release(v1.7.36-alpha): bitcoin-core in App Store + Sovereignty Stack + dynamic catalog URL

- neode-ui/public/assets/img/app-icons/bitcoin-core.svg (NEW): 256×256
  Umbrel community Bitcoin icon sourced from getumbrel.github.io/
  umbrel-apps-gallery/bitcoin/icon.svg. Referenced by the static
  catalog, the curated fallback, and the upstream lfg2025/app-catalog
  entry so every surface shows the same image.
- app-catalog/catalog.json + neode-ui/public/catalog.json: add
  bitcoin-core (v28.4) entry pointing at bitcoin/bitcoin:28.4. Same
  entry pushed to the lfg2025/app-catalog repo on .160 and the local
  gitea mirror so nodes see it without needing a full archipelago
  update. Sovereignty Stack entry added to FEATURED_DEFINITIONS with
  a description that frames it as a Knots alternative, not a rival.
- core/archipelago/src/api/handler/mod.rs: handle_app_catalog_proxy
  is now instance-scoped (&self) and derives its upstream list from
  load_registries — each active container registry contributes one
  `<scheme>://<reg.url>/app-catalog/raw/branch/main/catalog.json` URL
  in priority order (scheme follows tls_verify). When the operator
  switches mirrors in Settings, the App Store now follows. Falls back
  to the legacy hardcoded .160/tx1138 pair only when registry config
  can't be loaded, so the App Store still renders on nodes that
  haven't persisted one yet.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app-catalog/catalog.json

@@ -1,6 +1,6 @@
 {
   "version": 2,
-  "updated": "2026-04-12T00:00:00Z",
+  "updated": "2026-04-22T00:00:00Z",
   "registry": "git.tx1138.com/lfg2025",
   "featured": {
     "id": "indeedhub",
@@ -18,6 +18,14 @@
       "dockerImage": "git.tx1138.com/lfg2025/bitcoin-knots:latest",
       "repoUrl": "https://github.com/bitcoinknots/bitcoin"
     },
+    {
+      "id": "bitcoin-core", "title": "Bitcoin Core", "version": "28.4",
+      "description": "Reference implementation of the Bitcoin protocol. Run a full node validating and relaying blocks.",
+      "icon": "/assets/img/app-icons/bitcoin-core.svg",
+      "author": "Bitcoin Core contributors", "category": "money", "tier": "optional",
+      "dockerImage": "bitcoin/bitcoin:28.4",
+      "repoUrl": "https://github.com/bitcoin/bitcoin"
+    },
     {
       "id": "lnd", "title": "LND", "version": "0.18.4",
       "description": "Lightning Network Daemon. Fast Bitcoin payments through Lightning.",

apps/bitcoin-core/manifest.yml

@@ -1,11 +1,11 @@
 app:
   id: bitcoin-core
   name: Bitcoin Core
-  version: 24.0.0
+  version: 28.4.0
   description: Full Bitcoin node implementation. The reference implementation of the Bitcoin protocol.
-  
+
   container:
-    image: bitcoin/bitcoin:24.0
+    image: bitcoin/bitcoin:28.4
     image_signature: cosign://...
     pull_policy: verify-signature
     
@@ -13,8 +13,8 @@ app:
     - storage: 500Gi  # Minimum disk space for mainnet
     
   resources:
-    cpu_limit: 2
-    memory_limit: 2Gi
+    cpu_limit: 0      # 0 = unlimited; bitcoind uses -par=auto across all cores
+    memory_limit: 4Gi # matches container-specs.sh bitcoin-knots large-disk dbcache=4096
     disk_limit: 500Gi
     
   security:

core/Cargo.lock

@@ -80,7 +80,7 @@ checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
 [[package]]
 name = "archipelago"
-version = "1.7.28-alpha"
+version = "1.7.36-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.28-alpha"
+version = "1.7.36-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]

core/archipelago/src/api/handler/mod.rs

@@ -115,14 +115,41 @@ impl ApiHandler {
 
     /// Server-side fetch of the upstream app catalog so the browser can
     /// load it without fighting CORS (git.tx1138.com emits no ACAO) or
-    /// CSP (the fallback IP-port URL isn't in `connect-src`). Tries the
-    /// upstream URLs in the same order the frontend used, returns the
-    /// first 2xx response. 15s total timeout.
-    async fn handle_app_catalog_proxy() -> Result<Response<hyper::Body>> {
-        const UPSTREAMS: &[&str] = &[
-            "https://git.tx1138.com/lfg2025/app-catalog/raw/branch/main/catalog.json",
-            "http://23.182.128.160:3000/lfg2025/app-catalog/raw/branch/main/catalog.json",
-        ];
+    /// CSP (the fallback IP-port URL isn't in `connect-src`). The upstream
+    /// list is derived from the operator's configured container registries
+    /// so switching mirrors in Settings changes the App Store source too —
+    /// each active registry contributes one Gitea `raw/branch/main/catalog.json`
+    /// URL (http or https per `tls_verify`), tried in priority order.
+    /// If registry config can't be loaded, falls back to the legacy
+    /// hardcoded pair so the App Store still renders on nodes that haven't
+    /// persisted a registry config yet. 15s total timeout.
+    async fn handle_app_catalog_proxy(&self) -> Result<Response<hyper::Body>> {
+        let mut upstreams: Vec<String> = Vec::new();
+        if let Ok(config) =
+            crate::container::registry::load_registries(&self.config.data_dir).await
+        {
+            for reg in config.active_registries() {
+                let scheme = if reg.tls_verify { "https" } else { "http" };
+                // Gitea raw URL: <scheme>://<host>/<namespace>/app-catalog/raw/branch/main/catalog.json.
+                // reg.url already includes the namespace (e.g. "host/lfg2025"),
+                // so we just tack on the repo + raw path.
+                upstreams.push(format!(
+                    "{}://{}/app-catalog/raw/branch/main/catalog.json",
+                    scheme, reg.url
+                ));
+            }
+        }
+        if upstreams.is_empty() {
+            upstreams.push(
+                "http://23.182.128.160:3000/lfg2025/app-catalog/raw/branch/main/catalog.json"
+                    .to_string(),
+            );
+            upstreams.push(
+                "https://git.tx1138.com/lfg2025/app-catalog/raw/branch/main/catalog.json"
+                    .to_string(),
+            );
+        }
+
         let client = match reqwest::Client::builder()
             .timeout(std::time::Duration::from_secs(15))
             .build()
@@ -136,8 +163,8 @@ impl ApiHandler {
                 ));
             }
         };
-        for url in UPSTREAMS {
-            match client.get(*url).send().await {
+        for url in &upstreams {
+            match client.get(url).send().await {
                 Ok(resp) if resp.status().is_success() => {
                     if let Ok(bytes) = resp.bytes().await {
                         return Ok(Response::builder()
@@ -408,7 +435,7 @@ impl ApiHandler {
                 if !self.is_authenticated(&headers).await {
                     return Ok(Self::unauthorized());
                 }
-                Self::handle_app_catalog_proxy().await
+                self.handle_app_catalog_proxy().await
             }
 
             // LND connect info — nginx validates session cookie (presence check),

core/archipelago/src/api/rpc/dispatcher.rs

@@ -220,6 +220,7 @@ impl RpcHandler {
             "registry.list" => self.handle_registry_list().await,
             "registry.add" => self.handle_registry_add(params).await,
             "registry.remove" => self.handle_registry_remove(params).await,
+            "registry.set-primary" => self.handle_registry_set_primary(params).await,
             "registry.test" => self.handle_registry_test(params).await,
 
             // Streaming ecash payments

core/archipelago/src/api/rpc/package/install.rs

@@ -635,31 +635,32 @@ impl RpcHandler {
         unreachable!()
     }
 
-    /// Single image pull attempt with progress streaming.
-    async fn do_pull_image(&self, package_id: &str, docker_image: &str) -> Result<()> {
-        debug!("Pulling image: {}", docker_image);
-        self.set_install_progress(package_id, 0, 0).await;
-
-        // Set TMPDIR to user-writable location — rootless podman's user namespace
-        // makes /var/tmp read-only, which causes `podman pull` to fail with
-        // "mkdir /var/tmp/container_images_storage...: read-only file system"
-        let user_tmp = format!(
-            "{}/.local/share/containers/tmp",
-            std::env::var("HOME").unwrap_or_else(|_| "/home/archipelago".to_string())
-        );
-        let _ = std::fs::create_dir_all(&user_tmp);
-
+    /// Pull one image URL with live progress streamed through
+    /// `update_install_progress`. Returns Ok(true) on a successful pull,
+    /// Ok(false) on transient failure (so the caller can try the next
+    /// mirror), Err only for unrecoverable setup errors.
+    async fn pull_one_url_with_progress(
+        &self,
+        url: &str,
+        tls_verify: bool,
+        package_id: &str,
+        user_tmp: &str,
+    ) -> Result<bool> {
+        let mut pull_args = vec!["pull".to_string(), url.to_string()];
+        if !tls_verify {
+            pull_args.push("--tls-verify=false".to_string());
+        }
         let mut child = tokio::process::Command::new("podman")
-            .args(["pull", docker_image])
-            .env("TMPDIR", &user_tmp)
+            .args(&pull_args)
+            .env("TMPDIR", user_tmp)
             .stdout(std::process::Stdio::piped())
             .stderr(std::process::Stdio::piped())
             .spawn()
             .context("Failed to start image pull")?;
 
-        // Wrap the entire pull (stderr progress + wait) in a 10-minute timeout.
-        // Large image layers (Minio, Postgres, ffmpeg) can take several minutes
-        // to pull. 60s was too short and caused premature retries on slow registries.
+        // 10-minute per-URL budget — large layers (Minio, Postgres,
+        // ffmpeg) regularly take several minutes and we'd rather wait
+        // than bounce to the next mirror mid-download.
         let pull_result = tokio::time::timeout(std::time::Duration::from_secs(600), async {
             if let Some(stderr) = child.stderr.take() {
                 let reader = BufReader::new(stderr);
@@ -677,38 +678,115 @@ impl RpcHandler {
         })
         .await;
 
-        let primary_failed = match pull_result {
-            Ok(Ok(status)) => !status.success(),
+        match pull_result {
+            Ok(Ok(status)) => Ok(status.success()),
             Ok(Err(e)) => {
-                tracing::warn!("Image pull process error: {}", e);
-                true
+                tracing::warn!("Image pull process error on {}: {}", url, e);
+                Ok(false)
             }
             Err(_) => {
-                tracing::warn!("Image pull timed out after 60s: {}", docker_image);
+                tracing::warn!("Image pull timed out after 600s: {}", url);
                 let _ = child.kill().await;
                 let _ = child.wait().await; // reap zombie
-                true
+                Ok(false)
             }
-        };
-        if primary_failed {
-            // Try all configured fallback registries dynamically
-            match crate::container::registry::pull_from_registries(
-                &self.config.data_dir,
-                docker_image,
-                &user_tmp,
-            )
+        }
+    }
+
+    /// Pull a container image, trying each configured registry in
+    /// priority order and streaming progress during every attempt. The
+    /// primary is tried first; if it doesn't have the image (or 404's),
+    /// the next mirror is tried — with its own progress streaming, so
+    /// the UI doesn't freeze at 0% after a primary miss. On success the
+    /// image is tagged under `docker_image` so downstream commands
+    /// (images -q, run -d, etc.) can find it by its canonical name.
+    async fn do_pull_image(&self, package_id: &str, docker_image: &str) -> Result<()> {
+        debug!("Pulling image: {}", docker_image);
+        self.set_install_progress(package_id, 0, 0).await;
+
+        // Set TMPDIR to user-writable location — rootless podman's user namespace
+        // makes /var/tmp read-only, which causes `podman pull` to fail with
+        // "mkdir /var/tmp/container_images_storage...: read-only file system"
+        let user_tmp = format!(
+            "{}/.local/share/containers/tmp",
+            std::env::var("HOME").unwrap_or_else(|_| "/home/archipelago".to_string())
+        );
+        let _ = std::fs::create_dir_all(&user_tmp);
+
+        // Build the ordered candidate list: every enabled registry
+        // (highest priority first), each rewriting the image URL to its
+        // own origin. Deduplicate — two registries that happen to share
+        // a URL should only be tried once.
+        let config = crate::container::registry::load_registries(&self.config.data_dir)
             .await
+            .unwrap_or_default();
+        let mut tried: std::collections::HashSet<String> = std::collections::HashSet::new();
+        let mut candidates: Vec<(String, bool)> = Vec::new();
+        for reg in config.active_registries() {
+            let url = config.rewrite_image(docker_image, reg);
+            if tried.insert(url.clone()) {
+                candidates.push((url, reg.tls_verify));
+            }
+        }
+        // If no registries are configured, fall back to the literal URL.
+        if candidates.is_empty() {
+            candidates.push((docker_image.to_string(), true));
+        }
+
+        // Walk candidates, streaming progress for each attempt.
+        let mut pulled_url: Option<String> = None;
+        let attempts = candidates.len();
+        for (i, (url, tls_verify)) in candidates.iter().enumerate() {
+            if url != docker_image {
+                debug!("Attempt {}/{}: {}", i + 1, attempts, url);
+            } else {
+                debug!("Attempt {}/{}: {} (literal)", i + 1, attempts, url);
+            }
+            // Reset progress at the top of each attempt so the UI reflects
+            // the fresh pull instead of showing stale bytes from a prior
+            // partial attempt.
+            self.set_install_progress(package_id, 0, 0).await;
+            match self
+                .pull_one_url_with_progress(url, *tls_verify, package_id, &user_tmp)
+                .await?
             {
-                Ok(_) => {
-                    tracing::info!("Pulled {} via dynamic registry fallback", docker_image);
+                true => {
+                    tracing::info!("Pulled {} from {}", docker_image, url);
+                    pulled_url = Some(url.clone());
+                    break;
                 }
-                Err(e) => {
-                    return Err(anyhow::anyhow!("Image pull failed: {}", e));
+                false => {
+                    tracing::debug!(
+                        "Pull attempt {}/{} failed for {}, trying next mirror",
+                        i + 1,
+                        attempts,
+                        url
+                    );
+                    continue;
                 }
             }
         }
 
-        // Verify image exists locally after pull
+        let Some(pulled_url) = pulled_url else {
+            return Err(anyhow::anyhow!(
+                "Image pull failed from all {} configured registries for {}",
+                attempts,
+                docker_image
+            ));
+        };
+
+        // Tag under the original docker_image reference if the successful
+        // pull came from a rewritten URL — downstream code (images -q,
+        // run -d docker_image, etc.) needs to find it by its canonical
+        // name regardless of which mirror actually served the bytes.
+        if pulled_url != docker_image {
+            let _ = tokio::process::Command::new("podman")
+                .args(["tag", &pulled_url, docker_image])
+                .output()
+                .await;
+        }
+
+        // Verify image exists locally after pull.
         let verify = tokio::process::Command::new("podman")
             .args(["images", "-q", docker_image])
             .output()
@@ -1467,6 +1545,36 @@ server {
         Ok(serde_json::json!({ "registries": config.registries, "removed": url }))
     }
 
+    /// Promote a registry to primary by resetting priorities — the named
+    /// URL becomes priority 0, every other enabled registry is bumped up
+    /// by 10. Order is stable (ties broken by original priority).
+    pub(in crate::api::rpc) async fn handle_registry_set_primary(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let params = params.ok_or_else(|| anyhow::anyhow!("Missing params"))?;
+        let url = params
+            .get("url")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("Missing url"))?;
+
+        let mut config = crate::container::registry::load_registries(&self.config.data_dir).await?;
+        if !config.registries.iter().any(|r| r.url == url) {
+            return Err(anyhow::anyhow!("Registry '{}' not found", url));
+        }
+
+        // Reassign priorities: target = 0, everyone else = 10, 20, 30…
+        // in their existing priority order.
+        let target_url = url.to_string();
+        config.registries.sort_by_key(|r| (r.url != target_url, r.priority));
+        for (i, r) in config.registries.iter_mut().enumerate() {
+            r.priority = if r.url == target_url { 0 } else { (i as u32) * 10 };
+        }
+
+        crate::container::registry::save_registries(&self.config.data_dir, &config).await?;
+        Ok(serde_json::json!({ "registries": config.registries, "primary": url }))
+    }
+
     pub(in crate::api::rpc) async fn handle_registry_test(
         &self,
         params: Option<serde_json::Value>,
@@ -1481,10 +1589,16 @@ server {
             .and_then(|v| v.as_bool())
             .unwrap_or(true);
 
+        // Registries are configured as `host[:port]/namespace` (for
+        // example `23.182.128.160:3000/lfg2025`), but the Docker V2
+        // registry API lives at `/v2/` on the ROOT of the host — NOT
+        // under the namespace. Strip the namespace before appending
+        // `/v2/` so the reachability probe hits the correct URL.
+        let host = url.split('/').next().unwrap_or(url);
         let test_url = if tls_verify {
-            format!("https://{}/v2/", url)
+            format!("https://{}/v2/", host)
         } else {
-            format!("http://{}/v2/", url)
+            format!("http://{}/v2/", host)
         };
 
         let client = reqwest::Client::builder()
@@ -1496,8 +1610,11 @@ server {
         match client.get(&test_url).send().await {
             Ok(resp) => {
                 let status = resp.status().as_u16();
-                // 200 = open registry, 401 = auth required (both mean it exists)
-                let reachable = status == 200 || status == 401;
+                // Accept any "the server responded to HTTP" code as
+                // reachable — 200 (open registry), 401 (auth required),
+                // or 405 (server rejects GET but the endpoint exists)
+                // all mean the registry daemon is alive on the host.
+                let reachable = status == 200 || status == 401 || status == 405;
                 Ok(serde_json::json!({
                     "url": url,
                     "reachable": reachable,

core/archipelago/src/api/rpc/package/progress.rs

@@ -28,6 +28,18 @@ impl RpcHandler {
         self.state_manager.update_data(data).await;
     }
 
+    /// Set the uninstall stage label so the UI can show what's happening
+    /// instead of a generic spinner. Each call broadcasts a state change
+    /// — call sparingly (one per pipeline phase, not per container).
+    pub(super) async fn set_uninstall_stage(&self, package_id: &str, stage: &str) {
+        let (mut data, _rev) = self.state_manager.get_snapshot().await;
+        if let Some(entry) = data.package_data.get_mut(package_id) {
+            entry.uninstall_stage = Some(stage.to_string());
+            entry.state = crate::data_model::PackageState::Removing;
+        }
+        self.state_manager.update_data(data).await;
+    }
+
     /// Update install progress (static method for use in async closures).
     pub(super) async fn update_install_progress(
         state_manager: &crate::state::StateManager,
@@ -81,6 +93,7 @@ fn create_installing_entry(package_id: &str) -> PackageDataEntry {
         },
         installed: None,
         install_progress: None,
+        uninstall_stage: None,
         available_update: None,
     }
 }

core/archipelago/src/api/rpc/package/runtime.rs

@@ -261,12 +261,28 @@ impl RpcHandler {
         if containers_to_remove.is_empty() {
             tracing::warn!("Uninstall {}: no containers found", package_id);
         }
+        let total = containers_to_remove.len();
 
         let mut stopped = 0u32;
         let mut removed = 0u32;
         let mut errors = Vec::new();
 
-        for name in &containers_to_remove {
+        self.set_uninstall_stage(
+            package_id,
+            &if total > 0 {
+                format!("Stopping containers (0/{})", total)
+            } else {
+                "Cleaning up".to_string()
+            },
+        )
+        .await;
+
+        for (i, name) in containers_to_remove.iter().enumerate() {
+            self.set_uninstall_stage(
+                package_id,
+                &format!("Stopping containers ({}/{})", i + 1, total),
+            )
+            .await;
             tracing::info!("Uninstall {}: stopping container {}", package_id, name);
             let stop_out = tokio::process::Command::new("podman")
                 .args(["stop", "-t", stop_timeout_secs(name), name])
@@ -326,6 +342,7 @@ impl RpcHandler {
             }
         }
 
+        self.set_uninstall_stage(package_id, "Cleaning up volumes").await;
         // Clean up dangling volumes associated with removed containers
         let _ = tokio::process::Command::new("podman")
             .args(["volume", "prune", "-f"])
@@ -354,6 +371,7 @@ impl RpcHandler {
 
         // Clean data directories unless preserve_data
         if !preserve_data {
+            self.set_uninstall_stage(package_id, "Removing app data").await;
             let data_dirs = get_data_dirs_for_app(package_id);
             for dir in &data_dirs {
                 tracing::info!("Uninstall {}: removing data {}", package_id, dir);

core/archipelago/src/api/rpc/package/stacks.rs

@@ -937,6 +937,31 @@ impl RpcHandler {
                 .with_context(|| format!("Failed to pull IndeedHub image: {}", img))?;
         }
 
+        // Remove any leftover containers from a previous partial install (or
+        // from the first-boot frontend stub that used to race the installer).
+        // Without this, `podman run --name indeedhub` fails on name conflict
+        // and the whole stack install errors out — leaving a half-broken node.
+        for name in [
+            "indeedhub",
+            "indeedhub-postgres",
+            "indeedhub-redis",
+            "indeedhub-minio",
+            "indeedhub-relay",
+            "indeedhub-api",
+            "indeedhub-ffmpeg",
+            "indeedhub-build_api_1",
+            "indeedhub-build_ffmpeg-worker_1",
+        ] {
+            let _ = tokio::process::Command::new("podman")
+                .args(["rm", "-f", name])
+                .status()
+                .await;
+        }
+        let _ = tokio::process::Command::new("podman")
+            .args(["network", "rm", "-f", "indeedhub-net"])
+            .status()
+            .await;
+
         // Create indeedhub-net
         let _ = tokio::process::Command::new("podman")
             .args(["network", "create", "indeedhub-net"])

core/archipelago/src/bootstrap.rs

@@ -0,0 +1,152 @@
+//! Bootstrap host-side doctor artifacts on every archipelago startup.
+//!
+//! The update pipeline swaps the archipelago binary but does not touch
+//! scripts or systemd units — those are installed once by the ISO builder.
+//! Without this module, changes to `container-doctor.sh` or the doctor
+//! service/timer never reach boxes installed before the change.
+//!
+//! On startup we compare three embedded files against their on-disk
+//! copies and rewrite any that differ, then enable the doctor timer if
+//! it isn't already. Idempotent: no-ops on boxes that match the
+//! embedded version. All work is best-effort — failures are logged but
+//! never abort the backend.
+
+use anyhow::{Context, Result};
+use std::path::Path;
+use tokio::fs;
+use tracing::{debug, info, warn};
+
+use crate::update::host_sudo;
+
+const DOCTOR_SH: &str = include_str!("../../../scripts/container-doctor.sh");
+const DOCTOR_SERVICE: &str =
+    include_str!("../../../image-recipe/configs/archipelago-doctor.service");
+const DOCTOR_TIMER: &str =
+    include_str!("../../../image-recipe/configs/archipelago-doctor.timer");
+
+const DOCTOR_SH_PATH: &str = "/home/archipelago/archy/scripts/container-doctor.sh";
+const DOCTOR_SERVICE_PATH: &str = "/etc/systemd/system/archipelago-doctor.service";
+const DOCTOR_TIMER_PATH: &str = "/etc/systemd/system/archipelago-doctor.timer";
+
+/// Entry point called from main startup. Never returns an error to the caller —
+/// failing to bootstrap the doctor must not prevent the backend from serving.
+pub async fn ensure_doctor_installed() {
+    match run().await {
+        Ok(changed) if changed => info!("Doctor artifacts synchronized with binary"),
+        Ok(_) => debug!("Doctor artifacts already in sync"),
+        Err(e) => warn!("Doctor bootstrap failed (non-fatal): {:#}", e),
+    }
+}
+
+async fn run() -> Result<bool> {
+    // Dev-box guard: on contributors' laptops `/home/archipelago/archy` is
+    // typically a symlink into the git checkout, and writing through it
+    // would clobber the working tree with whatever the binary happens to
+    // have been compiled from. Production ISO installs materialize a real
+    // directory.
+    let home_archy = Path::new("/home/archipelago/archy");
+    if fs::symlink_metadata(home_archy)
+        .await
+        .map(|m| m.file_type().is_symlink())
+        .unwrap_or(false)
+    {
+        debug!("/home/archipelago/archy is a symlink — skipping doctor bootstrap (dev box)");
+        return Ok(false);
+    }
+
+    // Skip entirely on machines without the canonical scripts directory —
+    // writing orphan files there just causes confusion.
+    let scripts_dir = Path::new(DOCTOR_SH_PATH)
+        .parent()
+        .context("doctor script path has no parent")?;
+    if !scripts_dir.exists() {
+        debug!(
+            "Scripts dir {} missing — skipping doctor bootstrap",
+            scripts_dir.display()
+        );
+        return Ok(false);
+    }
+
+    let mut changed = false;
+
+    // 1. Script — lives in archipelago's home dir, user-writable.
+    if needs_write(DOCTOR_SH_PATH, DOCTOR_SH).await {
+        fs::write(DOCTOR_SH_PATH, DOCTOR_SH)
+            .await
+            .with_context(|| format!("write {}", DOCTOR_SH_PATH))?;
+        let _ = tokio::process::Command::new("chmod")
+            .args(["+x", DOCTOR_SH_PATH])
+            .status()
+            .await;
+        info!("Updated {}", DOCTOR_SH_PATH);
+        changed = true;
+    }
+
+    // 2. Systemd unit files — /etc is restricted; route through host_sudo.
+    let service_changed = write_root_if_needed(DOCTOR_SERVICE_PATH, DOCTOR_SERVICE).await?;
+    let timer_changed = write_root_if_needed(DOCTOR_TIMER_PATH, DOCTOR_TIMER).await?;
+    changed = changed || service_changed || timer_changed;
+
+    // 3. Reload + enable. Only when we actually touched units, or when the
+    // timer isn't enabled yet (catches fresh upgrades of boxes that predate
+    // the doctor entirely).
+    let timer_enabled = is_timer_enabled().await;
+    if service_changed || timer_changed || !timer_enabled {
+        if let Err(e) = host_sudo(&["systemctl", "daemon-reload"]).await {
+            warn!("daemon-reload failed: {:#}", e);
+        }
+        if let Err(e) = host_sudo(&["systemctl", "enable", "--now", "archipelago-doctor.timer"])
+            .await
+        {
+            warn!("enable archipelago-doctor.timer failed: {:#}", e);
+        } else if !timer_enabled {
+            info!("Enabled archipelago-doctor.timer");
+        }
+    }
+
+    Ok(changed)
+}
+
+async fn needs_write(path: &str, expected: &str) -> bool {
+    match fs::read_to_string(path).await {
+        Ok(current) => current != expected,
+        Err(_) => true,
+    }
+}
+
+/// Write content to a root-owned path via `sudo mv` of a user-owned tmp file.
+/// Returns true if a write happened.
+async fn write_root_if_needed(path: &str, content: &str) -> Result<bool> {
+    if !needs_write(path, content).await {
+        return Ok(false);
+    }
+    let tmp = format!(
+        "/tmp/archipelago-bootstrap-{}-{}.tmp",
+        std::process::id(),
+        Path::new(path)
+            .file_name()
+            .and_then(|n| n.to_str())
+            .unwrap_or("unit")
+    );
+    fs::write(&tmp, content)
+        .await
+        .with_context(|| format!("write tmp {}", tmp))?;
+    let status = host_sudo(&["mv", &tmp, path])
+        .await
+        .with_context(|| format!("sudo mv {} -> {}", tmp, path))?;
+    if !status.success() {
+        let _ = fs::remove_file(&tmp).await;
+        anyhow::bail!("sudo mv to {} exited with {}", path, status);
+    }
+    info!("Updated {}", path);
+    Ok(true)
+}
+
+async fn is_timer_enabled() -> bool {
+    tokio::process::Command::new("systemctl")
+        .args(["is-enabled", "--quiet", "archipelago-doctor.timer"])
+        .status()
+        .await
+        .map(|s| s.success())
+        .unwrap_or(false)
+}

core/archipelago/src/container/docker_packages.rs

@@ -247,6 +247,7 @@ impl DockerPackageScanner {
                     status: service_status,
                 }),
                 install_progress: None,
+                uninstall_stage: None,
             };
 
             packages.insert(app_id.clone(), package);

core/archipelago/src/container/registry.rs

@@ -44,19 +44,26 @@ impl Default for RegistryConfig {
         Self {
             registries: vec![
                 Registry {
-                    url: "git.tx1138.com/lfg2025".to_string(),
-                    name: "Archipelago Primary".to_string(),
-                    tls_verify: true,
+                    url: "23.182.128.160:3000/lfg2025".to_string(),
+                    name: "Server 1 (VPS)".to_string(),
+                    tls_verify: false,
                     enabled: true,
                     priority: 0,
                 },
                 Registry {
-                    url: "23.182.128.160:3000/lfg2025".to_string(),
-                    name: "Archipelago Fallback".to_string(),
-                    tls_verify: false,
+                    url: "git.tx1138.com/lfg2025".to_string(),
+                    name: "Server 2 (tx1138)".to_string(),
+                    tls_verify: true,
                     enabled: true,
                     priority: 10,
                 },
+                Registry {
+                    url: "146.59.87.168:3000/lfg2025".to_string(),
+                    name: "Server 3 (OVH)".to_string(),
+                    tls_verify: false,
+                    enabled: true,
+                    priority: 20,
+                },
             ],
         }
     }
@@ -80,20 +87,6 @@ impl RegistryConfig {
         format!("{}/{}", registry.url, image_name)
     }
 
-    /// Generate fallback image URLs to try (excludes the original since it already failed).
-    pub fn image_candidates(&self, image: &str) -> Vec<(String, bool)> {
-        let mut candidates = Vec::new();
-
-        // Rewrite for each active registry (skip if identical to original)
-        for reg in self.active_registries() {
-            let rewritten = self.rewrite_image(image, reg);
-            if rewritten != image {
-                candidates.push((rewritten, reg.tls_verify));
-            }
-        }
-
-        candidates
-    }
 }
 
 /// Extract the image name from a full image reference.
@@ -104,7 +97,12 @@ fn extract_image_name(image: &str) -> &str {
     image.rsplit('/').next().unwrap_or(image)
 }
 
-/// Load registry config from disk.
+/// Load registry config from disk, merging in any default registries
+/// that the operator hasn't explicitly removed. This lets us roll out
+/// new default mirrors (e.g. a new Server 3) to existing nodes without
+/// them having to edit their saved config. Explicit removals stick —
+/// if the URL is absent from disk AND absent from current defaults, it
+/// stays gone.
 pub async fn load_registries(data_dir: &Path) -> Result<RegistryConfig> {
     let path = data_dir.join(REGISTRY_FILE);
     if !path.exists() {
@@ -113,8 +111,34 @@ pub async fn load_registries(data_dir: &Path) -> Result<RegistryConfig> {
     let content = fs::read_to_string(&path)
         .await
         .context("Failed to read registry config")?;
-    let config: RegistryConfig =
+    let mut config: RegistryConfig =
         serde_json::from_str(&content).unwrap_or_else(|_| RegistryConfig::default());
+
+    // Migrate: any default registry URL that isn't already in the
+    // saved list gets appended at the end (so existing priority order
+    // is preserved for anything the operator already configured).
+    let defaults = RegistryConfig::default();
+    let known: std::collections::HashSet<String> =
+        config.registries.iter().map(|r| r.url.clone()).collect();
+    let max_priority = config
+        .registries
+        .iter()
+        .map(|r| r.priority)
+        .max()
+        .unwrap_or(0);
+    let mut added = false;
+    for (i, def) in defaults.registries.iter().enumerate() {
+        if !known.contains(&def.url) {
+            let mut cloned = def.clone();
+            cloned.priority = max_priority.saturating_add(10 + i as u32);
+            config.registries.push(cloned);
+            added = true;
+        }
+    }
+    if added {
+        // Persist so the next load doesn't have to re-merge.
+        let _ = save_registries(data_dir, &config).await;
+    }
     Ok(config)
 }
 
@@ -133,69 +157,6 @@ pub async fn save_registries(data_dir: &Path, config: &RegistryConfig) -> Result
     Ok(())
 }
 
-/// Try pulling an image from configured registries in priority order.
-/// Returns the image reference that succeeded.
-pub async fn pull_from_registries(data_dir: &Path, image: &str, tmpdir: &str) -> Result<String> {
-    let config = load_registries(data_dir).await?;
-    let candidates = config.image_candidates(image);
-
-    for (candidate, tls_verify) in &candidates {
-        debug!("Trying registry: {}", candidate);
-
-        let mut args = vec!["pull".to_string(), candidate.clone()];
-        if !tls_verify {
-            args.push("--tls-verify=false".to_string());
-        }
-
-        let mut child = tokio::process::Command::new("podman")
-            .args(&args)
-            .env("TMPDIR", tmpdir)
-            .stdout(std::process::Stdio::null())
-            .stderr(std::process::Stdio::null())
-            .spawn()
-            .ok();
-
-        let status = if let Some(ref mut c) = child {
-            match tokio::time::timeout(std::time::Duration::from_secs(120), c.wait()).await {
-                Ok(Ok(s)) => Some(s.success()),
-                _ => {
-                    let _ = c.kill().await;
-                    let _ = c.wait().await;
-                    debug!("Fallback pull timed out: {}", candidate);
-                    None
-                }
-            }
-        } else {
-            None
-        };
-
-        if status == Some(true) {
-            // If we pulled from a non-original registry, tag it with the original name
-            if candidate != image {
-                let _ = tokio::process::Command::new("podman")
-                    .args(["tag", candidate, image])
-                    .status()
-                    .await;
-                info!(
-                    "Pulled {} from fallback registry, tagged as {}",
-                    candidate, image
-                );
-            } else {
-                info!("Pulled {} from primary registry", image);
-            }
-            return Ok(candidate.clone());
-        }
-
-        debug!("Failed to pull from {}", candidate);
-    }
-
-    Err(anyhow::anyhow!(
-        "Failed to pull {} from all {} configured registries",
-        image,
-        candidates.len()
-    ))
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -217,34 +178,29 @@ mod tests {
     #[test]
     fn test_rewrite_image() {
         let config = RegistryConfig::default();
-        let fallback = &config.registries[1];
+        // Default primary is now VPS (index 0). A tx1138-hardcoded image
+        // rewrites to VPS when asked for the primary mirror.
+        let primary = &config.registries[0];
         assert_eq!(
-            config.rewrite_image("git.tx1138.com/lfg2025/bitcoin-knots:latest", fallback),
+            config.rewrite_image("git.tx1138.com/lfg2025/bitcoin-knots:latest", primary),
             "23.182.128.160:3000/lfg2025/bitcoin-knots:latest"
         );
     }
 
-    #[test]
-    fn test_image_candidates() {
-        let config = RegistryConfig::default();
-        let candidates = config.image_candidates("git.tx1138.com/lfg2025/lnd:v0.18.4-beta");
-        assert!(candidates.len() >= 2);
-        assert_eq!(candidates[0].0, "git.tx1138.com/lfg2025/lnd:v0.18.4-beta");
-    }
-
     #[test]
     fn test_active_registries_sorted() {
         let config = RegistryConfig::default();
         let active = config.active_registries();
-        assert_eq!(active.len(), 2);
+        assert_eq!(active.len(), 3);
         assert!(active[0].priority <= active[1].priority);
+        assert!(active[1].priority <= active[2].priority);
     }
 
     #[tokio::test]
     async fn test_load_default() {
         let tmp = TempDir::new().unwrap();
         let config = load_registries(tmp.path()).await.unwrap();
-        assert_eq!(config.registries.len(), 2);
+        assert_eq!(config.registries.len(), 3);
     }
 
     #[tokio::test]
@@ -260,6 +216,6 @@ mod tests {
         });
         save_registries(tmp.path(), &config).await.unwrap();
         let loaded = load_registries(tmp.path()).await.unwrap();
-        assert_eq!(loaded.registries.len(), 3);
+        assert_eq!(loaded.registries.len(), 4);
     }
 }

core/archipelago/src/data_model.rs

@@ -138,6 +138,13 @@ pub struct PackageDataEntry {
     pub installed: Option<InstalledPackageDataEntry>,
     #[serde(rename = "install-progress")]
     pub install_progress: Option<InstallProgress>,
+    /// Live label describing the current uninstall step ("Stopping
+    /// containers (2/5)", "Removing data", …). Set by the uninstall
+    /// pipeline so the UI can show real progress instead of a generic
+    /// "Uninstalling…" spinner. Cleared after the package entry is
+    /// removed.
+    #[serde(rename = "uninstall-stage", skip_serializing_if = "Option::is_none", default)]
+    pub uninstall_stage: Option<String>,
     /// Pinned image version from image-versions.sh when it differs from running version
     #[serde(rename = "available-update", skip_serializing_if = "Option::is_none")]
     pub available_update: Option<String>,

core/archipelago/src/identity_manager.rs

@@ -216,6 +216,80 @@ impl IdentityManager {
         Ok(record)
     }
 
+    /// Mirror an existing Ed25519 signing key as a manager-level identity.
+    ///
+    /// Used at boot to expose the node's own seed-derived key (the one that
+    /// backs `server_info.pubkey` and peer-to-peer connections) as an
+    /// entry in the Identities page, so all three surfaces — DID Status,
+    /// "Node" entry on Identities, and peer-connect DID — resolve to the
+    /// same DID. The id is deterministic (`node-<pubkey16>`), so repeated
+    /// calls on the same key are idempotent: if the file already exists
+    /// we return the existing record untouched.
+    pub async fn create_from_signing_key(
+        &self,
+        name: String,
+        purpose: IdentityPurpose,
+        signing_key: SigningKey,
+    ) -> Result<IdentityRecord> {
+        let pubkey_hex = hex::encode(signing_key.verifying_key().as_bytes());
+        let did = did_key_from_pubkey_hex(&pubkey_hex)?;
+        let id = format!("node-{}", &pubkey_hex[..16]);
+
+        // Idempotent: if we already mirrored this key, just return it.
+        let file_path = self.identities_dir.join(format!("{}.json", id));
+        if file_path.exists() {
+            return self.get(&id).await;
+        }
+
+        let created_at = chrono::Utc::now().to_rfc3339();
+        // Mark as the node (master) identity so it gets the hex SVG.
+        let default_profile = IdentityProfile {
+            picture: Some(crate::avatar::default_picture(&pubkey_hex, true)),
+            ..Default::default()
+        };
+
+        let identity_file = IdentityFile {
+            id: id.clone(),
+            name: name.clone(),
+            purpose: purpose.clone(),
+            secret_key: signing_key.to_bytes().to_vec(),
+            pubkey_hex: pubkey_hex.clone(),
+            did: did.clone(),
+            created_at,
+            nostr_secret_hex: None,
+            nostr_pubkey_hex: None,
+            profile: Some(default_profile),
+            derivation_index: Some(0),
+        };
+
+        let json = serde_json::to_string_pretty(&identity_file)
+            .context("Failed to serialize identity")?;
+        fs::write(&file_path, json.as_bytes())
+            .await
+            .context("Failed to write identity file")?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            fs::set_permissions(&file_path, std::fs::Permissions::from_mode(0o600))
+                .await
+                .context("Failed to set identity file permissions")?;
+        }
+
+        // First identity becomes the default.
+        let (existing, _) = self.list().await?;
+        if existing.len() <= 1 {
+            self.set_default(&id).await?;
+        }
+
+        tracing::info!(
+            "Mirrored node signing key as Node identity '{}' ({})",
+            name,
+            purpose
+        );
+
+        self.get(&id).await
+    }
+
     /// Create a new identity with keys derived from a BIP-39 master seed.
     /// The derivation index is auto-incremented and persisted.
     pub async fn create_from_seed(

core/archipelago/src/main.rs

@@ -28,6 +28,7 @@ mod avatar;
 mod backup;
 mod bitcoin_rpc;
 mod blobs;
+mod bootstrap;
 mod config;
 mod constants;
 mod container;
@@ -171,6 +172,11 @@ async fn main() -> Result<()> {
         update::run_update_scheduler(update_data_dir).await;
     });
 
+    // Synchronize host-side doctor artifacts (script + systemd units) with
+    // what's embedded in this binary. Runs in the background so it never
+    // delays server readiness; best-effort, warnings only.
+    tokio::spawn(bootstrap::ensure_doctor_installed());
+
     // Spawn periodic container snapshot (for crash recovery)
     crash_recovery::spawn_snapshot_task(config.data_dir.clone());
 
@@ -229,5 +235,14 @@ async fn main() -> Result<()> {
     crash_recovery::remove_pid_marker(&config.data_dir).await;
 
     info!("Archipelago shut down cleanly");
-    Ok(())
+
+    // Hard-exit after logging. All business state is persisted by now
+    // (connections drained, PID marker removed, disk flushes done via
+    // tokio::fs awaits). Letting tokio try to drop the runtime instead
+    // can stall for 15s+ on non-daemon OS threads we don't directly
+    // own (mdns_sd daemon, reqwest resolver pool, etc.) — long enough
+    // for systemd's TimeoutStopSec to SIGKILL us and mark the service
+    // Failed, which makes an otherwise-successful update look like a
+    // crash in `systemctl status`.
+    std::process::exit(0);
 }

core/archipelago/src/server.rs

@@ -89,22 +89,32 @@ impl Server {
         // Load persisted messages (Archipelago channel)
         node_message::init(&config.data_dir).await;
 
-        // Auto-create default identity if none exist (fresh boot or factory reset)
+        // Auto-create the Node identity on fresh boot, mirroring the node's
+        // own signing key (seed-derived when onboarded, random otherwise).
+        // This keeps the DID shown on the Identities page, the DID Status
+        // card, and the DID used for peer-to-peer connects all aligned on
+        // one value — the seed-derived node DID. Idempotent: if the entry
+        // already exists from a prior boot, create_from_signing_key returns
+        // the existing record unchanged.
         {
             let im = crate::identity_manager::IdentityManager::new(&config.data_dir).await;
             if let Ok(mgr) = im {
                 if let Ok((list, _)) = mgr.list().await {
                     if list.is_empty() {
+                        let signing_key = ed25519_dalek::SigningKey::from_bytes(
+                            &identity.signing_key().to_bytes(),
+                        );
                         match mgr
-                            .create(
-                                "Default".to_string(),
+                            .create_from_signing_key(
+                                "Node".to_string(),
                                 crate::identity_manager::IdentityPurpose::Personal,
+                                signing_key,
                             )
                             .await
                         {
                             Ok(record) => {
                                 let _ = mgr.create_nostr_key(&record.id).await;
-                                tracing::info!(did = %record.did, "Auto-created default identity with Nostr key");
+                                tracing::info!(did = %record.did, "Auto-created Node identity mirroring node key");
                             }
                             Err(e) => tracing::debug!("Auto-identity creation (non-fatal): {}", e),
                         }

core/archipelago/src/transport/lan.rs

@@ -160,6 +160,18 @@ impl LanTransport {
     }
 }
 
+impl Drop for LanTransport {
+    // The mdns_sd daemon runs on its own OS thread and the browse
+    // listener task blocks on a sync channel. Without this call both
+    // keep the process alive past SIGTERM, long enough for systemd to
+    // SIGKILL us — which makes a normal update look like a crash.
+    fn drop(&mut self) {
+        if let Some(daemon) = self.daemon.take() {
+            let _ = daemon.shutdown();
+        }
+    }
+}
+
 impl NodeTransport for LanTransport {
     fn kind(&self) -> TransportKind {
         TransportKind::Lan

core/archipelago/src/update.rs

@@ -68,6 +68,10 @@ const DEFAULT_UPDATE_MANIFEST_URL: &str =
 /// is slow or unreachable.
 const DEFAULT_SECONDARY_MIRROR_URL: &str =
     "http://23.182.128.160:3000/lfg2025/archy/raw/branch/main/releases/manifest.json";
+/// Tertiary mirror on a separate OVH VPS — independent network path so
+/// a single-provider outage doesn't knock out all three mirrors.
+const DEFAULT_TERTIARY_MIRROR_URL: &str =
+    "http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json";
 const UPDATE_STATE_FILE: &str = "update_state.json";
 const UPDATE_MIRRORS_FILE: &str = "update-mirrors.json";
 
@@ -97,13 +101,24 @@ fn default_mirrors() -> Vec<UpdateMirror> {
             url: DEFAULT_UPDATE_MANIFEST_URL.to_string(),
             label: "Server 2 (tx1138)".to_string(),
         },
+        UpdateMirror {
+            url: DEFAULT_TERTIARY_MIRROR_URL.to_string(),
+            label: "Server 3 (OVH)".to_string(),
+        },
     ]
 }
 
 /// Load the operator-configured mirror list. Returns defaults if the
 /// file doesn't exist yet, so a node OTA'd from a pre-mirrors release
-/// starts with both Server 1 and Server 2 available without any manual
-/// config.
+/// starts with the current default mirrors available without any
+/// manual config.
+///
+/// Migration: any default mirror URL that isn't already in the saved
+/// list gets appended at the end. This lets us add new default mirrors
+/// (e.g. a new Server 3) and have them appear on existing nodes after
+/// an update, without requiring manual config edits. Explicit removals
+/// stick — once an operator removes a URL it stays gone unless it's
+/// later re-added to defaults.
 pub async fn load_mirrors(data_dir: &Path) -> Result<Vec<UpdateMirror>> {
     let path = mirrors_path(data_dir);
     if !path.exists() {
@@ -112,13 +127,27 @@ pub async fn load_mirrors(data_dir: &Path) -> Result<Vec<UpdateMirror>> {
     let bytes = fs::read(&path)
         .await
         .with_context(|| format!("read {}", path.display()))?;
-    let list: Vec<UpdateMirror> =
+    let mut list: Vec<UpdateMirror> =
         serde_json::from_slice(&bytes).with_context(|| format!("parse {}", path.display()))?;
     if list.is_empty() {
-        Ok(default_mirrors())
-    } else {
-        Ok(list)
+        return Ok(default_mirrors());
     }
+
+    // Merge in any default URLs the saved config is missing.
+    let known: std::collections::HashSet<String> =
+        list.iter().map(|m| m.url.clone()).collect();
+    let defaults = default_mirrors();
+    let mut added = false;
+    for def in &defaults {
+        if !known.contains(&def.url) {
+            list.push(def.clone());
+            added = true;
+        }
+    }
+    if added {
+        let _ = save_mirrors(data_dir, &list).await;
+    }
+    Ok(list)
 }
 
 pub async fn save_mirrors(data_dir: &Path, mirrors: &[UpdateMirror]) -> Result<()> {
@@ -763,7 +792,7 @@ pub async fn cancel_download(data_dir: &Path) -> Result<()> {
 /// though sudo itself is root. `systemd-run --wait` spawns a transient
 /// service unit that inherits systemd's default protections (i.e. none
 /// of ours), escaping the namespace.
-async fn host_sudo(args: &[&str]) -> Result<std::process::ExitStatus> {
+pub(crate) async fn host_sudo(args: &[&str]) -> Result<std::process::ExitStatus> {
     let mut full: Vec<&str> = vec![
         "systemd-run",
         "--wait",
@@ -1187,9 +1216,10 @@ mod tests {
     async fn test_load_mirrors_returns_defaults_when_absent() {
         let dir = tempfile::tempdir().unwrap();
         let list = load_mirrors(dir.path()).await.unwrap();
-        assert_eq!(list.len(), 2);
-        assert!(list[0].url.contains("git.tx1138.com"));
-        assert!(list[1].url.contains("23.182.128.160"));
+        assert_eq!(list.len(), 3);
+        assert!(list[0].url.contains("23.182.128.160"));
+        assert!(list[1].url.contains("git.tx1138.com"));
+        assert!(list[2].url.contains("146.59.87.168"));
     }
 
     #[tokio::test]

neode-ui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "neode-ui",
-  "version": "1.6.0-alpha",
+  "version": "1.7.36-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.6.0-alpha",
+      "version": "1.7.36-alpha",
       "dependencies": {
         "@types/dompurify": "^3.0.5",
         "@vue-leaflet/vue-leaflet": "^0.10.1",

neode-ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "neode-ui",
   "private": true,
-  "version": "1.6.0-alpha",
+  "version": "1.7.36-alpha",
   "type": "module",
   "scripts": {
     "start": "./start-dev.sh",

neode-ui/public/catalog.json

@@ -22,6 +22,18 @@
       "category": "money",
       "tier": "core"
     },
+    {
+      "id": "bitcoin-core",
+      "title": "Bitcoin Core",
+      "version": "28.4",
+      "description": "Reference implementation of the Bitcoin protocol. Run a full node validating and relaying blocks on the Bitcoin network.",
+      "icon": "/assets/img/app-icons/bitcoin-core.svg",
+      "author": "Bitcoin Core contributors",
+      "dockerImage": "bitcoin/bitcoin:28.4",
+      "repoUrl": "https://github.com/bitcoin/bitcoin",
+      "category": "money",
+      "tier": "optional"
+    },
     {
       "id": "lnd",
       "title": "LND",

neode-ui/src/composables/useOnboarding.ts

@@ -19,11 +19,24 @@ async function callWithRetry<T>(fn: () => Promise<T>, maxRetries = 3): Promise<T
 }
 
 export async function isOnboardingComplete(): Promise<boolean> {
-  // localStorage is set on completion and survives backend restarts/resets
-  if (localStorage.getItem('neode_onboarding_complete') === '1') return true
+  // Prefer the backend — localStorage gets stale across nodes (a
+  // browser that onboarded node A would otherwise treat fresh node B
+  // as already-onboarded and skip the wizard entirely). Only fall
+  // back to localStorage if the backend is unreachable.
   const result = await callWithRetry(() => rpcClient.isOnboardingComplete(), 2)
-  if (result !== null) return result
-  return false
+  if (result !== null) {
+    // Re-seed the localStorage cache so non-async consumers
+    // (OnboardingWrapper's useVideoBackground computed, etc.) see the
+    // right answer after the user clears site data on an already-
+    // onboarded node.
+    if (result) {
+      try { localStorage.setItem('neode_onboarding_complete', '1') } catch {}
+    } else {
+      try { localStorage.removeItem('neode_onboarding_complete') } catch {}
+    }
+    return result
+  }
+  return localStorage.getItem('neode_onboarding_complete') === '1'
 }
 
 export async function completeOnboarding(): Promise<void> {

neode-ui/src/locales/en.json

@@ -19,6 +19,8 @@
     "launch": "Launch",
     "starting": "Starting...",
     "stopping": "Stopping...",
+    "update": "Update",
+    "updating": "Updating...",
     "send": "Send",
     "sending": "Sending...",
     "back": "Back",

neode-ui/src/locales/es.json

@@ -19,6 +19,8 @@
     "launch": "Abrir",
     "starting": "Iniciando...",
     "stopping": "Deteniendo...",
+    "update": "Actualizar",
+    "updating": "Actualizando...",
     "send": "Enviar",
     "sending": "Enviando...",
     "back": "Volver",

neode-ui/src/router/index.ts

@@ -193,6 +193,11 @@ const router = createRouter({
           name: 'system-update',
           component: () => import('../views/SystemUpdate.vue'),
         },
+        {
+          path: 'settings/registries',
+          name: 'app-registries',
+          component: () => import('../views/AppRegistries.vue'),
+        },
         {
           path: 'goals/:goalId',
           name: 'goal-detail',

neode-ui/src/stores/__tests__/loginTransition.test.ts

@@ -10,10 +10,19 @@ describe('useLoginTransitionStore', () => {
   it('starts with all flags false', () => {
     const store = useLoginTransitionStore()
     expect(store.justLoggedIn).toBe(false)
+    expect(store.justCompletedOnboarding).toBe(false)
     expect(store.pendingWelcomeTyping).toBe(false)
     expect(store.startWelcomeTyping).toBe(false)
   })
 
+  it('setJustCompletedOnboarding updates justCompletedOnboarding', () => {
+    const store = useLoginTransitionStore()
+    store.setJustCompletedOnboarding(true)
+    expect(store.justCompletedOnboarding).toBe(true)
+    store.setJustCompletedOnboarding(false)
+    expect(store.justCompletedOnboarding).toBe(false)
+  })
+
   it('setJustLoggedIn updates justLoggedIn', () => {
     const store = useLoginTransitionStore()
     store.setJustLoggedIn(true)

neode-ui/src/stores/loginTransition.ts

@@ -4,6 +4,13 @@ import { ref } from 'vue'
 /** Signals that we just logged in - Dashboard uses this for zoom + oomph */
 export const useLoginTransitionStore = defineStore('loginTransition', () => {
   const justLoggedIn = ref(false)
+  /**
+   * True only when the user just finished the onboarding wizard
+   * (first password setup), as distinct from a regular re-login.
+   * Dashboard uses this to decide whether to play the full glitchy
+   * reveal vs just a quick interface-draw.
+   */
+  const justCompletedOnboarding = ref(false)
   /** Show empty welcome block until typing starts (hide static text) */
   const pendingWelcomeTyping = ref(false)
   /** Trigger welcome typing on Home - set true after dashboard animation finishes */
@@ -13,6 +20,10 @@ export const useLoginTransitionStore = defineStore('loginTransition', () => {
     justLoggedIn.value = value
   }
 
+  function setJustCompletedOnboarding(value: boolean) {
+    justCompletedOnboarding.value = value
+  }
+
   function setPendingWelcomeTyping(value: boolean) {
     pendingWelcomeTyping.value = value
   }
@@ -24,6 +35,8 @@ export const useLoginTransitionStore = defineStore('loginTransition', () => {
   return {
     justLoggedIn,
     setJustLoggedIn,
+    justCompletedOnboarding,
+    setJustCompletedOnboarding,
     pendingWelcomeTyping,
     setPendingWelcomeTyping,
     startWelcomeTyping,

neode-ui/src/types/api.ts

@@ -91,6 +91,8 @@ export interface PackageDataEntry {
   manifest: Manifest
   installed?: InstalledPackageDataEntry
   'install-progress'?: InstallProgress
+  /** Live label for the current uninstall step ("Stopping containers (2/5)", …). */
+  'uninstall-stage'?: string | null
   'available-update'?: string | null
 }
 

neode-ui/src/views/AppRegistries.vue

@@ -0,0 +1,330 @@
+<template>
+  <div class="pb-6">
+    <div class="mb-6">
+      <h1 class="text-3xl font-bold text-white mb-2">App registries</h1>
+      <p class="text-white/70">
+        Container registries this node pulls app images from. The primary is tried first; if it's
+        slow or unreachable, the next one in the list is tried automatically.
+      </p>
+    </div>
+
+    <!-- Status message -->
+    <div
+      v-if="statusMessage"
+      class="mb-4 p-3 rounded-lg text-sm"
+      :class="statusIsError ? 'bg-red-500/20 text-red-300' : 'bg-green-500/20 text-green-300'"
+    >
+      {{ statusMessage }}
+    </div>
+
+    <!-- Registry list -->
+    <div class="glass-card p-6 mb-6">
+      <div class="flex items-start justify-between gap-4 mb-2">
+        <h2 class="text-lg font-semibold text-white">Registries</h2>
+        <button
+          type="button"
+          class="text-xs px-3 py-1.5 rounded-md bg-white/5 hover:bg-white/10 text-white/70 hover:text-white transition-colors"
+          @click="openAddRegistry"
+        >+ Add registry</button>
+      </div>
+      <p class="text-sm text-white/60 mb-4">
+        Registries are tried in priority order on every app install. Changing the primary takes
+        effect on the next install — existing containers keep running on whatever image they
+        already pulled.
+      </p>
+      <ul v-if="registries.length" class="space-y-2">
+        <li
+          v-for="r in sortedRegistries"
+          :key="r.url"
+          class="p-3 bg-white/5 rounded-lg"
+        >
+          <div class="flex items-start gap-3">
+            <div class="flex-1 min-w-0">
+              <div class="flex items-center gap-2 mb-0.5 flex-wrap">
+                <p class="text-sm font-medium text-white truncate">{{ r.name || r.url }}</p>
+                <span
+                  v-if="r.priority === 0"
+                  class="text-[10px] font-mono px-2 py-0.5 rounded bg-green-500/20 text-green-300"
+                >PRIMARY</span>
+                <span
+                  v-if="!r.tls_verify"
+                  class="text-[10px] font-mono px-2 py-0.5 rounded bg-amber-500/20 text-amber-300"
+                  title="TLS verification disabled — HTTP or self-signed registry"
+                >HTTP</span>
+              </div>
+              <p class="text-xs text-white/50 font-mono break-all">{{ r.url }}</p>
+            </div>
+            <div class="shrink-0 flex items-center gap-1">
+              <button
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-white hover:bg-white/10 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+                :disabled="registryTests[r.url]?.testing"
+                title="Test reachability"
+                @click="testRegistry(r)"
+              >
+                <svg v-if="registryTests[r.url]?.testing" class="w-4 h-4 animate-spin" fill="none" viewBox="0 0 24 24">
+                  <circle cx="12" cy="12" r="10" stroke="currentColor" stroke-width="3" stroke-opacity="0.25"></circle>
+                  <path fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"></path>
+                </svg>
+                <svg v-else class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z" />
+                </svg>
+              </button>
+              <button
+                v-if="r.priority !== 0"
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-yellow-300 hover:bg-white/10 transition-colors"
+                title="Make primary"
+                @click="setPrimary(r.url)"
+              >
+                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11.049 2.927c.3-.921 1.603-.921 1.902 0l1.519 4.674a1 1 0 00.95.69h4.915c.969 0 1.371 1.24.588 1.81l-3.976 2.888a1 1 0 00-.363 1.118l1.518 4.674c.3.922-.755 1.688-1.538 1.118l-3.976-2.888a1 1 0 00-1.176 0l-3.976 2.888c-.783.57-1.838-.197-1.538-1.118l1.518-4.674a1 1 0 00-.363-1.118l-3.976-2.888c-.784-.57-.38-1.81.588-1.81h4.914a1 1 0 00.951-.69l1.519-4.674z" />
+                </svg>
+              </button>
+              <button
+                v-if="registries.length > 1"
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-red-300 hover:bg-red-400/10 transition-colors"
+                title="Remove registry"
+                @click="removeRegistry(r.url)"
+              >
+                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" />
+                </svg>
+              </button>
+            </div>
+          </div>
+          <div
+            v-if="registryTests[r.url] && !registryTests[r.url]?.testing"
+            class="mt-2 pt-2 border-t border-white/5 text-xs"
+          >
+            <span v-if="registryTests[r.url]?.reachable" class="inline-flex items-center gap-1.5 text-green-300">
+              <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="3" d="M5 13l4 4L19 7" />
+              </svg>
+              Reachable (HTTP {{ registryTests[r.url]?.status }})
+            </span>
+            <span v-else class="inline-flex items-center gap-1.5 text-red-300">
+              <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="3" d="M6 18L18 6M6 6l12 12" />
+              </svg>
+              <span class="truncate">{{ registryTests[r.url]?.error || 'Unreachable' }}</span>
+            </span>
+          </div>
+        </li>
+      </ul>
+    </div>
+
+    <!-- Back link -->
+    <RouterLink
+      to="/dashboard/settings"
+      class="glass-button rounded-lg px-5 py-2 text-sm font-medium inline-flex items-center gap-2"
+    >
+      <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 19l-7-7 7-7" />
+      </svg>
+      Back to Settings
+    </RouterLink>
+
+    <!-- Add-registry modal -->
+    <Teleport to="body">
+      <Transition name="fade">
+        <div
+          v-if="addingRegistry"
+          class="fixed inset-0 z-50 flex items-center justify-center bg-black/10 backdrop-blur-md"
+          @click.self="cancelAddRegistry"
+        >
+          <div class="glass-card p-6 max-w-md w-full mx-4">
+            <h3 class="text-lg font-semibold text-white mb-1">Add app registry</h3>
+            <p class="text-sm text-white/60 mb-5">
+              The URL should be of the form <span class="font-mono text-white/80">host[:port]/namespace</span>
+              — for example <span class="font-mono text-white/80">ghcr.io/myorg</span> or
+              <span class="font-mono text-white/80">192.168.1.50:3000/apps</span>. Registries are
+              added to the end of the list; use "Make primary" to reorder.
+            </p>
+            <form class="space-y-3" @submit.prevent="submitRegistry">
+              <div>
+                <label class="block text-xs text-white/60 mb-1">Name</label>
+                <input
+                  v-model="registryDraft.name"
+                  type="text"
+                  placeholder="My private registry"
+                  class="w-full px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none"
+                />
+              </div>
+              <div>
+                <label class="block text-xs text-white/60 mb-1">Registry URL</label>
+                <input
+                  v-model="registryDraft.url"
+                  type="text"
+                  autofocus
+                  placeholder="host:port/namespace"
+                  class="w-full px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none font-mono"
+                />
+              </div>
+              <label class="flex items-center gap-2 cursor-pointer text-sm text-white/80">
+                <input
+                  v-model="registryDraft.tls_verify"
+                  type="checkbox"
+                  class="accent-orange-400"
+                />
+                Verify TLS certificate (uncheck for HTTP or self-signed)
+              </label>
+              <div class="flex gap-3 justify-end pt-2">
+                <button
+                  type="button"
+                  @click="cancelAddRegistry"
+                  class="glass-button rounded-lg px-4 py-2 text-sm font-medium"
+                >Cancel</button>
+                <button
+                  type="submit"
+                  class="glass-button rounded-lg px-4 py-2 text-sm font-medium bg-orange-500/20 border-orange-400/30 disabled:opacity-50 disabled:cursor-not-allowed"
+                  :disabled="registrySaving || !registryDraft.url.trim()"
+                >{{ registrySaving ? 'Adding…' : 'Add registry' }}</button>
+              </div>
+            </form>
+          </div>
+        </div>
+      </Transition>
+    </Teleport>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, computed, onMounted, reactive } from 'vue'
+import { RouterLink } from 'vue-router'
+import { rpcClient } from '@/api/rpc-client'
+
+interface Registry {
+  url: string
+  name: string
+  tls_verify: boolean
+  enabled: boolean
+  priority: number
+}
+
+interface RegistryTestState {
+  testing?: boolean
+  reachable?: boolean
+  status?: number | null
+  error?: string | null
+}
+
+const registries = ref<Registry[]>([])
+const sortedRegistries = computed(() =>
+  [...registries.value].sort((a, b) => a.priority - b.priority)
+)
+const registryTests = ref<Record<string, RegistryTestState>>({})
+const statusMessage = ref('')
+const statusIsError = ref(false)
+
+const addingRegistry = ref(false)
+const registrySaving = ref(false)
+const registryDraft = reactive({ url: '', name: '', tls_verify: true })
+
+function showStatus(msg: string, isError = false) {
+  statusMessage.value = msg
+  statusIsError.value = isError
+  setTimeout(() => { statusMessage.value = '' }, 8000)
+}
+
+async function loadRegistries() {
+  try {
+    const res = await rpcClient.call<{ registries: Registry[] }>({ method: 'registry.list' })
+    registries.value = res.registries
+  } catch (e) {
+    if (import.meta.env.DEV) console.warn('registry.list failed', e)
+  }
+}
+
+function openAddRegistry() {
+  registryDraft.url = ''
+  registryDraft.name = ''
+  registryDraft.tls_verify = true
+  addingRegistry.value = true
+}
+function cancelAddRegistry() {
+  addingRegistry.value = false
+}
+
+async function submitRegistry() {
+  const url = registryDraft.url.trim()
+  if (!url) return
+  registrySaving.value = true
+  try {
+    const res = await rpcClient.call<{ registries: Registry[] }>({
+      method: 'registry.add',
+      params: {
+        url,
+        name: registryDraft.name.trim() || url,
+        tls_verify: registryDraft.tls_verify,
+      },
+    })
+    registries.value = res.registries
+    addingRegistry.value = false
+    showStatus('Registry added.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Add registry failed: ${msg}`, true)
+  } finally {
+    registrySaving.value = false
+  }
+}
+
+async function removeRegistry(url: string) {
+  try {
+    const res = await rpcClient.call<{ registries: Registry[] }>({
+      method: 'registry.remove',
+      params: { url },
+    })
+    registries.value = res.registries
+    showStatus('Registry removed.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Remove failed: ${msg}`, true)
+  }
+}
+
+async function setPrimary(url: string) {
+  try {
+    const res = await rpcClient.call<{ registries: Registry[] }>({
+      method: 'registry.set-primary',
+      params: { url },
+    })
+    registries.value = res.registries
+    showStatus('Primary registry updated. Next install will try it first.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Set primary failed: ${msg}`, true)
+  }
+}
+
+async function testRegistry(r: Registry) {
+  registryTests.value = { ...registryTests.value, [r.url]: { testing: true } }
+  try {
+    const res = await rpcClient.call<{
+      url: string
+      reachable: boolean
+      status: number | null
+      error?: string | null
+    }>({ method: 'registry.test', params: { url: r.url, tls_verify: r.tls_verify } })
+    registryTests.value = {
+      ...registryTests.value,
+      [r.url]: {
+        testing: false,
+        reachable: res.reachable,
+        status: res.status,
+        error: res.error ?? null,
+      },
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    registryTests.value = {
+      ...registryTests.value,
+      [r.url]: { testing: false, reachable: false, error: msg },
+    }
+  }
+}
+
+onMounted(() => { void loadRegistries() })
+</script>

neode-ui/src/views/Apps.vue

@@ -117,6 +117,7 @@
         @start="actions.startApp"
         @stop="actions.stopApp"
         @restart="actions.restartApp"
+        @update="updateApp"
         @show-uninstall="showUninstallModal"
       />
     </div>
@@ -282,6 +283,9 @@ function closeUninstallModal() {
 
 async function onConfirmUninstall() {
   const { appId } = uninstallModal.value
+  // Close the modal immediately so the user can fire off concurrent
+  // uninstalls. Each AppCard surfaces its own live stage label while
+  // its uninstall is in flight.
   uninstallModal.value.show = false
   await actions.confirmUninstall(appId)
 }
@@ -293,4 +297,12 @@ function goToApp(id: string) {
 function launchApp(id: string) {
   useAppLauncherStore().openSession(id)
 }
+
+async function updateApp(id: string) {
+  try {
+    await serverStore.updatePackage(id)
+  } catch (err) {
+    actions.actionError.value = `Failed to update ${id}: ${err instanceof Error ? err.message : 'Unknown error'}`
+  }
+}
 </script>

neode-ui/src/views/Dashboard.vue

@@ -264,10 +264,13 @@ watch(() => route.path, (newPath) => {
 onMounted(() => {
   previousRoutePath = route.path
   document.body.classList.add('dashboard-active')
-  if (loginTransition.justLoggedIn) {
+  if (loginTransition.justCompletedOnboarding) {
+    // Full glitchy reveal — only on the very first dashboard entry
+    // right after onboarding (one-time event, persists in feel).
     playDashboardLoadOomph()
     showZoomIn.value = true
     loginTransition.setPendingWelcomeTyping(true)
+    loginTransition.setJustCompletedOnboarding(false)
     loginTransition.setJustLoggedIn(false)
     const triggerRevealGlitch = () => {
       isGlitching.value = true
@@ -281,6 +284,16 @@ onMounted(() => {
       loginTransition.setStartWelcomeTyping(true)
       loginTransition.setPendingWelcomeTyping(false)
     }, 4000)
+  } else if (loginTransition.justLoggedIn) {
+    // Regular re-login — no zoom, no glitch. Just land on the
+    // dashboard and kick off the welcome typing quickly.
+    playDashboardLoadOomph()
+    loginTransition.setPendingWelcomeTyping(true)
+    loginTransition.setJustLoggedIn(false)
+    scheduledTimeout(() => {
+      loginTransition.setStartWelcomeTyping(true)
+      loginTransition.setPendingWelcomeTyping(false)
+    }, 300)
   }
 
   window.addEventListener('keydown', handleKioskShortcuts)

neode-ui/src/views/Login.vue

@@ -408,6 +408,7 @@ async function handleSetup() {
     stopSynthwave()
     whooshAway.value = true
     playLoginSuccessWhoosh()
+    loginTransition.setJustCompletedOnboarding(true)
     loginTransition.setJustLoggedIn(true)
     await new Promise(r => setTimeout(r, 520))
     await router.replace(loginRedirectTo.value).catch(() => {

neode-ui/src/views/OnboardingWrapper.vue

@@ -86,9 +86,23 @@ const videoBackgroundRoutes = ['/onboarding/intro', '/login']
 // Login uses video when coming from splash, or static + glitch when direct
 const isLoginRoute = computed(() => route.path === '/login')
 
+// True once onboarding is complete. Used to skip the intro video on
+// the /login route so that returning (logged-out) users go straight
+// to the screensaver-style static + glitch background instead of
+// replaying the full intro every time.
+const onboardingDone = computed(() => {
+  try {
+    return localStorage.getItem('neode_onboarding_complete') === '1'
+  } catch {
+    return false
+  }
+})
+
 // Check if current route should use video background
 const useVideoBackground = computed(() => {
-  return videoBackgroundRoutes.includes(route.path)
+  if (!videoBackgroundRoutes.includes(route.path)) return false
+  if (route.path === '/login' && onboardingDone.value) return false
+  return true
 })
 
 // Map each route to a specific background image
@@ -108,7 +122,32 @@ const routeBackgrounds: Record<string, string> = {
   '/login': 'bg-intro.jpg' // Video loops from splash (same as intro)
 }
 
-const loginBackground = 'bg-intro-1.jpg'
+// Rotate the login background so the lock screen doesn't look
+// identical on every logout. Cycles through bg-intro-1..6 using a
+// counter persisted to localStorage so subsequent visits advance.
+const LOGIN_BACKGROUNDS = [
+  'bg-intro-1.jpg',
+  'bg-intro-2.jpg',
+  'bg-intro-3.jpg',
+  'bg-intro-4.jpg',
+  'bg-intro-5.jpg',
+  'bg-intro-6.jpg',
+]
+function pickNextLoginBackground(): string {
+  try {
+    const raw = localStorage.getItem('neode_login_bg_idx')
+    const prev = raw !== null ? parseInt(raw, 10) : -1
+    const next = (Number.isFinite(prev) ? prev + 1 : 0) % LOGIN_BACKGROUNDS.length
+    localStorage.setItem('neode_login_bg_idx', String(next))
+    return LOGIN_BACKGROUNDS[next]!
+  } catch {
+    return LOGIN_BACKGROUNDS[Math.floor(Math.random() * LOGIN_BACKGROUNDS.length)]!
+  }
+}
+const loginBackground = ref(pickNextLoginBackground())
+watch(() => route.path, (p) => {
+  if (p === '/login') loginBackground.value = pickNextLoginBackground()
+})
 
 // Restore video time from splash screen for seamless transition
 function restoreVideoTime() {

neode-ui/src/views/RootRedirect.vue

@@ -129,7 +129,31 @@ onMounted(async () => {
     return
   }
 
-  // Server not ready — show boot screen (waiting for backend)
+  // Server not ready. The full BootScreen is meant for a genuine
+  // cold-start (fresh install), not for the brief blip during an
+  // OTA update where the backend restarts. If onboarding has already
+  // completed we just keep the spinner and retry until the server
+  // responds again.
+  const wasOnboardedBefore = localStorage.getItem('neode_onboarding_complete') === '1'
+  if (wasOnboardedBefore) {
+    log('server down + onboarded → polling without boot screen')
+    let retries = 0
+    const maxRetries = 30 // 30 * 2s = 60s before giving up and showing boot screen
+    const poll = setInterval(async () => {
+      retries++
+      if (await quickHealthCheck()) {
+        clearInterval(poll)
+        proceedToApp()
+        return
+      }
+      if (retries >= maxRetries) {
+        clearInterval(poll)
+        log('server still down after retries → falling back to boot screen')
+        showBootScreen.value = true
+      }
+    }, 2000)
+    return
+  }
   showBootScreen.value = true
 })
 </script>

neode-ui/src/views/apps/AppCard.vue

@@ -99,14 +99,14 @@
       </div>
     </div>
 
-    <!-- Uninstalling progress — replaces action buttons -->
+    <!-- Uninstalling progress — live stage label from backend -->
     <div v-else-if="isUninstalling" class="mt-4">
       <div class="flex items-center gap-1.5">
         <svg class="animate-spin h-3 w-3 text-red-400" fill="none" viewBox="0 0 24 24">
           <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
           <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
         </svg>
-        <span class="text-xs text-red-300">{{ t('common.uninstalling') }}...</span>
+        <span class="text-xs text-red-300 truncate">{{ uninstallStageLabel }}</span>
       </div>
       <div class="mt-1.5 w-full h-1.5 bg-white/10 rounded-full overflow-hidden">
         <div class="h-full bg-red-400/60 rounded-full animate-pulse w-full"></div>
@@ -114,6 +114,29 @@
     </div>
 
     <div v-else class="mt-4 flex gap-2">
+      <!-- Update available -->
+      <button
+        v-if="pkg['available-update'] && pkg.state !== 'updating'"
+        @click.stop="$emit('update', id)"
+        class="px-3 py-2 rounded-lg text-sm font-medium flex items-center justify-center gap-1.5 bg-orange-500/20 border border-orange-500/40 text-orange-200 hover:bg-orange-500/30 transition-colors"
+        :title="`Update to v${pkg['available-update']}`"
+      >
+        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15" />
+        </svg>
+        {{ t('common.update') }}
+      </button>
+      <!-- Updating in progress -->
+      <span
+        v-if="pkg.state === 'updating'"
+        class="px-3 py-2 rounded-lg text-sm font-medium flex items-center justify-center gap-1.5 bg-orange-500/20 border border-orange-500/40 text-orange-200"
+      >
+        <svg class="animate-spin h-4 w-4" fill="none" viewBox="0 0 24 24">
+          <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+          <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
+        </svg>
+        {{ t('common.updating') }}
+      </span>
       <!-- Launch -->
       <button
         v-if="canLaunch(pkg)"
@@ -211,6 +234,7 @@ const emit = defineEmits<{
   start: [id: string]
   stop: [id: string]
   restart: [id: string]
+  update: [id: string]
   showUninstall: [id: string, pkg: PackageDataEntry]
 }>()
 
@@ -251,6 +275,13 @@ const tier = computed(() => {
   return 'optional'
 })
 
+// Live uninstall stage from backend, with a sensible fallback so the
+// label is never blank between WS pushes.
+const uninstallStageLabel = computed(() => {
+  const raw = props.pkg['uninstall-stage']
+  return raw ? raw : `${t('common.uninstalling')}…`
+})
+
 const isTransitioning = computed(() => {
   const s = props.pkg.state
   const h = props.pkg.health

neode-ui/src/views/discover/curatedApps.ts

@@ -77,6 +77,7 @@ export async function fetchAppCatalog(): Promise<AppCatalog | null> {
 export function getCuratedAppList(): MarketplaceApp[] {
   return [
     { id: 'bitcoin-knots', title: 'Bitcoin Knots', version: '28.1.0', description: 'Run a full Bitcoin node. Validate and relay blocks and transactions on the Bitcoin network.', icon: '/assets/img/app-icons/bitcoin-knots.webp', author: 'Bitcoin Knots', dockerImage: `${R}/bitcoin-knots:latest`, repoUrl: 'https://github.com/bitcoinknots/bitcoin' },
+    { id: 'bitcoin-core', title: 'Bitcoin Core', version: '28.4', description: 'Reference implementation of the Bitcoin protocol. Run a full node validating and relaying blocks on the Bitcoin network.', icon: '/assets/img/app-icons/bitcoin-core.svg', author: 'Bitcoin Core contributors', dockerImage: 'bitcoin/bitcoin:28.4', repoUrl: 'https://github.com/bitcoin/bitcoin' },
     { id: 'btcpay-server', title: 'BTCPay Server', version: '1.13.7', description: 'Self-hosted Bitcoin payment processor. Accept Bitcoin payments without intermediaries or fees.', icon: '/assets/img/app-icons/btcpay-server.png', author: 'BTCPay Server Foundation', dockerImage: `${R}/btcpayserver:1.13.7`, repoUrl: 'https://github.com/btcpayserver/btcpayserver' },
     { id: 'lnd', title: 'LND', version: '0.18.4', description: 'Lightning Network Daemon. Fast and cheap Bitcoin payments through the Lightning Network.', icon: '/assets/img/app-icons/lnd.svg', author: 'Lightning Labs', dockerImage: `${R}/lnd:v0.18.4-beta`, repoUrl: 'https://github.com/lightningnetwork/lnd' },
     { id: 'mempool', title: 'Mempool Explorer', version: '3.0.0', description: 'Self-hosted Bitcoin blockchain and mempool visualizer. Monitor transactions without revealing your addresses to third parties.', icon: '/assets/img/app-icons/mempool.webp', author: 'Mempool', dockerImage: `${R}/mempool-frontend:v3.0.0`, repoUrl: 'https://github.com/mempool/mempool' },
@@ -164,6 +165,11 @@ export const FEATURED_DEFINITIONS: {
     desc: 'The foundation of sovereignty. Run a full Bitcoin node to validate every transaction yourself. No trusted third parties. No asking permission. Your node enforces the consensus rules that protect your wealth. Don\'t trust — verify.',
     tag: 'FULL VALIDATION // ZERO TRUST',
   },
+  {
+    id: 'bitcoin-core',
+    desc: 'The reference Bitcoin implementation. Same full-node guarantees as Knots, tracking upstream releases from the Bitcoin Core maintainers. Pick this if you\'d rather run mainline Bitcoin Core than Knots — both validate every block themselves.',
+    tag: 'REFERENCE CLIENT // ZERO TRUST',
+  },
   {
     id: 'lnd',
     desc: 'Lightning-fast payments over the Lightning Network. Open channels, route transactions, and earn routing fees — all from your sovereign node. Instant settlement. Near-zero fees. The future of money, running on your hardware.',

neode-ui/src/views/marketplace/MarketplaceAppCard.vue

@@ -96,20 +96,32 @@
           Checking...
         </span>
       </span>
-      <!-- Installing — simple button-style indicator -->
-      <button
+      <!-- Installing — live progress with bar + message matching the
+           update download bar's accuracy. Falls back to a simple
+           spinner if no install_progress data is available yet. -->
+      <div
         v-else-if="!installed && installing"
-        disabled
-        class="flex-1 px-4 py-2 glass-button glass-button-sm rounded-lg text-sm font-medium opacity-80 cursor-wait"
+        class="flex-1 flex flex-col gap-1.5"
       >
-        <span class="flex items-center justify-center gap-2">
-          <svg class="animate-spin h-3.5 w-3.5" fill="none" viewBox="0 0 24 24">
+        <div
+          class="px-4 py-2 glass-button glass-button-sm rounded-lg text-sm font-medium opacity-90 cursor-wait flex items-center justify-center gap-2 text-center"
+        >
+          <svg class="animate-spin h-3.5 w-3.5 shrink-0" fill="none" viewBox="0 0 24 24">
             <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
             <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
           </svg>
-          Installing
-        </span>
-      </button>
+          <span class="truncate">{{ installProgressMessage }}</span>
+        </div>
+        <div
+          v-if="(installProgress?.progress ?? 0) > 0"
+          class="w-full h-1 bg-white/10 rounded-full overflow-hidden"
+        >
+          <div
+            class="h-full bg-orange-400 transition-all duration-300"
+            :style="{ width: (installProgress?.progress ?? 0) + '%' }"
+          ></div>
+        </div>
+      </div>
       <button
         v-else-if="!installed && (app.source === 'local' || app.dockerImage)"
         data-controller-install-btn
@@ -130,6 +142,7 @@
 </template>
 
 <script setup lang="ts">
+import { computed } from 'vue'
 import { useI18n } from 'vue-i18n'
 import type { MarketplaceApp, InstallProgress } from './marketplaceData'
 
@@ -154,6 +167,14 @@ defineEmits<{
   launch: [app: MarketplaceApp]
 }>()
 
+const installProgressMessage = computed(() => {
+  const p = props.installProgress
+  if (!p) return 'Installing'
+  // The store already formats messages like "Downloading: 50.5 / 200.0 MB (25%)"
+  // so we just surface them directly.
+  return p.message || 'Installing'
+})
+
 function handleImageError(event: Event) {
   const img = event.target as HTMLImageElement
   img.src = '/assets/img/logo-archipelago.svg'

neode-ui/src/views/settings/AccountInfoSection.vue

@@ -180,6 +180,31 @@ init()
               </button>
             </div>
             <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+              <!-- v1.7.30-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.30-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>App installs now show a real download progress bar — same accuracy as the system update bar. You'll see "Downloading: 50.5 / 200.0 MB (25%)" with a live percentage instead of a generic spinner. The bar keeps streaming even when the install falls back from one registry to another, so you'll never see a "stuck at 0%" again.</p>
+                  <p>Uninstalls now show what's actually happening: "Stopping containers (2/5)", "Cleaning up volumes", "Removing app data" — labelled per app so you can fire off multiple uninstalls in parallel and watch each one's stage on its own card.</p>
+                  <p>OVH (146.59.87.168) is now baked in as Server 3 by default for both updates and the app registry — extra mirror, completely independent network path so a single-provider outage can't take everything down.</p>
+                </div>
+              </div>
+              <!-- v1.7.29-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.29-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>New App registries page in Settings — same experience as Update mirrors, but for the container registries your node pulls app images from. Add a mirror, test reachability with one click, pick the primary.</p>
+                  <p>New nodes default to the VPS registry as the primary for both app installs and the app catalog, with tx1138 as the automatic fallback if the VPS is slow or unreachable. Existing nodes keep whatever registry order they've already set.</p>
+                  <p>App installs now genuinely honor the primary registry: the first pull attempt rewrites the image URL to use your primary, and only falls through to the secondary if that fails. Before, installs always hit whichever registry the image was hardcoded to.</p>
+                  <p>Reboot screen now shows the animated "a" logo in the center of the ring — matching the screensaver's look so you get something nice to watch while the node comes back up.</p>
+                </div>
+              </div>
               <!-- v1.7.28-alpha -->
               <div>
                 <div class="flex items-center gap-2 mb-3">

neode-ui/src/views/settings/AppRegistriesSection.vue

@@ -0,0 +1,27 @@
+<script setup lang="ts">
+import { RouterLink } from 'vue-router'
+</script>
+
+<template>
+  <!-- App Registries Section -->
+  <div class="glass-card px-6 py-6 mb-6">
+    <div class="flex items-center justify-between">
+      <div>
+        <h2 class="text-xl font-semibold text-white/96">App registries</h2>
+        <p class="text-sm text-white/60 mt-1">
+          Choose the primary registry for app installs and add mirrors for fallback.
+        </p>
+      </div>
+      <RouterLink
+        to="/dashboard/settings/registries"
+        class="glass-button px-4 py-2 rounded-lg text-sm flex items-center gap-2"
+      >
+        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+            d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1M12 12V3m0 0l-4 4m4-4l4 4" />
+        </svg>
+        Manage registries
+      </RouterLink>
+    </div>
+  </div>
+</template>

neode-ui/src/views/settings/SystemDangerZone.vue

@@ -4,6 +4,7 @@ import { useRouter } from 'vue-router'
 import { useI18n } from 'vue-i18n'
 import { rpcClient } from '@/api/rpc-client'
 import ScreensaverRing from '@/components/ScreensaverRing.vue'
+import ScreensaverLogo from '@/components/ScreensaverLogo.vue'
 
 const router = useRouter()
 const { t } = useI18n()
@@ -170,8 +171,13 @@ async function performFactoryReset() {
         v-if="rebootOverlay"
         class="fixed inset-0 z-[3000] bg-black flex flex-col items-center justify-center overflow-hidden"
       >
-        <!-- Centered animated ring — same segments as the screensaver -->
-        <ScreensaverRing />
+        <!-- Centered animated ring + logo — same composition as the screensaver -->
+        <div class="reboot-ring-content">
+          <ScreensaverRing />
+          <div class="reboot-logo-wrapper">
+            <ScreensaverLogo />
+          </div>
+        </div>
 
         <!-- Stage text + progress bar underneath -->
         <div class="mt-8 w-[min(520px,80vw)] text-center">
@@ -258,6 +264,20 @@ async function performFactoryReset() {
   opacity: 0;
 }
 
+.reboot-ring-content {
+  position: relative;
+  display: grid;
+  place-items: center;
+}
+.reboot-logo-wrapper {
+  position: absolute;
+  inset: 0;
+  display: grid;
+  place-items: center;
+  z-index: 10;
+  filter: drop-shadow(0 0 40px rgba(255, 255, 255, 0.15));
+}
+
 .reboot-overlay-bar-anim {
   animation: rebootBarSlide 1.8s ease-in-out infinite;
 }

neode-ui/src/views/settings/SystemSection.vue

@@ -3,6 +3,7 @@ import InterfaceModeSection from '@/views/settings/InterfaceModeSection.vue'
 import ClaudeAuthSection from '@/views/settings/ClaudeAuthSection.vue'
 import AIDataAccessSection from '@/views/settings/AIDataAccessSection.vue'
 import SystemUpdatesSection from '@/views/settings/SystemUpdatesSection.vue'
+import AppRegistriesSection from '@/views/settings/AppRegistriesSection.vue'
 import WebhookSection from '@/views/settings/WebhookSection.vue'
 import TelemetrySection from '@/views/settings/TelemetrySection.vue'
 import BackupSection from '@/views/settings/BackupSection.vue'
@@ -14,6 +15,7 @@ import SystemDangerZone from '@/views/settings/SystemDangerZone.vue'
   <ClaudeAuthSection />
   <AIDataAccessSection />
   <SystemUpdatesSection />
+  <AppRegistriesSection />
   <WebhookSection />
   <TelemetrySection />
   <BackupSection />

neode-ui/vite.config.ts

@@ -94,7 +94,7 @@ export default defineConfig({
             urlPattern: /\/assets\/.*/i,
             handler: 'CacheFirst',
             options: {
-              cacheName: 'assets-cache-v2',
+              cacheName: 'assets-cache-v3',
               expiration: {
                 maxEntries: 100,
                 maxAgeSeconds: 60 * 60 * 24 * 30 // 30 days

scripts/container-doctor.sh

@@ -367,7 +367,72 @@ print(' '.join(['\"' + a + '\"' if ' ' in a else a for a in args[2:]]))
     [ ${#fixed_names[@]} -gt 0 ] && return 0 || return 1
 }
 
-# ── Fix 8: Restart stopped core containers ──────────────────
+# ── Fix 8: Rootless netns egress lost ────────────────────────
+# Rootless podman uses pasta to give containers internet egress. If pasta's
+# tap vanishes (host link flap, mount churn), the rootless-netns keeps inter-
+# container traffic working but silently loses outbound. Bitcoin IBD stalls
+# at 0 peers; package pulls fail. The only reliable repair is a stop-all/
+# start-all cycle so pasta + aardvark-dns rebuild the netns from scratch.
+fix_rootless_netns_egress() {
+    local archi_uid
+    archi_uid=$(id -u archipelago 2>/dev/null) || return 1
+
+    # Locate the rootless-netns via aardvark-dns (it lives inside it).
+    local aardvark_pid
+    aardvark_pid=$(pgrep -U "$archi_uid" -f '^/usr/lib/podman/aardvark-dns' 2>/dev/null | head -1)
+    [ -z "$aardvark_pid" ] && return 1   # no rootless network active
+
+    # Host precheck: if the host itself can't reach the internet, no point
+    # cycling containers — this is an upstream problem.
+    if ! timeout 3 bash -c '</dev/tcp/1.1.1.1/443' 2>/dev/null; then
+        return 1
+    fi
+
+    # Probe egress from inside the rootless-netns. One probe is noisy;
+    # require two consecutive failures 10s apart to rule out transients.
+    if timeout 3 nsenter -t "$aardvark_pid" -n bash -c '</dev/tcp/1.1.1.1/443' 2>/dev/null; then
+        return 1   # first probe succeeded
+    fi
+    sleep 10
+    aardvark_pid=$(pgrep -U "$archi_uid" -f '^/usr/lib/podman/aardvark-dns' 2>/dev/null | head -1)
+    [ -z "$aardvark_pid" ] && return 1
+    if timeout 3 nsenter -t "$aardvark_pid" -n bash -c '</dev/tcp/1.1.1.1/443' 2>/dev/null; then
+        return 1   # recovered on its own
+    fi
+
+    log "Rootless-netns egress is broken (host online, container netns unreachable) — cycling"
+
+    local PODMANCMD="sudo -u archipelago XDG_RUNTIME_DIR=/run/user/$archi_uid podman"
+    local running
+    running=$($PODMANCMD ps --format '{{.Names}}' 2>/dev/null)
+    if [ -z "$running" ]; then
+        log "  No running containers to cycle — skipping"
+        return 1
+    fi
+
+    local count
+    count=$(echo "$running" | wc -l)
+    log "  Stopping $count running containers (graceful, 30s)..."
+    $PODMANCMD stop --all --time 30 >/dev/null 2>&1
+    sleep 5
+
+    log "  Starting containers back up..."
+    for c in $running; do
+        $PODMANCMD start "$c" >/dev/null 2>&1 &
+    done
+    wait
+    sleep 5
+
+    aardvark_pid=$(pgrep -U "$archi_uid" -f '^/usr/lib/podman/aardvark-dns' 2>/dev/null | head -1)
+    if [ -n "$aardvark_pid" ] && timeout 3 nsenter -t "$aardvark_pid" -n bash -c '</dev/tcp/1.1.1.1/443' 2>/dev/null; then
+        log "  Rootless-netns egress restored ($count containers cycled)"
+    else
+        log "  WARN: egress still broken after cycle — may need manual intervention"
+    fi
+    return 0
+}
+
+# ── Fix 9: Restart stopped core containers ──────────────────
 # Rootless Podman 4.x restart policies don't auto-restart on crash.
 # This check restarts any exited core containers (tiers 0-2).
 fix_stopped_core_containers() {
@@ -414,6 +479,7 @@ run_fix "tor-permissions"  fix_tor_permissions
 run_fix "searxng"         fix_searxng
 run_fix "bitcoin-txindex" fix_bitcoin_txindex
 run_fix "exit-127"        fix_exit_127
+run_fix "netns-egress"    fix_rootless_netns_egress
 run_fix "stopped-core"    fix_stopped_core_containers
 
 echo ""

scripts/first-boot-containers.sh

@@ -1216,44 +1216,6 @@ if $DOCKER images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -q 'str
   fi
 fi
 
-# 8b. Indeehub (pull from registry, or use local build)
-if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q indeedhub; then
-  # Use image-versions.sh variable if sourced, otherwise detect
-  if [ -z "${INDEEDHUB_IMAGE:-}" ]; then
-    INDEEDHUB_IMAGE=""
-    # Try local image first (pre-built or loaded from ISO)
-    if $DOCKER images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -q 'localhost/indeedhub'; then
-      INDEEDHUB_IMAGE="localhost/indeedhub:local"
-    # Try pinned registry image
-    elif $DOCKER pull "$ARCHY_REGISTRY/indeedhub:1.0.0" --tls-verify=false 2>>"$LOG"; then
-      INDEEDHUB_IMAGE="$ARCHY_REGISTRY/indeedhub:1.0.0"
-    fi
-  fi
-  if [ -n "$INDEEDHUB_IMAGE" ]; then
-    log "Creating Indeehub from $INDEEDHUB_IMAGE..."
-    $DOCKER run -d --name indeedhub --restart unless-stopped \
-      --network archy-net --network-alias indeedhub \
-      --health-cmd="curl -sf http://localhost:7777/health || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
-      --memory=$(mem_limit indeedhub) \
-      --cap-drop ALL --security-opt no-new-privileges:true \
-      --tmpfs /tmp:rw,noexec,nosuid,size=64m \
-      -p 7778:7777 \
-      "$INDEEDHUB_IMAGE" 2>>"$LOG" || true
-    # Fix IndeedHub for iframe: remove X-Frame-Options so it loads in Archipelago panel
-    sleep 2
-    if $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q "^indeedhub$"; then
-      $DOCKER exec indeedhub sed -i "/X-Frame-Options/d" /etc/nginx/conf.d/default.conf 2>/dev/null || true
-      # Fix Host header for NIP-98 auth — $host strips port, $http_host preserves it
-      $DOCKER exec indeedhub sed -i 's|proxy_set_header Host $host;|proxy_set_header Host $http_host;|g' /etc/nginx/conf.d/default.conf 2>/dev/null || true
-      if [ -f /opt/archipelago/web-ui/nostr-provider.js ]; then
-        $DOCKER cp /opt/archipelago/web-ui/nostr-provider.js indeedhub:/usr/share/nginx/html/nostr-provider.js 2>/dev/null || true
-      fi
-      $DOCKER exec indeedhub nginx -s reload 2>/dev/null || true
-      log "Applied IndeedHub iframe fix (X-Frame-Options, Host header, nostr-provider)"
-    fi
-  fi
-fi
-
 # 9. Custom UI containers (bitcoin-ui, lnd-ui)
 # These are built from Dockerfiles in /opt/archipelago/docker/ or loaded from pre-built images.