_update = None;
                         }
                         handled = true;
-                        break;
-                    }
-                    Err(e) => {
-                        last_err = Some(format!("parse: {}", e));
+                        break 'mirrors;
                     }
+                    Err(e) => last_err = Some(format!("{}: parse: {}", manifest_url, e)),
+                },
+                Ok(resp) => {
+                    last_err = Some(format!("{}: HTTP {}", manifest_url, resp.status()));
+                }
+                Err(e) => {
+                    last_err = Some(format!("{}: {}", manifest_url, e));
                 }
             }
-            Ok(resp) => {
-                last_err = Some(format!("HTTP {}", resp.status()));
-            }
-            Err(e) => {
-                last_err = Some(e.to_string());
-            }
         }
+        tracing::debug!(mirror = %manifest_url, "Mirror exhausted, trying next");
     }
     if !handled {
         if let Some(e) = last_err {
-            debug!("Update check failed after retries: {}", e);
+            debug!("Update check failed across all mirrors: {}", e);
         }
     }
 
@@ -233,6 +384,66 @@ pub async fn check_for_updates(data_dir: &Path) -> Result<UpdateState> {
     Ok(state)
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct MirrorTestResult {
+    pub reachable: bool,
+    pub latency_ms: u64,
+    pub http_status: Option<u16>,
+    pub error: Option<String>,
+}
+
+/// Ping a mirror's manifest URL and return reachability + wall-clock
+/// latency. Used by the "Test mirror" button so operators can sanity-
+/// check a newly added mirror without running a full update check.
+pub async fn test_mirror(url: &str) -> MirrorTestResult {
+    let client = match reqwest::Client::builder()
+        .timeout(std::time::Duration::from_secs(10))
+        .connect_timeout(std::time::Duration::from_secs(5))
+        .build()
+    {
+        Ok(c) => c,
+        Err(e) => {
+            return MirrorTestResult {
+                reachable: false,
+                latency_ms: 0,
+                http_status: None,
+                error: Some(format!("client build failed: {}", e)),
+            }
+        }
+    };
+    let start = std::time::Instant::now();
+    match client.get(url).send().await {
+        Ok(resp) => {
+            let latency_ms = start.elapsed().as_millis() as u64;
+            let status = resp.status();
+            if status.is_success() {
+                MirrorTestResult {
+                    reachable: true,
+                    latency_ms,
+                    http_status: Some(status.as_u16()),
+                    error: None,
+                }
+            } else {
+                MirrorTestResult {
+                    reachable: false,
+                    latency_ms,
+                    http_status: Some(status.as_u16()),
+                    error: Some(format!("HTTP {}", status.as_u16())),
+                }
+            }
+        }
+        Err(e) => {
+            let latency_ms = start.elapsed().as_millis() as u64;
+            MirrorTestResult {
+                reachable: false,
+                latency_ms,
+                http_status: None,
+                error: Some(e.to_string()),
+            }
+        }
+    }
+}
+
 /// Get current update status without checking remote.
 pub async fn get_status(data_dir: &Path) -> Result<UpdateState> {
     load_state(data_dir).await
@@ -914,6 +1125,85 @@ mod tests {
         assert_eq!(schedule, UpdateSchedule::DailyCheck);
     }
 
+    #[test]
+    fn test_manifest_origin_parses_https() {
+        assert_eq!(
+            manifest_origin("https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/manifest.json"),
+            Some("https://git.tx1138.com".to_string())
+        );
+    }
+
+    #[test]
+    fn test_manifest_origin_parses_http_with_port() {
+        assert_eq!(
+            manifest_origin("http://23.182.128.160:3000/lfg2025/archy/raw/branch/main/releases/manifest.json"),
+            Some("http://23.182.128.160:3000".to_string())
+        );
+    }
+
+    #[test]
+    fn test_manifest_origin_rejects_garbage() {
+        assert_eq!(manifest_origin("not a url"), None);
+        assert_eq!(manifest_origin("ftp://git.tx1138.com/x"), None);
+    }
+
+    #[test]
+    fn test_rewrite_manifest_origins_swaps_all_components() {
+        let mut manifest = UpdateManifest {
+            version: "1.7.26-alpha".into(),
+            release_date: "2026-04-21".into(),
+            changelog: vec![],
+            components: vec![
+                ComponentUpdate {
+                    name: "archipelago".into(),
+                    current_version: "1.7.25-alpha".into(),
+                    new_version: "1.7.26-alpha".into(),
+                    download_url: "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/v1.7.26-alpha/archipelago".into(),
+                    sha256: "x".into(),
+                    size_bytes: 1,
+                },
+                ComponentUpdate {
+                    name: "frontend".into(),
+                    current_version: "1.7.25-alpha".into(),
+                    new_version: "1.7.26-alpha".into(),
+                    download_url: "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/v1.7.26-alpha/frontend.tar.gz".into(),
+                    sha256: "y".into(),
+                    size_bytes: 2,
+                },
+            ],
+        };
+        rewrite_manifest_origins(&mut manifest, "http://23.182.128.160:3000/lfg2025/archy/raw/branch/main/releases/manifest.json");
+        assert_eq!(
+            manifest.components[0].download_url,
+            "http://23.182.128.160:3000/lfg2025/archy/raw/branch/main/releases/v1.7.26-alpha/archipelago"
+        );
+        assert_eq!(
+            manifest.components[1].download_url,
+            "http://23.182.128.160:3000/lfg2025/archy/raw/branch/main/releases/v1.7.26-alpha/frontend.tar.gz"
+        );
+    }
+
+    #[tokio::test]
+    async fn test_load_mirrors_returns_defaults_when_absent() {
+        let dir = tempfile::tempdir().unwrap();
+        let list = load_mirrors(dir.path()).await.unwrap();
+        assert_eq!(list.len(), 2);
+        assert!(list[0].url.contains("git.tx1138.com"));
+        assert!(list[1].url.contains("23.182.128.160"));
+    }
+
+    #[tokio::test]
+    async fn test_save_and_load_mirrors_roundtrip() {
+        let dir = tempfile::tempdir().unwrap();
+        let list = vec![UpdateMirror {
+            url: "https://example.com/m.json".into(),
+            label: "Example".into(),
+        }];
+        save_mirrors(dir.path(), &list).await.unwrap();
+        let back = load_mirrors(dir.path()).await.unwrap();
+        assert_eq!(back, list);
+    }
+
     #[test]
     fn test_update_state_default_values() {
         let state = UpdateState::default();
@@ -934,6 +1224,7 @@ mod tests {
             update_in_progress: false,
             rollback_available: true,
             schedule: UpdateSchedule::AutoApply,
+            manifest_mirror: None,
         };
         let json = serde_json::to_string(&state).unwrap();
         let deserialized: UpdateState = serde_json::from_str(&json).unwrap();
@@ -1044,6 +1335,10 @@ mod tests {
             update_in_progress: true,
             rollback_available: false,
             schedule: UpdateSchedule::Manual,
+            manifest_mirror: Some(
+                "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/manifest.json"
+                    .to_string(),
+            ),
         };
         save_state(dir.path(), &state).await.unwrap();
         let loaded = load_state(dir.path()).await.unwrap();

neode-ui/src/components/Screensaver.vue

@@ -13,15 +13,7 @@
         </div>
         <!-- Normal logo with audio viz ring -->
         <div v-else class="screensaver-content">
-          <!-- Radial audio visualization - bars around the logo -->
-          <div class="screensaver-viz-ring">
-            <div
-              v-for="(_, i) in segmentCount"
-              :key="i"
-              class="screensaver-viz-segment"
-              :style="getSegmentStyle(i)"
-            />
-          </div>
+          <ScreensaverRing />
           <!-- Logo in center -->
           <div class="screensaver-logo-wrapper">
             <ScreensaverLogo />
@@ -35,21 +27,12 @@
 <script setup lang="ts">
 import { onMounted, onBeforeUnmount } from 'vue'
 import ScreensaverLogo from '@/components/ScreensaverLogo.vue'
+import ScreensaverRing from '@/components/ScreensaverRing.vue'
 import BitcoinFaceAscii from '@/views/discover/BitcoinFaceAscii.vue'
 import { useScreensaverStore } from '@/stores/screensaver'
 
 const store = useScreensaverStore()
 
-const segmentCount = 48
-
-function getSegmentStyle(i: number) {
-  const deg = (i / segmentCount) * 360
-  return {
-    '--segment-index': i,
-    '--segment-deg': `${deg}deg`,
-  }
-}
-
 // Dismiss on any key (except when typing)
 function onKeyDown(e: KeyboardEvent) {
   if (store.isActive) {
@@ -86,102 +69,15 @@ onBeforeUnmount(() => {
 
 .screensaver-content {
   position: relative;
-  width: 280px;
-  height: 280px;
-  flex-shrink: 0;
-}
-
-@media (min-width: 640px) {
-  .screensaver-content {
-    width: 360px;
-    height: 360px;
-  }
-}
-
-@media (min-width: 768px) {
-  .screensaver-content {
-    width: 400px;
-    height: 400px;
-  }
-}
-
-/* Ring of segments around the logo - audio viz style (behind logo) */
-.screensaver-viz-ring {
-  position: absolute;
-  inset: 0;
-  width: 100%;
-  height: 100%;
-  z-index: 0;
-  pointer-events: none;
-  --viz-radius: 140px;
-}
-
-@media (min-width: 640px) {
-  .screensaver-viz-ring {
-    --viz-radius: 180px;
-  }
-}
-
-@media (min-width: 768px) {
-  .screensaver-viz-ring {
-    --viz-radius: 200px;
-  }
-}
-
-.screensaver-viz-segment {
-  position: absolute;
-  left: 50%;
-  top: 50%;
-  width: 4px;
-  height: 24px;
-  margin-left: -2px;
-  margin-top: -12px;
-  background: linear-gradient(to bottom, rgba(255, 255, 255, 0.4), rgba(255, 255, 255, 0.1));
-  border-radius: 2px;
-  /* Origin at segment center = ring center (segment is centered via left/top 50%) */
-  transform-origin: center center;
-  transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius)));
-  animation: segment-pulse 14s ease-in-out infinite;
-  animation-delay: calc(var(--segment-index) * 0.02s);
-}
-
-@media (min-width: 768px) {
-  .screensaver-viz-segment {
-    height: 28px;
-    margin-top: -14px;
-  }
-}
-
-/* 5 normal loops (10s) then stronger longer expression (4s) - total 14s */
-@keyframes segment-pulse {
-  /* Loop 1 */
-  0% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
-  7.1% { opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
-  14.3% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
-  /* Loop 2 */
-  21.4% { opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
-  28.6% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
-  /* Loop 3 */
-  35.7% { opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
-  42.9% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
-  /* Loop 4 */
-  50% { opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
-  57.1% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
-  /* Loop 5 */
-  64.3% { opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
-  71.4% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
-  /* Strong expression: ramp up (1.5s), hold (2s), ease back (0.5s) */
-  78.6% { opacity: 1; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1.5); }
-  85.7% { opacity: 1; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1.5); }
-  92.9% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
-  100% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  display: grid;
+  place-items: center;
 }
 
 .screensaver-logo-wrapper {
   position: absolute;
-  left: 50%;
-  top: 50%;
-  transform: translate(-50%, -50%);
+  inset: 0;
+  display: grid;
+  place-items: center;
   z-index: 10;
   filter: drop-shadow(0 0 40px rgba(255, 255, 255, 0.15));
 }

neode-ui/src/components/ScreensaverRing.vue

@@ -0,0 +1,114 @@
+<template>
+  <div class="viz-ring" :class="sizeClass">
+    <div
+      v-for="(_, i) in segmentCount"
+      :key="i"
+      class="viz-segment"
+      :style="getSegmentStyle(i)"
+    />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed } from 'vue'
+
+const props = withDefaults(defineProps<{
+  /** Visual size: 'default' matches the screensaver; 'compact' drops the
+   *  min-width breakpoints (useful inside overlays on narrower canvases). */
+  size?: 'default' | 'compact'
+  /** Override segment count. Defaults to 48 (screensaver standard). */
+  segmentCount?: number
+}>(), { size: 'default', segmentCount: 48 })
+
+const sizeClass = computed(() => props.size === 'compact' ? 'viz-ring-compact' : 'viz-ring-default')
+
+function getSegmentStyle(i: number) {
+  const deg = (i / props.segmentCount) * 360
+  return {
+    '--segment-index': i,
+    '--segment-deg': `${deg}deg`,
+  }
+}
+</script>
+
+<style scoped>
+.viz-ring {
+  position: relative;
+  pointer-events: none;
+}
+
+.viz-ring-default {
+  width: 280px;
+  height: 280px;
+  --viz-radius: 140px;
+}
+@media (min-width: 640px) {
+  .viz-ring-default {
+    width: 360px;
+    height: 360px;
+    --viz-radius: 180px;
+  }
+}
+@media (min-width: 768px) {
+  .viz-ring-default {
+    width: 400px;
+    height: 400px;
+    --viz-radius: 200px;
+  }
+}
+
+.viz-ring-compact {
+  width: 240px;
+  height: 240px;
+  --viz-radius: 120px;
+}
+@media (min-width: 768px) {
+  .viz-ring-compact {
+    width: 320px;
+    height: 320px;
+    --viz-radius: 160px;
+  }
+}
+
+.viz-segment {
+  position: absolute;
+  left: 50%;
+  top: 50%;
+  width: 4px;
+  height: 24px;
+  margin-left: -2px;
+  margin-top: -12px;
+  background: linear-gradient(to bottom, rgba(255, 255, 255, 0.4), rgba(255, 255, 255, 0.1));
+  border-radius: 2px;
+  transform-origin: center center;
+  transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius)));
+  animation: segment-pulse 14s ease-in-out infinite;
+  animation-delay: calc(var(--segment-index) * 0.02s);
+}
+
+@media (min-width: 768px) {
+  .viz-segment {
+    height: 28px;
+    margin-top: -14px;
+  }
+}
+
+/* 5 normal loops (10s) then stronger longer expression (4s) — total 14s */
+@keyframes segment-pulse {
+  0%   { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  7.1% { opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
+  14.3%{ opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  21.4%{ opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
+  28.6%{ opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  35.7%{ opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
+  42.9%{ opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  50%  { opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
+  57.1%{ opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  64.3%{ opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
+  71.4%{ opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  78.6%{ opacity: 1;   transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1.5); }
+  85.7%{ opacity: 1;   transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1.5); }
+  92.9%{ opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  100% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+}
+</style>

neode-ui/src/router/index.ts

@@ -193,6 +193,11 @@ const router = createRouter({
           name: 'system-update',
           component: () => import('../views/SystemUpdate.vue'),
         },
+        {
+          path: 'settings/registries',
+          name: 'app-registries',
+          component: () => import('../views/AppRegistries.vue'),
+        },
         {
           path: 'goals/:goalId',
           name: 'goal-detail',

neode-ui/src/views/AppRegistries.vue

@@ -0,0 +1,330 @@
+<template>
+  <div class="pb-6">
+    <div class="mb-6">
+      <h1 class="text-3xl font-bold text-white mb-2">App registries</h1>
+      <p class="text-white/70">
+        Container registries this node pulls app images from. The primary is tried first; if it's
+        slow or unreachable, the next one in the list is tried automatically.
+      </p>
+    </div>
+
+    <!-- Status message -->
+    <div
+      v-if="statusMessage"
+      class="mb-4 p-3 rounded-lg text-sm"
+      :class="statusIsError ? 'bg-red-500/20 text-red-300' : 'bg-green-500/20 text-green-300'"
+    >
+      {{ statusMessage }}
+    </div>
+
+    <!-- Registry list -->
+    <div class="glass-card p-6 mb-6">
+      <div class="flex items-start justify-between gap-4 mb-2">
+        <h2 class="text-lg font-semibold text-white">Registries</h2>
+        <button
+          type="button"
+          class="text-xs px-3 py-1.5 rounded-md bg-white/5 hover:bg-white/10 text-white/70 hover:text-white transition-colors"
+          @click="openAddRegistry"
+        >+ Add registry</button>
+      </div>
+      <p class="text-sm text-white/60 mb-4">
+        Registries are tried in priority order on every app install. Changing the primary takes
+        effect on the next install — existing containers keep running on whatever image they
+        already pulled.
+      </p>
+      <ul v-if="registries.length" class="space-y-2">
+        <li
+          v-for="r in sortedRegistries"
+          :key="r.url"
+          class="p-3 bg-white/5 rounded-lg"
+        >
+          <div class="flex items-start gap-3">
+            <div class="flex-1 min-w-0">
+              <div class="flex items-center gap-2 mb-0.5 flex-wrap">
+                <p class="text-sm font-medium text-white truncate">{{ r.name || r.url }}</p>
+                <span
+                  v-if="r.priority === 0"
+                  class="text-[10px] font-mono px-2 py-0.5 rounded bg-green-500/20 text-green-300"
+                >PRIMARY</span>
+                <span
+                  v-if="!r.tls_verify"
+                  class="text-[10px] font-mono px-2 py-0.5 rounded bg-amber-500/20 text-amber-300"
+                  title="TLS verification disabled — HTTP or self-signed registry"
+                >HTTP</span>
+              </div>
+              <p class="text-xs text-white/50 font-mono break-all">{{ r.url }}</p>
+            </div>
+            <div class="shrink-0 flex items-center gap-1">
+              <button
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-white hover:bg-white/10 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+                :disabled="registryTests[r.url]?.testing"
+                title="Test reachability"
+                @click="testRegistry(r)"
+              >
+                <svg v-if="registryTests[r.url]?.testing" class="w-4 h-4 animate-spin" fill="none" viewBox="0 0 24 24">
+                  <circle cx="12" cy="12" r="10" stroke="currentColor" stroke-width="3" stroke-opacity="0.25"></circle>
+                  <path fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"></path>
+                </svg>
+                <svg v-else class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z" />
+                </svg>
+              </button>
+              <button
+                v-if="r.priority !== 0"
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-yellow-300 hover:bg-white/10 transition-colors"
+                title="Make primary"
+                @click="setPrimary(r.url)"
+              >
+                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11.049 2.927c.3-.921 1.603-.921 1.902 0l1.519 4.674a1 1 0 00.95.69h4.915c.969 0 1.371 1.24.588 1.81l-3.976 2.888a1 1 0 00-.363 1.118l1.518 4.674c.3.922-.755 1.688-1.538 1.118l-3.976-2.888a1 1 0 00-1.176 0l-3.976 2.888c-.783.57-1.838-.197-1.538-1.118l1.518-4.674a1 1 0 00-.363-1.118l-3.976-2.888c-.784-.57-.38-1.81.588-1.81h4.914a1 1 0 00.951-.69l1.519-4.674z" />
+                </svg>
+              </button>
+              <button
+                v-if="registries.length > 1"
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-red-300 hover:bg-red-400/10 transition-colors"
+                title="Remove registry"
+                @click="removeRegistry(r.url)"
+              >
+                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" />
+                </svg>
+              </button>
+            </div>
+          </div>
+          <div
+            v-if="registryTests[r.url] && !registryTests[r.url]?.testing"
+            class="mt-2 pt-2 border-t border-white/5 text-xs"
+          >
+            <span v-if="registryTests[r.url]?.reachable" class="inline-flex items-center gap-1.5 text-green-300">
+              <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="3" d="M5 13l4 4L19 7" />
+              </svg>
+              Reachable (HTTP {{ registryTests[r.url]?.status }})
+            </span>
+            <span v-else class="inline-flex items-center gap-1.5 text-red-300">
+              <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="3" d="M6 18L18 6M6 6l12 12" />
+              </svg>
+              <span class="truncate">{{ registryTests[r.url]?.error || 'Unreachable' }}</span>
+            </span>
+          </div>
+        </li>
+      </ul>
+    </div>
+
+    <!-- Back link -->
+    <RouterLink
+      to="/dashboard/settings"
+      class="glass-button rounded-lg px-5 py-2 text-sm font-medium inline-flex items-center gap-2"
+    >
+      <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 19l-7-7 7-7" />
+      </svg>
+      Back to Settings
+    </RouterLink>
+
+    <!-- Add-registry modal -->
+    <Teleport to="body">
+      <Transition name="fade">
+        <div
+          v-if="addingRegistry"
+          class="fixed inset-0 z-50 flex items-center justify-center bg-black/10 backdrop-blur-md"
+          @click.self="cancelAddRegistry"
+        >
+          <div class="glass-card p-6 max-w-md w-full mx-4">
+            <h3 class="text-lg font-semibold text-white mb-1">Add app registry</h3>
+            <p class="text-sm text-white/60 mb-5">
+              The URL should be of the form <span class="font-mono text-white/80">host[:port]/namespace</span>
+              — for example <span class="font-mono text-white/80">ghcr.io/myorg</span> or
+              <span class="font-mono text-white/80">192.168.1.50:3000/apps</span>. Registries are
+              added to the end of the list; use "Make primary" to reorder.
+            </p>
+            <form class="space-y-3" @submit.prevent="submitRegistry">
+              <div>
+                <label class="block text-xs text-white/60 mb-1">Name</label>
+                <input
+                  v-model="registryDraft.name"
+                  type="text"
+                  placeholder="My private registry"
+                  class="w-full px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none"
+                />
+              </div>
+              <div>
+                <label class="block text-xs text-white/60 mb-1">Registry URL</label>
+                <input
+                  v-model="registryDraft.url"
+                  type="text"
+                  autofocus
+                  placeholder="host:port/namespace"
+                  class="w-full px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none font-mono"
+                />
+              </div>
+              <label class="flex items-center gap-2 cursor-pointer text-sm text-white/80">
+                <input
+                  v-model="registryDraft.tls_verify"
+                  type="checkbox"
+                  class="accent-orange-400"
+                />
+                Verify TLS certificate (uncheck for HTTP or self-signed)
+              </label>
+              <div class="flex gap-3 justify-end pt-2">
+                <button
+                  type="button"
+                  @click="cancelAddRegistry"
+                  class="glass-button rounded-lg px-4 py-2 text-sm font-medium"
+                >Cancel</button>
+                <button
+                  type="submit"
+                  class="glass-button rounded-lg px-4 py-2 text-sm font-medium bg-orange-500/20 border-orange-400/30 disabled:opacity-50 disabled:cursor-not-allowed"
+                  :disabled="registrySaving || !registryDraft.url.trim()"
+                >{{ registrySaving ? 'Adding…' : 'Add registry' }}</button>
+              </div>
+            </form>
+          </div>
+        </div>
+      </Transition>
+    </Teleport>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, computed, onMounted, reactive } from 'vue'
+import { RouterLink } from 'vue-router'
+import { rpcClient } from '@/api/rpc-client'
+
+interface Registry {
+  url: string
+  name: string
+  tls_verify: boolean
+  enabled: boolean
+  priority: number
+}
+
+interface RegistryTestState {
+  testing?: boolean
+  reachable?: boolean
+  status?: number | null
+  error?: string | null
+}
+
+const registries = ref<Registry[]>([])
+const sortedRegistries = computed(() =>
+  [...registries.value].sort((a, b) => a.priority - b.priority)
+)
+const registryTests = ref<Record<string, RegistryTestState>>({})
+const statusMessage = ref('')
+const statusIsError = ref(false)
+
+const addingRegistry = ref(false)
+const registrySaving = ref(false)
+const registryDraft = reactive({ url: '', name: '', tls_verify: true })
+
+function showStatus(msg: string, isError = false) {
+  statusMessage.value = msg
+  statusIsError.value = isError
+  setTimeout(() => { statusMessage.value = '' }, 8000)
+}
+
+async function loadRegistries() {
+  try {
+    const res = await rpcClient.call<{ registries: Registry[] }>({ method: 'registry.list' })
+    registries.value = res.registries
+  } catch (e) {
+    if (import.meta.env.DEV) console.warn('registry.list failed', e)
+  }
+}
+
+function openAddRegistry() {
+  registryDraft.url = ''
+  registryDraft.name = ''
+  registryDraft.tls_verify = true
+  addingRegistry.value = true
+}
+function cancelAddRegistry() {
+  addingRegistry.value = false
+}
+
+async function submitRegistry() {
+  const url = registryDraft.url.trim()
+  if (!url) return
+  registrySaving.value = true
+  try {
+    const res = await rpcClient.call<{ registries: Registry[] }>({
+      method: 'registry.add',
+      params: {
+        url,
+        name: registryDraft.name.trim() || url,
+        tls_verify: registryDraft.tls_verify,
+      },
+    })
+    registries.value = res.registries
+    addingRegistry.value = false
+    showStatus('Registry added.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Add registry failed: ${msg}`, true)
+  } finally {
+    registrySaving.value = false
+  }
+}
+
+async function removeRegistry(url: string) {
+  try {
+    const res = await rpcClient.call<{ registries: Registry[] }>({
+      method: 'registry.remove',
+      params: { url },
+    })
+    registries.value = res.registries
+    showStatus('Registry removed.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Remove failed: ${msg}`, true)
+  }
+}
+
+async function setPrimary(url: string) {
+  try {
+    const res = await rpcClient.call<{ registries: Registry[] }>({
+      method: 'registry.set-primary',
+      params: { url },
+    })
+    registries.value = res.registries
+    showStatus('Primary registry updated. Next install will try it first.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Set primary failed: ${msg}`, true)
+  }
+}
+
+async function testRegistry(r: Registry) {
+  registryTests.value = { ...registryTests.value, [r.url]: { testing: true } }
+  try {
+    const res = await rpcClient.call<{
+      url: string
+      reachable: boolean
+      status: number | null
+      error?: string | null
+    }>({ method: 'registry.test', params: { url: r.url, tls_verify: r.tls_verify } })
+    registryTests.value = {
+      ...registryTests.value,
+      [r.url]: {
+        testing: false,
+        reachable: res.reachable,
+        status: res.status,
+        error: res.error ?? null,
+      },
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    registryTests.value = {
+      ...registryTests.value,
+      [r.url]: { testing: false, reachable: false, error: msg },
+    }
+  }
+}
+
+onMounted(() => { void loadRegistries() })
+</script>

neode-ui/src/views/SystemUpdate.vue

@@ -42,6 +42,12 @@
         <div>
           <h2 class="text-lg font-semibold text-white">{{ t('systemUpdate.updateAvailable') }}</h2>
           <p class="text-sm text-white/60">Version {{ updateInfo.version }} &mdash; {{ updateInfo.release_date }}</p>
+          <p v-if="manifestMirrorLabel" class="text-xs text-white/40 mt-1 flex items-center gap-1.5">
+            <svg class="w-3 h-3 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 12h14M12 5l7 7-7 7" />
+            </svg>
+            <span>Served by <span class="text-white/70">{{ manifestMirrorLabel }}</span></span>
+          </p>
         </div>
         <span class="px-3 py-1 bg-orange-500/20 text-orange-400 text-xs font-medium rounded-full">{{ t('systemUpdate.new') }}</span>
       </div>
@@ -172,6 +178,87 @@
       </div>
     </div>
 
+    <!-- Mirrors -->
+    <div class="glass-card p-6 mb-6">
+      <div class="flex items-start justify-between gap-4 mb-2">
+        <h2 class="text-lg font-semibold text-white">Update mirrors</h2>
+        <button
+          type="button"
+          class="text-xs px-3 py-1.5 rounded-md bg-white/5 hover:bg-white/10 text-white/70 hover:text-white transition-colors"
+          @click="openAddMirror"
+        >+ Add mirror</button>
+      </div>
+      <p class="text-sm text-white/60 mb-4">
+        Servers this node checks for updates. The primary is tried first; if it's slow or unreachable, the next one in the list is tried automatically. Downloads always come from the mirror that served the manifest — switching primary switches where files come from.
+      </p>
+      <ul v-if="mirrors.length" class="space-y-2">
+        <li v-for="(m, i) in mirrors" :key="m.url" class="p-3 bg-white/5 rounded-lg">
+          <div class="flex items-start gap-3">
+            <div class="flex-1 min-w-0">
+              <div class="flex items-center gap-2 mb-0.5 flex-wrap">
+                <p class="text-sm font-medium text-white truncate">{{ m.label || `Mirror ${i + 1}` }}</p>
+                <span v-if="i === 0" class="text-[10px] font-mono px-2 py-0.5 rounded bg-green-500/20 text-green-300">PRIMARY</span>
+              </div>
+              <p class="text-xs text-white/50 font-mono break-all">{{ m.url }}</p>
+            </div>
+            <div class="shrink-0 flex items-center gap-1">
+              <button
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-white hover:bg-white/10 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+                :disabled="mirrorTests[m.url]?.testing"
+                title="Test reachability"
+                @click="testMirror(m.url)"
+              >
+                <svg v-if="mirrorTests[m.url]?.testing" class="w-4 h-4 animate-spin" fill="none" viewBox="0 0 24 24">
+                  <circle cx="12" cy="12" r="10" stroke="currentColor" stroke-width="3" stroke-opacity="0.25"></circle>
+                  <path fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"></path>
+                </svg>
+                <svg v-else class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z" />
+                </svg>
+              </button>
+              <button
+                v-if="i !== 0"
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-yellow-300 hover:bg-white/10 transition-colors"
+                title="Make primary"
+                @click="setPrimaryMirror(m.url)"
+              >
+                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11.049 2.927c.3-.921 1.603-.921 1.902 0l1.519 4.674a1 1 0 00.95.69h4.915c.969 0 1.371 1.24.588 1.81l-3.976 2.888a1 1 0 00-.363 1.118l1.518 4.674c.3.922-.755 1.688-1.538 1.118l-3.976-2.888a1 1 0 00-1.176 0l-3.976 2.888c-.783.57-1.838-.197-1.538-1.118l1.518-4.674a1 1 0 00-.363-1.118l-3.976-2.888c-.784-.57-.38-1.81.588-1.81h4.914a1 1 0 00.951-.69l1.519-4.674z" />
+                </svg>
+              </button>
+              <button
+                v-if="mirrors.length > 1"
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-red-300 hover:bg-red-400/10 transition-colors"
+                title="Remove mirror"
+                @click="removeMirror(m.url)"
+              >
+                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" />
+                </svg>
+              </button>
+            </div>
+          </div>
+          <div v-if="mirrorTests[m.url] && !mirrorTests[m.url]?.testing" class="mt-2 pt-2 border-t border-white/5 text-xs">
+            <span v-if="mirrorTests[m.url]?.reachable" class="inline-flex items-center gap-1.5 text-green-300">
+              <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="3" d="M5 13l4 4L19 7" />
+              </svg>
+              Reachable &middot; {{ mirrorTests[m.url]?.latency_ms }}ms
+            </span>
+            <span v-else class="inline-flex items-center gap-1.5 text-red-300">
+              <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="3" d="M6 18L18 6M6 6l12 12" />
+              </svg>
+              <span class="truncate">{{ mirrorTests[m.url]?.error || 'Unreachable' }}</span>
+            </span>
+          </div>
+        </li>
+      </ul>
+    </div>
+
     <!-- Actions row -->
     <div class="glass-card p-6">
       <h2 class="text-lg font-semibold text-white mb-4">{{ t('systemUpdate.actions') }}</h2>
@@ -257,6 +344,51 @@
       </Transition>
     </Teleport>
 
+    <!-- Add-mirror modal -->
+    <Transition name="fade">
+      <div v-if="addingMirror" class="fixed inset-0 z-50 flex items-center justify-center bg-black/10 backdrop-blur-md" @click.self="cancelAddMirror">
+        <div class="glass-card p-6 max-w-md w-full mx-4">
+          <h3 class="text-lg font-semibold text-white mb-1">Add update mirror</h3>
+          <p class="text-sm text-white/60 mb-5">
+            The URL should point directly at a <span class="font-mono text-white/80">manifest.json</span> served by a Gitea mirror or equivalent. It's added to the end of the list; use "Make primary" to change order.
+          </p>
+          <form class="space-y-3" @submit.prevent="submitMirror">
+            <div>
+              <label class="block text-xs text-white/60 mb-1">Manifest URL</label>
+              <input
+                v-model="mirrorDraft.url"
+                type="text"
+                autofocus
+                placeholder="https://host/.../manifest.json"
+                class="w-full px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none font-mono"
+              />
+            </div>
+            <div>
+              <label class="block text-xs text-white/60 mb-1">Label (optional)</label>
+              <input
+                v-model="mirrorDraft.label"
+                type="text"
+                placeholder="Home VPS"
+                class="w-full px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none"
+              />
+            </div>
+            <div class="flex gap-3 justify-end pt-2">
+              <button
+                type="button"
+                @click="cancelAddMirror"
+                class="glass-button rounded-lg px-4 py-2 text-sm font-medium"
+              >{{ t('common.cancel') }}</button>
+              <button
+                type="submit"
+                class="glass-button rounded-lg px-4 py-2 text-sm font-medium bg-orange-500/20 border-orange-400/30 disabled:opacity-50 disabled:cursor-not-allowed"
+                :disabled="mirrorSaving || !mirrorDraft.url.trim()"
+              >{{ mirrorSaving ? 'Adding…' : 'Add mirror' }}</button>
+            </div>
+          </form>
+        </div>
+      </div>
+    </Transition>
+
     <!-- Confirmation modal -->
     <Transition name="fade">
       <div v-if="confirmAction" class="fixed inset-0 z-50 flex items-center justify-center bg-black/10 backdrop-blur-md" @click.self="cancelConfirm">
@@ -304,7 +436,7 @@
 </template>
 
 <script setup lang="ts">
-import { ref, computed, onMounted } from 'vue'
+import { ref, computed, onMounted, reactive } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { RouterLink } from 'vue-router'
 import { rpcClient } from '@/api/rpc-client'
@@ -346,6 +478,133 @@ const statusIsError = ref(false)
 const downloadPercent = ref(0)
 const downloadPercentFormatted = computed(() => downloadPercent.value.toFixed(2))
 
+// Mirrors — servers this node tries for the manifest, in priority
+// order. First entry is the primary. Add/remove/set-primary are wired
+// to update.*-mirror RPCs; downloads automatically go to the mirror
+// that served the manifest.
+interface UpdateMirror { url: string; label: string }
+const mirrors = ref<UpdateMirror[]>([])
+const addingMirror = ref(false)
+const mirrorSaving = ref(false)
+const mirrorDraft = reactive({ url: '', label: '' })
+
+// URL of the mirror that served the currently-available-update manifest.
+// Backend reports it in update.status and update.check responses; the UI
+// resolves it to a friendly label by matching against the mirrors list.
+const manifestMirror = ref<string | null>(null)
+const manifestMirrorLabel = computed(() => {
+  const url = manifestMirror.value
+  if (!url) return null
+  const match = mirrors.value.find(m => m.url === url)
+  if (match && match.label) return match.label
+  try {
+    const u = new URL(url)
+    return u.host
+  } catch {
+    return url
+  }
+})
+
+// Per-mirror test state. Populated by testMirror(); each entry is either
+// { testing: true } while in flight or the backend response shape on
+// completion. Rendered inline under each mirror row.
+interface MirrorTestState {
+  testing?: boolean
+  reachable?: boolean
+  latency_ms?: number
+  http_status?: number | null
+  error?: string | null
+}
+const mirrorTests = ref<Record<string, MirrorTestState>>({})
+
+async function testMirror(url: string) {
+  mirrorTests.value = { ...mirrorTests.value, [url]: { testing: true } }
+  try {
+    const res = await rpcClient.call<{
+      reachable: boolean
+      latency_ms: number
+      http_status: number | null
+      error: string | null
+    }>({ method: 'update.test-mirror', params: { url } })
+    mirrorTests.value = { ...mirrorTests.value, [url]: { ...res, testing: false } }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    mirrorTests.value = { ...mirrorTests.value, [url]: { testing: false, reachable: false, error: msg } }
+  }
+}
+
+function openAddMirror() {
+  mirrorDraft.url = ''
+  mirrorDraft.label = ''
+  addingMirror.value = true
+}
+function cancelAddMirror() {
+  addingMirror.value = false
+}
+
+async function loadMirrors() {
+  try {
+    const res = await rpcClient.call<{ mirrors: UpdateMirror[] }>({ method: 'update.list-mirrors' })
+    mirrors.value = res.mirrors
+  } catch (e) {
+    if (import.meta.env.DEV) console.warn('update.list-mirrors failed', e)
+  }
+}
+
+async function submitMirror() {
+  const url = mirrorDraft.url.trim()
+  if (!url) return
+  if (!url.startsWith('http://') && !url.startsWith('https://')) {
+    showStatus('Mirror URL must start with http:// or https://', true)
+    return
+  }
+  mirrorSaving.value = true
+  try {
+    const res = await rpcClient.call<{ mirrors: UpdateMirror[] }>({
+      method: 'update.add-mirror',
+      params: { url, label: mirrorDraft.label.trim() },
+    })
+    mirrors.value = res.mirrors
+    mirrorDraft.url = ''
+    mirrorDraft.label = ''
+    addingMirror.value = false
+    showStatus('Mirror added.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Add mirror failed: ${msg}`, true)
+  } finally {
+    mirrorSaving.value = false
+  }
+}
+
+async function removeMirror(url: string) {
+  try {
+    const res = await rpcClient.call<{ mirrors: UpdateMirror[] }>({
+      method: 'update.remove-mirror',
+      params: { url },
+    })
+    mirrors.value = res.mirrors
+    showStatus('Mirror removed.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Remove failed: ${msg}`, true)
+  }
+}
+
+async function setPrimaryMirror(url: string) {
+  try {
+    const res = await rpcClient.call<{ mirrors: UpdateMirror[] }>({
+      method: 'update.set-primary-mirror',
+      params: { url },
+    })
+    mirrors.value = res.mirrors
+    showStatus('Primary mirror updated. Next update check will try it first.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Set primary failed: ${msg}`, true)
+  }
+}
+
 // Poll the backend for the real bytes_downloaded / total_bytes so the
 // progress bar tracks actual download state (and survives route
 // changes). Returns true if a download is currently in progress.
@@ -488,11 +747,13 @@ async function loadStatus() {
       update_available: boolean
       update_in_progress: boolean
       rollback_available: boolean
+      manifest_mirror: string | null
     }>({ method: 'update.status' })
     currentVersion.value = res.current_version
     lastCheck.value = res.last_check
     updateInProgress.value = res.update_in_progress
     rollbackAvailable.value = res.rollback_available
+    manifestMirror.value = res.manifest_mirror ?? null
 
     if (res.update_in_progress) {
       downloaded.value = true
@@ -512,11 +773,13 @@ async function checkForUpdates() {
       update_available: boolean
       update: UpdateDetail | null
       update_method?: string
+      manifest_mirror?: string | null
     }>({ method: 'update.check' })
     currentVersion.value = res.current_version
     lastCheck.value = res.last_check
     updateInfo.value = res.update
     updateMethod.value = res.update_method === 'git' ? 'git' : 'manifest'
+    manifestMirror.value = res.manifest_mirror ?? null
     if (!res.update_available) {
       showStatus(t('systemUpdate.upToDateMessage'))
     }
@@ -685,7 +948,7 @@ async function setSchedule(value: ScheduleValue) {
 }
 
 onMounted(async () => {
-  await Promise.all([loadStatus(), loadSchedule(), checkForUpdates()])
+  await Promise.all([loadStatus(), loadSchedule(), loadMirrors(), checkForUpdates()])
   // If a download was already running when the user navigated here
   // (or refreshed), pick up the progress bar where it is and keep
   // polling until the backend reports done. No RPC call to start the

neode-ui/src/views/server/FipsNetworkCard.vue

@@ -9,15 +9,53 @@
       <div class="flex-1">
         <div class="flex items-start justify-between gap-4 mb-2">
           <h2 class="text-xl font-semibold text-white">FIPS Mesh</h2>
-          <div class="flex items-center gap-2" :title="statusLabel">
-            <span class="w-2 h-2 rounded-full" :class="statusDotColor"></span>
-            <span class="text-sm font-medium" :class="statusTextColor">{{ statusLabel }}</span>
+          <div class="flex items-center gap-3">
+            <div class="flex items-center gap-2" :title="statusLabel">
+              <span class="w-2 h-2 rounded-full" :class="statusDotColor"></span>
+              <span class="text-sm font-medium" :class="statusTextColor">{{ statusLabel }}</span>
+            </div>
+            <button
+              type="button"
+              class="p-1.5 rounded-md text-white/50 hover:text-white hover:bg-white/10 transition-colors"
+              title="Seed anchors"
+              aria-label="Open FIPS seed anchors settings"
+              @click="showAnchorsModal = true"
+            >
+              <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10.325 4.317c.426-1.756 2.924-1.756 3.35 0a1.724 1.724 0 002.573 1.066c1.543-.94 3.31.826 2.37 2.37a1.724 1.724 0 001.065 2.572c1.756.426 1.756 2.924 0 3.35a1.724 1.724 0 00-1.066 2.573c.94 1.543-.826 3.31-2.37 2.37a1.724 1.724 0 00-2.572 1.065c-.426 1.756-2.924 1.756-3.35 0a1.724 1.724 0 00-2.573-1.066c-1.543.94-3.31-.826-2.37-2.37a1.724 1.724 0 00-1.065-2.572c-1.756-.426-1.756-2.924 0-3.35a1.724 1.724 0 001.066-2.573c-.94-1.543.826-3.31 2.37-2.37.996.608 2.296.07 2.572-1.065z" />
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z" />
+              </svg>
+            </button>
           </div>
         </div>
         <p class="text-white/70 text-sm mb-4">Fast Nostr-keyed mesh routing</p>
       </div>
     </div>
 
+    <!-- Seed anchors modal — operator-editable list of peers this node
+         dials to bootstrap the mesh. Tucked behind the gear so it
+         doesn't crowd the card but is still one click away. Close
+         button and layout mirror the What's New modal (and the rest
+         of the app) so it feels like a first-class modal. -->
+    <Teleport to="body">
+      <Transition name="fade">
+        <div
+          v-if="showAnchorsModal"
+          class="fixed inset-0 z-[3000] flex items-center justify-center p-4"
+          @click="showAnchorsModal = false"
+        >
+          <div class="absolute inset-0 bg-black/60 backdrop-blur-sm"></div>
+          <div
+            class="relative z-10 max-w-xl w-full"
+            style="max-height: 90vh; overflow-y: auto"
+            @click.stop
+          >
+            <FipsSeedAnchorsCard closable @close="showAnchorsModal = false" />
+          </div>
+        </div>
+      </Transition>
+    </Teleport>
+
     <div class="grid grid-cols-1 sm:grid-cols-2 gap-3 mb-3 shrink-0">
       <div class="p-3 bg-white/5 rounded-lg">
         <p class="text-xs text-white/60 mb-1">Daemon version</p>
@@ -50,7 +88,7 @@
       <div class="flex items-center justify-between gap-3 flex-wrap">
         <div class="flex items-center gap-2 text-xs">
           <span class="w-2 h-2 rounded-full" :class="status.anchor_connected ? 'bg-cyan-400' : 'bg-orange-400'"></span>
-          <span class="text-white/70">Anchor (fips.v0l.io):</span>
+          <span class="text-white/70">Anchor:</span>
           <span :class="status.anchor_connected ? 'text-cyan-300' : 'text-orange-300'">
             {{ status.anchor_connected ? 'connected' : 'not reached' }}
           </span>
@@ -68,7 +106,7 @@
         </button>
       </div>
       <p v-if="!status.anchor_connected" class="mt-2 text-[11px] text-white/40 leading-snug">
-        Without the anchor, DHT routing to unknown npubs can't bootstrap; federation and messaging fall back to Tor until it reconnects. Reconnect restarts the FIPS daemon, which usually clears a stale identity cache.
+        No known anchor is currently an authenticated peer. DHT routing to unknown npubs can't bootstrap; federation and messaging fall back to Tor until one reconnects. Reconnect restarts the FIPS daemon, which usually clears a stale identity cache. Add a cluster-local anchor in Seed Anchors if the public one is unreachable.
       </p>
     </div>
 
@@ -84,6 +122,7 @@
 import { computed, onMounted, ref } from 'vue'
 import { rpcClient } from '@/api/rpc-client'
 import { safeClipboardWrite } from '@/views/web5/utils'
+import FipsSeedAnchorsCard from './FipsSeedAnchorsCard.vue'
 
 interface FipsStatus {
   installed: boolean
@@ -113,6 +152,7 @@ const reconnecting = ref(false)
 const statusMessage = ref('')
 const statusIsError = ref(false)
 const copied = ref(false)
+const showAnchorsModal = ref(false)
 
 async function copyNpub() {
   if (!status.value.npub) return

neode-ui/src/views/server/FipsSeedAnchorsCard.vue

@@ -0,0 +1,186 @@
+<template>
+  <div data-controller-container tabindex="0" class="glass-card p-6 flex flex-col transition-all hover:-translate-y-1 relative">
+    <button
+      v-if="closable"
+      type="button"
+      class="absolute top-4 right-4 p-2 rounded-lg hover:bg-white/10 text-white/70 hover:text-white transition-colors z-10"
+      aria-label="Close"
+      @click="$emit('close')"
+    >
+      <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
+      </svg>
+    </button>
+    <div class="flex items-start gap-4 mb-4 shrink-0" :class="{ 'pr-10': closable }">
+      <div class="flex-shrink-0 w-12 h-12 rounded-lg bg-white/10 flex items-center justify-center">
+        <!-- Radio/broadcast icon — three concentric arcs radiating from a
+             dot. Reads as mesh, signal, anchor-reaching-peers. -->
+        <svg class="w-6 h-6 text-white/80" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8.288 15.038a5.25 5.25 0 017.424 0M5.106 11.856c3.807-3.808 9.98-3.808 13.788 0M1.924 8.674c5.565-5.565 14.587-5.565 20.152 0" />
+          <circle cx="12" cy="18" r="1.25" fill="currentColor" stroke="none" />
+        </svg>
+      </div>
+      <div class="flex-1">
+        <div class="flex items-start justify-between gap-4 mb-2">
+          <h2 class="text-xl font-semibold text-white">FIPS Seed Anchors</h2>
+          <button
+            type="button"
+            class="text-xs px-3 py-1.5 rounded-md bg-white/5 hover:bg-white/10 text-white/70 hover:text-white transition-colors disabled:opacity-60"
+            :disabled="applying"
+            :title="applying ? 'Applying…' : 'Re-dial every anchor in the list'"
+            @click="applyAll"
+          >
+            {{ applying ? 'Applying…' : 'Apply now' }}
+          </button>
+        </div>
+        <p class="text-white/70 text-sm mb-4">
+          Peers this node dials to bootstrap the FIPS mesh. A cluster with its own anchors doesn't depend on the global public anchor — if one is down, the next seeds the DHT instead.
+        </p>
+      </div>
+    </div>
+
+    <div v-if="statusMessage" class="mb-3 p-3 rounded-lg text-xs" :class="statusIsError ? 'bg-red-400/10 text-red-300' : 'bg-green-400/10 text-green-300'">{{ statusMessage }}</div>
+
+    <div v-if="anchors.length === 0" class="p-4 rounded-lg bg-white/5 text-sm text-white/60 mb-3">
+      <p>No seed anchors configured. The daemon will fall back to whatever the upstream FIPS build dials on its own — usually the single public anchor, which is fine until it isn't.</p>
+      <p class="mt-2 text-white/50">Add at least one known-reachable peer (e.g. your VPS or a home node with port-forwarded UDP 8668) to make this cluster self-anchoring.</p>
+    </div>
+
+    <ul v-else class="space-y-2 mb-3">
+      <li v-for="a in anchors" :key="a.npub" class="p-3 bg-white/5 rounded-lg flex items-start gap-3">
+        <div class="flex-1 min-w-0">
+          <p class="text-sm font-medium text-white truncate">{{ a.label || 'Unlabeled anchor' }}</p>
+          <p class="text-xs text-white/60 font-mono break-all">{{ a.npub.slice(0, 20) }}…{{ a.npub.slice(-8) }}</p>
+          <p class="text-xs text-white/50 mt-0.5">{{ a.address }} · {{ a.transport }}</p>
+        </div>
+        <button
+          type="button"
+          class="shrink-0 text-xs px-2 py-1 rounded-md text-red-300 hover:bg-red-400/10 transition-colors"
+          :title="`Remove ${a.label || a.npub.slice(0, 12)}`"
+          @click="removeAnchor(a.npub)"
+        >Remove</button>
+      </li>
+    </ul>
+
+    <form class="grid grid-cols-1 sm:grid-cols-2 gap-2 mt-auto pt-3 border-t border-white/10 shrink-0" @submit.prevent="addAnchor">
+      <label class="flex flex-col gap-1 sm:col-span-2">
+        <span class="text-xs text-white/60">Anchor npub</span>
+        <input v-model="draft.npub" type="text" placeholder="npub1…" class="px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none" />
+      </label>
+      <label class="flex flex-col gap-1">
+        <span class="text-xs text-white/60">Address (host:port)</span>
+        <input v-model="draft.address" type="text" placeholder="192.168.1.116:8668" class="px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none" />
+      </label>
+      <label class="flex flex-col gap-1">
+        <span class="text-xs text-white/60">Label (optional)</span>
+        <input v-model="draft.label" type="text" placeholder="Home anchor" class="px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none" />
+      </label>
+      <button type="submit" class="sm:col-span-2 min-h-[44px] glass-button rounded-lg text-sm font-medium disabled:opacity-60" :disabled="adding || !draft.npub || !draft.address">{{ adding ? 'Adding…' : 'Add anchor' }}</button>
+    </form>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { onMounted, reactive, ref } from 'vue'
+import { rpcClient } from '@/api/rpc-client'
+
+defineProps<{ closable?: boolean }>()
+defineEmits<{ (e: 'close'): void }>()
+
+interface SeedAnchor {
+  npub: string
+  address: string
+  transport: string
+  label: string
+}
+
+interface ApplyResult {
+  npub: string
+  ok: boolean
+  message: string
+}
+
+const anchors = ref<SeedAnchor[]>([])
+const adding = ref(false)
+const applying = ref(false)
+const statusMessage = ref('')
+const statusIsError = ref(false)
+
+const draft = reactive<Pick<SeedAnchor, 'npub' | 'address' | 'label'>>({
+  npub: '',
+  address: '',
+  label: '',
+})
+
+function flash(msg: string, isError = false) {
+  statusMessage.value = msg
+  statusIsError.value = isError
+  setTimeout(() => { statusMessage.value = '' }, 6000)
+}
+
+async function load() {
+  try {
+    const res = await rpcClient.call<{ seed_anchors: SeedAnchor[] }>({ method: 'fips.list-seed-anchors' })
+    anchors.value = res.seed_anchors
+  } catch (e: unknown) {
+    if (import.meta.env.DEV) console.warn('fips.list-seed-anchors failed', e)
+  }
+}
+
+async function addAnchor() {
+  if (!draft.npub.trim() || !draft.address.trim()) return
+  adding.value = true
+  try {
+    const res = await rpcClient.call<{ seed_anchors: SeedAnchor[]; apply: ApplyResult[] }>({
+      method: 'fips.add-seed-anchor',
+      params: {
+        npub: draft.npub.trim(),
+        address: draft.address.trim(),
+        transport: 'udp',
+        label: draft.label.trim(),
+      },
+    })
+    anchors.value = res.seed_anchors
+    draft.npub = ''
+    draft.address = ''
+    draft.label = ''
+    const applied = res.apply.find(r => r.ok)
+    flash(applied ? 'Anchor added and dialed.' : 'Anchor saved — dial failed, will retry on the next apply cycle.', !applied)
+  } catch (e: unknown) {
+    const msg = e instanceof Error ? e.message : String(e)
+    flash(`Add failed: ${msg}`, true)
+  } finally {
+    adding.value = false
+  }
+}
+
+async function removeAnchor(npub: string) {
+  try {
+    const res = await rpcClient.call<{ seed_anchors: SeedAnchor[] }>({
+      method: 'fips.remove-seed-anchor',
+      params: { npub },
+    })
+    anchors.value = res.seed_anchors
+    flash('Anchor removed.')
+  } catch (e: unknown) {
+    const msg = e instanceof Error ? e.message : String(e)
+    flash(`Remove failed: ${msg}`, true)
+  }
+}
+
+async function applyAll() {
+  applying.value = true
+  try {
+    const res = await rpcClient.call<{ applied: number; results: ApplyResult[] }>({ method: 'fips.apply-seed-anchors' })
+    const ok = res.results.filter(r => r.ok).length
+    flash(`${ok} of ${res.applied} anchor${res.applied === 1 ? '' : 's'} dialed.`, ok === 0 && res.applied > 0)
+  } catch (e: unknown) {
+    const msg = e instanceof Error ? e.message : String(e)
+    flash(`Apply failed: ${msg}`, true)
+  } finally {
+    applying.value = false
+  }
+}
+
+onMounted(load)
+</script>

neode-ui/src/views/settings/AccountInfoSection.vue

@@ -180,6 +180,114 @@ init()
               </button>
             </div>
             <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+              <!-- v1.7.29-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.29-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>New App registries page in Settings — same experience as Update mirrors, but for the container registries your node pulls app images from. Add a mirror, test reachability with one click, pick the primary.</p>
+                  <p>New nodes default to the VPS registry as the primary for both app installs and the app catalog, with tx1138 as the automatic fallback if the VPS is slow or unreachable. Existing nodes keep whatever registry order they've already set.</p>
+                  <p>App installs now genuinely honor the primary registry: the first pull attempt rewrites the image URL to use your primary, and only falls through to the secondary if that fails. Before, installs always hit whichever registry the image was hardcoded to.</p>
+                  <p>Reboot screen now shows the animated "a" logo in the center of the ring — matching the screensaver's look so you get something nice to watch while the node comes back up.</p>
+                </div>
+              </div>
+              <!-- v1.7.28-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.28-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Reboot now shows a proper progress screen. Click Reboot and you'll see a full-screen overlay with the familiar pulsing ring animation, a rebooting / reconnecting / back-online status, and an elapsed counter — no more black screen of mystery while you wait.</p>
+                  <p>The overlay auto-reloads the page the moment your node is back up; if it takes longer than three minutes it surfaces a manual Reload button.</p>
+                  <p>New nodes now default to the VPS mirror as Server 1 (primary) and tx1138 as Server 2 (fallback). Existing nodes keep whatever mirror order they've already set — use Set Primary on the System Update page to change it.</p>
+                </div>
+              </div>
+              <!-- v1.7.27-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.27-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>The Update page now shows which mirror delivered your update — a small "Served by" line under the new version tells you whether Server 1, Server 2, or a custom mirror was the one your node actually reached. Great for spot-checking that mirror fallback is doing its job.</p>
+                  <p>Every mirror row has a new lightning-bolt button that pings the mirror and shows whether it's reachable, plus the round-trip latency in milliseconds. No more guessing if a mirror you just added is responding.</p>
+                  <p>The Update mirrors section got a visual refresh: Set Primary, Remove, and the new Test action are compact icon buttons instead of crowded text, and adding a mirror now happens in a dedicated dialog that matches the rest of the UI.</p>
+                </div>
+              </div>
+              <!-- v1.7.26-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.26-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Update downloads now have a mirror list. If the primary update server is slow or unreachable, your node automatically tries the next mirror and downloads the files from there — no more waiting on a stalled server with no recourse.</p>
+                  <p>A new 'Update mirrors' section on the System Update page lets you see the list, add your own mirror URL, reorder which is tried first (Set primary), or remove one. The primary is tagged with a green PRIMARY pill.</p>
+                  <p>Downloads automatically follow the mirror that served the manifest. Previously every mirror served the same manifest, and the manifest's download URLs were hardcoded to a single server — so even picking a faster mirror couldn't speed up the actual download. Now the backend rewrites download URLs to match whichever mirror succeeded.</p>
+                  <p>Ships with two defaults: Server 1 (tx1138) and Server 2 (VPS). Add the URL format <code>https://host/.../releases/manifest.json</code> for custom mirrors.</p>
+                </div>
+              </div>
+              <!-- v1.7.25-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.25-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Your node can now reach the broader FIPS public mesh, not just your own federated cluster. The FIPS daemon now binds both UDP (fast mesh forwarding) and TCP (NAT-friendly bootstrap) transports — matching the upstream factory default. The public anchor currently answers on TCP, so UDP-only nodes couldn't reach it; this fixes that without any action needed on your end.</p>
+                  <p>Upgrading the config happens automatically. On next startup, if the installed FIPS yaml doesn't match the new two-transport schema, the node reinstalls and restarts the daemon so the TCP transport comes online. No manual Reconnect required.</p>
+                  <p>Side benefit: TCP also helps on networks that block outbound UDP (corporate, some guest wifi) — your node falls back to TCP/8443 automatically and still joins the mesh.</p>
+                </div>
+              </div>
+              <!-- v1.7.24-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.24-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Frontend updates now actually ship. Since roughly v1.7.17 the release pipeline had been rebuilding the backend every version but silently skipping the frontend bundle — a permissions issue on the build server meant vue-tsc failed before vite ever ran, and nobody noticed because the published tarballs still extracted cleanly. The result was the backend moving forward while the UI stayed frozen at its v1.7.9-era state, which is why the FIPS gear icon and the What's New entries for every release since then had been missing on your node.</p>
+                  <p>Once this update applies, your node gets the real v1.7.24 frontend: the FIPS Seed Anchors modal (gear icon on the FIPS Mesh card), the current What's New history, the cancel-download button, and every other UI touch from the releases in between.</p>
+                </div>
+              </div>
+              <!-- v1.7.23-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.23-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>FIPS Seed Anchors are now one click away. A small gear icon sits next to the status pill on the FIPS Mesh card — click it to open a modal where you can add, remove, and re-apply anchors. No more needing to go digging for the card or editing JSON by hand.</p>
+                  <p>The modal lists each anchor with its label, truncated npub, address, and transport, plus an Apply button to force-redial the full list and a Remove button per entry. The add form right below validates that the address is host:port and the npub is bech32 before saving.</p>
+                </div>
+              </div>
+              <!-- v1.7.22-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.22-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>The FIPS Reconnect and Restart buttons now work on every node, regardless of which systemd unit is actually supervising the daemon. Previously they targeted only the archipelago-managed unit — nodes that were running the upstream unit instead saw the buttons silently do nothing. Both paths now auto-detect which unit is up and act on that one.</p>
+                  <p>The FIPS anchor status no longer shows red just because one specific public anchor is unreachable. It now lights green whenever any authenticated peer is a recognised anchor — that's either the public anchor or something you added under Seed Anchors. A federated cluster that routes through its own seed anchor finally reports the truth.</p>
+                  <p>Reconnect also re-pushes your seed anchors after the restart, so you don't have to wait five minutes for the background apply loop to re-dial them.</p>
+                </div>
+              </div>
+              <!-- v1.7.21-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.21-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>FIPS bootstrap no longer depends on a single public anchor. You can now add your own anchors — other archipelago nodes or a VPS you control — and the node will dial every one of them to join the mesh on startup. If one anchor is down, the next one seeds the routing layer instead, so a flaky public anchor no longer strands a fresh install.</p>
+                  <p>Anchors persist across restarts and are re-applied every five minutes, so a daemon that got temporarily isolated reconnects on its own without anyone having to SSH in. Each anchor carries an operator-editable label so you can remember which is which.</p>
+                  <p>No behavior change if you don't configure any — the upstream daemon's own defaults keep working as before. This purely adds an operator-controlled list on top.</p>
+                </div>
+              </div>
               <!-- v1.7.20-alpha -->
               <div>
                 <div class="flex items-center gap-2 mb-3">

neode-ui/src/views/settings/AppRegistriesSection.vue

@@ -0,0 +1,27 @@
+<script setup lang="ts">
+import { RouterLink } from 'vue-router'
+</script>
+
+<template>
+  <!-- App Registries Section -->
+  <div class="glass-card px-6 py-6 mb-6">
+    <div class="flex items-center justify-between">
+      <div>
+        <h2 class="text-xl font-semibold text-white/96">App registries</h2>
+        <p class="text-sm text-white/60 mt-1">
+          Choose the primary registry for app installs and add mirrors for fallback.
+        </p>
+      </div>
+      <RouterLink
+        to="/dashboard/settings/registries"
+        class="glass-button px-4 py-2 rounded-lg text-sm flex items-center gap-2"
+      >
+        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+            d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1M12 12V3m0 0l-4 4m4-4l4 4" />
+        </svg>
+        Manage registries
+      </RouterLink>
+    </div>
+  </div>
+</template>

neode-ui/src/views/settings/SystemDangerZone.vue

@@ -1,8 +1,10 @@
 <script setup lang="ts">
-import { ref } from 'vue'
+import { ref, computed, onBeforeUnmount } from 'vue'
 import { useRouter } from 'vue-router'
 import { useI18n } from 'vue-i18n'
 import { rpcClient } from '@/api/rpc-client'
+import ScreensaverRing from '@/components/ScreensaverRing.vue'
+import ScreensaverLogo from '@/components/ScreensaverLogo.vue'
 
 const router = useRouter()
 const { t } = useI18n()
@@ -13,6 +15,59 @@ const rebooting = ref(false)
 const rebootPassword = ref('')
 const rebootError = ref('')
 
+// Reboot overlay — full-screen progress shown once the reboot is committed.
+// Mirrors the update overlay pattern in SystemUpdate.vue: poll /health,
+// auto-reload when the backend returns, stall fallback at 3 min.
+type RebootStage = 'rebooting' | 'reconnecting' | 'ready' | 'stalled'
+const rebootOverlay = ref(false)
+const rebootStage = ref<RebootStage>('rebooting')
+const rebootStartedAt = ref(0)
+const rebootElapsedSec = ref(0)
+let rebootPollTimer: ReturnType<typeof setInterval> | null = null
+let rebootElapsedTimer: ReturnType<typeof setInterval> | null = null
+const rebootElapsedLabel = computed(() => {
+  const s = rebootElapsedSec.value
+  if (s < 60) return `Elapsed: ${s}s`
+  return `Elapsed: ${Math.floor(s / 60)}m${s % 60 < 10 ? '0' : ''}${s % 60}s`
+})
+
+function startRebootOverlay() {
+  rebootOverlay.value = true
+  rebootStage.value = 'rebooting'
+  rebootStartedAt.value = Date.now()
+  rebootElapsedSec.value = 0
+  rebootElapsedTimer = setInterval(() => {
+    rebootElapsedSec.value = Math.floor((Date.now() - rebootStartedAt.value) / 1000)
+    if (rebootElapsedSec.value >= 180 && rebootStage.value !== 'ready') {
+      rebootStage.value = 'stalled'
+    }
+  }, 1000)
+  // Start health polling after 2.5s — the kernel has to go down before
+  // /health can disappear, and we don't want to see the pre-reboot health
+  // reply and mis-report "ready".
+  setTimeout(() => {
+    rebootStage.value = 'reconnecting'
+    rebootPollTimer = setInterval(pollRebootHealth, 1500)
+  }, 2500)
+}
+async function pollRebootHealth() {
+  if (rebootStage.value === 'ready' || rebootStage.value === 'stalled') return
+  try {
+    const res = await fetch('/health', { signal: AbortSignal.timeout(2000) })
+    if (!res.ok) throw new Error(`health ${res.status}`)
+    rebootStage.value = 'ready'
+    if (rebootPollTimer) { clearInterval(rebootPollTimer); rebootPollTimer = null }
+    setTimeout(() => { window.location.reload() }, 1200)
+  } catch {
+    // Fetch failing is the normal state while the host is down.
+  }
+}
+function rebootReloadNow() { window.location.reload() }
+onBeforeUnmount(() => {
+  if (rebootPollTimer) clearInterval(rebootPollTimer)
+  if (rebootElapsedTimer) clearInterval(rebootElapsedTimer)
+})
+
 async function performReboot() {
   if (!rebootPassword.value) return
   rebooting.value = true
@@ -21,6 +76,7 @@ async function performReboot() {
     await rpcClient.call({ method: 'system.reboot', params: { password: rebootPassword.value } })
     showRebootConfirm.value = false
     rebootPassword.value = ''
+    startRebootOverlay()
   } catch (e) {
     rebootError.value = e instanceof Error ? e.message : 'Reboot failed'
     rebooting.value = false
@@ -108,6 +164,55 @@ async function performFactoryReset() {
     </div>
   </Teleport>
 
+  <!-- Reboot Progress Overlay -->
+  <Teleport to="body">
+    <Transition name="fade">
+      <div
+        v-if="rebootOverlay"
+        class="fixed inset-0 z-[3000] bg-black flex flex-col items-center justify-center overflow-hidden"
+      >
+        <!-- Centered animated ring + logo — same composition as the screensaver -->
+        <div class="reboot-ring-content">
+          <ScreensaverRing />
+          <div class="reboot-logo-wrapper">
+            <ScreensaverLogo />
+          </div>
+        </div>
+
+        <!-- Stage text + progress bar underneath -->
+        <div class="mt-8 w-[min(520px,80vw)] text-center">
+          <h2 class="text-xl font-semibold text-white mb-1">
+            {{ rebootStage === 'rebooting' ? 'Rebooting…'
+             : rebootStage === 'reconnecting' ? 'Reconnecting to your node…'
+             : rebootStage === 'ready' ? 'Back online'
+             : 'Reboot is taking longer than expected' }}
+          </h2>
+          <p class="text-sm text-white/60 mb-4">
+            Your node is restarting. This page will refresh automatically once it's back.
+          </p>
+
+          <!-- Animated progress bar: indeterminate stripe while working,
+               solid green when ready, paused at half while stalled. -->
+          <div class="w-full h-2 bg-white/10 rounded-full overflow-hidden mb-3 relative">
+            <div v-if="rebootStage === 'ready'" class="absolute inset-0 bg-green-400"></div>
+            <div v-else-if="rebootStage === 'stalled'" class="absolute inset-y-0 left-0 w-1/2 bg-orange-400/60"></div>
+            <div v-else class="absolute inset-y-0 w-1/3 bg-orange-400 rounded-full reboot-overlay-bar-anim"></div>
+          </div>
+
+          <p class="text-xs text-white/40">{{ rebootElapsedLabel }}</p>
+
+          <button
+            v-if="rebootStage === 'stalled'"
+            @click="rebootReloadNow"
+            class="mt-5 glass-button rounded-lg px-5 py-2 text-sm font-medium bg-orange-500/20 border-orange-400/30"
+          >
+            Reload now
+          </button>
+        </div>
+      </div>
+    </Transition>
+  </Teleport>
+
   <!-- Factory Reset Section -->
   <div class="glass-card px-6 py-6 mb-6 border border-red-500/30">
     <div class="flex flex-col md:flex-row md:items-center md:justify-between gap-3">
@@ -148,3 +253,37 @@ async function performFactoryReset() {
     </div>
   </Teleport>
 </template>
+
+<style scoped>
+.fade-enter-active,
+.fade-leave-active {
+  transition: opacity 0.3s ease;
+}
+.fade-enter-from,
+.fade-leave-to {
+  opacity: 0;
+}
+
+.reboot-ring-content {
+  position: relative;
+  display: grid;
+  place-items: center;
+}
+.reboot-logo-wrapper {
+  position: absolute;
+  inset: 0;
+  display: grid;
+  place-items: center;
+  z-index: 10;
+  filter: drop-shadow(0 0 40px rgba(255, 255, 255, 0.15));
+}
+
+.reboot-overlay-bar-anim {
+  animation: rebootBarSlide 1.8s ease-in-out infinite;
+}
+@keyframes rebootBarSlide {
+  0%   { transform: translateX(-100%); }
+  50%  { transform: translateX(120%); }
+  100% { transform: translateX(300%); }
+}
+</style>

neode-ui/src/views/settings/SystemSection.vue

@@ -3,6 +3,7 @@ import InterfaceModeSection from '@/views/settings/InterfaceModeSection.vue'
 import ClaudeAuthSection from '@/views/settings/ClaudeAuthSection.vue'
 import AIDataAccessSection from '@/views/settings/AIDataAccessSection.vue'
 import SystemUpdatesSection from '@/views/settings/SystemUpdatesSection.vue'
+import AppRegistriesSection from '@/views/settings/AppRegistriesSection.vue'
 import WebhookSection from '@/views/settings/WebhookSection.vue'
 import TelemetrySection from '@/views/settings/TelemetrySection.vue'
 import BackupSection from '@/views/settings/BackupSection.vue'
@@ -14,6 +15,7 @@ import SystemDangerZone from '@/views/settings/SystemDangerZone.vue'
   <ClaudeAuthSection />
   <AIDataAccessSection />
   <SystemUpdatesSection />
+  <AppRegistriesSection />
   <WebhookSection />
   <TelemetrySection />
   <BackupSection />