chore: release v1.7.57-alpha

fix(iso): avoid polkit in live debootstrap seed
chore(release): refresh v1.7.56-alpha manifest after wifi fix
2026-05-17 17:30:04 -04:00 · 2026-05-15 18:32:14 -04:00 · 2026-05-15 18:26:17 -04:00 · 2026-05-15 18:15:06 -04:00 · 2026-05-15 17:54:32 -04:00 · 2026-05-14 09:13:58 -04:00
49 changed files with 889 additions and 137 deletions
@@ -7,6 +7,14 @@
 # Allow demo assets (AIUI pre-built dist)
 !demo/

+# Allow backend source for ISO source builds
+!core/
+!scripts/
+!image-recipe/
+image-recipe/build/
+image-recipe/results/
+image-recipe/output/
+
 # Exclude nested node_modules (will npm install in container)
 neode-ui/node_modules
 neode-ui/dist
@@ -1,5 +1,34 @@
 # Changelog

+## v1.7.57-alpha (2026-05-17)
+
+- Nginx Proxy Manager now avoids privileged rootless Podman host port `81`, preferring `8081:81` while host nginx keeps a compatibility proxy on `:81` for stale cached launch buttons.
+- App installs now allocate ports by checking live host bind availability, falling back to a free high port when preferred ports are already occupied.
+- Portainer-created launchable containers are separated into a `Websites` tab and launch through their discovered published host port instead of hard-coded app URLs.
+- Internal BuildKit helper containers such as `buildx_buildkit_default` are hidden from the Apps UI.
+- Portainer works out of the box on Debian 13/Podman installs by including `catatonit` and by preserving the Podman socket mount as a socket rather than creating it as a directory.
+
+## v1.7.56-alpha (2026-05-15)
+
+- Health notifications now clear when an app is no longer unhealthy, including stale alerts for removed containers such as Portainer.
+- Fresh installs now include the full Wi-Fi userspace stack (`wpasupplicant`, `wireless-regdb`, `iw`, `rfkill`, `polkitd`, `pciutils`, and `usbutils`) so NetworkManager can scan and connect with Intel Wi-Fi cards out of the box.
+- The installed system now grants the `archipelago` service user explicit NetworkManager PolicyKit access for web-triggered Wi-Fi scans and connection changes.
+- Wi-Fi connect now replaces stale/partial NetworkManager profiles and creates an explicit WPA-PSK profile with the supplied password, avoiding no-secret retry failures after a failed attempt.
+- Settings password changes now update the Linux/SSH password through non-interactive sudo, so the web password and SSH password stay in sync when the checkbox is enabled.
+- Quadlet environment values with spaces or shell metacharacters are quoted consistently, preventing env drift recreate loops for apps like nostr-rs-relay and Grafana.
+- Boot/bootstrap reconcile avoids restarting running Bitcoin containers while repairing RPC config, preserving IBD progress on active nodes.
+- Exit code 137 is labeled as SIGKILL instead of assuming OOM, avoiding false OOM alerts for orchestrator-managed recreates.
+- Container reconcile force-recreates Podman records stuck in `Stopping`, preserving bind-mounted app data while recovering wedged containers automatically.
+- Container health reporting is honest for running containers: Archipelago surfaces Podman's actual health state instead of marking every running container healthy.
+- Quadlet reconciliation restarts services when stale health gates, port bindings, network aliases, exec commands, or healthchecks drift from the current manifest.
+- Bitcoin Knots sync performance improves on fresh installs and updates with 8Gi container memory, a 4Gi dbcache, and full CPU parallelism.
+- ElectrumX initial indexing gets more headroom: CPU caps are removed, memory is raised to 4Gi, cache is raised to 3Gi, and oversized sends are allowed for heavier wallet/indexing workloads.
+- Mempool/ElectrumX lifecycle qualification respects pruned/non-archival Bitcoin nodes instead of installing a half-running stack with unhealthy dependencies.
+- LND wallet/RPC helpers are more tolerant of container-owned files and updated REST port metadata, improving LND lifecycle and wallet-connect flows.
+- Marketplace/catalog metadata carries richer container config so remote lifecycle tests install apps using the same settings users get from the UI.
+- The app screensaver no longer activates during media-heavy app sessions such as IndeeHub, Jellyfin, Immich, PhotoPrism, and File Browser; apps can also pause/resume it with media playback messages.
+- A fresh `1.7.56-alpha` unbundled installer ISO is built from the same primary VPS2 release line for easy download and USB flashing.
+
 ## v1.7.55-alpha (2026-05-13)

 - Container reconcile now force-recreates Podman records stuck in `Stopping`, preserving bind-mounted app data while recovering wedged containers automatically.
@@ -30,7 +30,7 @@ app:
        RPC_PASS="$(printenv BITCOIN_RPC_PASS)";
        DISK_GB_VALUE="$(printenv DISK_GB || true)";
        if [ "${DISK_GB_VALUE:-0}" -lt 1000 ]; then
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
        else
          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
        fi
@@ -80,7 +80,7 @@ checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"

 [[package]]
 name = "archipelago"
-version = "1.7.55-alpha"
+version = "1.7.57-alpha"
 dependencies = [
 "anyhow",
 "archipelago-container",
@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.55-alpha"
+version = "1.7.57-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]
@@ -307,14 +307,62 @@ async fn scan_wifi() -> Result<Vec<serde_json::Value>> {

 /// Connect to a WiFi network using nmcli.
 async fn connect_wifi(ssid: &str, password: &str) -> Result<()> {
+    let conn_name = format!("archipelago-wifi-{ssid}");
+
+    // Delete prior profiles for this SSID/name first. Failed attempts can leave
+    // a profile with key-mgmt but no saved PSK, causing future retries to fail
+    // with "no secrets" before the supplied password is used.
+    let _ = tokio::process::Command::new("nmcli")
+        .args(["connection", "delete", &conn_name])
+        .output()
+        .await;
+    let _ = tokio::process::Command::new("nmcli")
+        .args(["connection", "delete", ssid])
+        .output()
+        .await;
+
    let output = tokio::process::Command::new("nmcli")
-        .args(["device", "wifi", "connect", ssid, "password", password])
+        .args([
+            "connection",
+            "add",
+            "type",
+            "wifi",
+            "con-name",
+            &conn_name,
+            "ifname",
+            "*",
+            "ssid",
+            ssid,
+            "wifi-sec.key-mgmt",
+            "wpa-psk",
+            "wifi-sec.psk",
+            password,
+            "ipv4.method",
+            "auto",
+            "ipv6.method",
+            "auto",
+        ])
+        .output()
+        .await
+        .context("Failed to run nmcli wifi profile create")?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        anyhow::bail!("WiFi profile create failed: {}", stderr);
+    }
+
+    let activate = tokio::process::Command::new("nmcli")
+        .args(["connection", "up", &conn_name])
        .output()
        .await
        .context("Failed to run nmcli wifi connect")?;

-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
+    if !activate.status.success() {
+        let stderr = String::from_utf8_lossy(&activate.stderr);
+        let _ = tokio::process::Command::new("nmcli")
+            .args(["connection", "delete", &conn_name])
+            .output()
+            .await;
        anyhow::bail!("WiFi connection failed: {}", stderr);
    }

@@ -153,11 +153,13 @@ pub(super) fn get_app_capabilities(app_id: &str) -> Vec<String> {
            "--cap-add=SETGID".to_string(),
            "--cap-add=DAC_OVERRIDE".to_string(),
        ],
-        // Nginx Proxy Manager needs to bind low ports
+        // Nginx Proxy Manager initializes/chowns mounted state on first boot.
        "nginx-proxy-manager" => vec![
            "--cap-add=CHOWN".to_string(),
+            "--cap-add=FOWNER".to_string(),
            "--cap-add=SETUID".to_string(),
            "--cap-add=SETGID".to_string(),
+            "--cap-add=DAC_OVERRIDE".to_string(),
            "--cap-add=NET_BIND_SERVICE".to_string(),
        ],
        // Bitcoin needs only file-ownership ops + NET_BIND_SERVICE for the
@@ -924,20 +926,34 @@ pub(super) async fn get_app_config(
                ]),
            )
        }
-        "nginx-proxy-manager" => (
-            vec![
-                "81:81".to_string(),
-                "8084:80".to_string(),
-                "8444:443".to_string(),
-            ],
-            vec![
-                "/var/lib/archipelago/nginx-proxy-manager/data:/data".to_string(),
-                "/var/lib/archipelago/nginx-proxy-manager/letsencrypt:/etc/letsencrypt".to_string(),
-            ],
-            vec![],
-            None,
-            None,
-        ),
+        "nginx-proxy-manager" => {
+            let admin_port = allocator
+                .allocate_or_get(app_id, 8081, 81)
+                .await
+                .unwrap_or(8081);
+            let http_port = allocator
+                .allocate_or_get("nginx-proxy-manager-http", 8084, 80)
+                .await
+                .unwrap_or(8084);
+            let https_port = allocator
+                .allocate_or_get("nginx-proxy-manager-https", 8444, 443)
+                .await
+                .unwrap_or(8444);
+            (
+                vec![
+                    format!("{}:81", admin_port),
+                    format!("{}:80", http_port),
+                    format!("{}:443", https_port),
+                ],
+                vec![
+                    "/var/lib/archipelago/nginx-proxy-manager/data:/data".to_string(),
+                    "/var/lib/archipelago/nginx-proxy-manager/letsencrypt:/etc/letsencrypt".to_string(),
+                ],
+                vec![],
+                None,
+                None,
+            )
+        }
        "portainer" => (
            vec!["9000:9000".to_string()],
            vec![
@@ -376,7 +376,7 @@ impl RpcHandler {
                            package_id
                        ))
                        .await;
-                        if let Err(e) = ensure_host_port_listener(package_id, package_id).await {
+                        if let Err(e) = ensure_host_port_listener(package_id, package_id, &[]).await {
                            install_log(&format!(
                                "INSTALL ADOPT RECREATE: {} — host listener repair failed, removing wedged container: {}",
                                package_id, e
@@ -402,7 +402,7 @@ impl RpcHandler {
                        package_id
                    ))
                    .await;
-                    if let Err(e) = ensure_host_port_listener(package_id, package_id).await {
+                    if let Err(e) = ensure_host_port_listener(package_id, package_id, &[]).await {
                        install_log(&format!(
                            "INSTALL ADOPT RECREATE: {} — host listener repair failed, removing wedged container: {}",
                            package_id, e
@@ -880,7 +880,7 @@ impl RpcHandler {
            repair_nextcloud_permissions().await;
        }

-        ensure_host_port_listener(package_id, container_name).await?;
+        ensure_host_port_listener(package_id, container_name, &ports).await?;

        install_log(&format!(
            "INSTALL OK: {} (container: {})",
@@ -1866,7 +1866,7 @@ async fn cleanup_stale_package_ports(package_id: &str) {
            cleanup_stale_pasta_port("3000").await;
        }
        "nginx-proxy-manager" => {
-            cleanup_stale_pasta_port("81").await;
+            cleanup_stale_pasta_port("8081").await;
            cleanup_stale_pasta_port("8084").await;
            cleanup_stale_pasta_port("8444").await;
        }
@@ -1914,7 +1914,7 @@ async fn cleanup_start_conflict(package_id: &str, stderr: &str) -> bool {
        "nginx-proxy-manager"
            if stderr.contains("pasta failed") || stderr.contains("address already in use") =>
        {
-            cleanup_stale_pasta_port("81").await;
+            cleanup_stale_pasta_port("8081").await;
            cleanup_stale_pasta_port("8084").await;
            cleanup_stale_pasta_port("8444").await;
            true
@@ -1968,8 +1968,18 @@ async fn repair_nextcloud_permissions() {
    }
 }

-async fn ensure_host_port_listener(package_id: &str, container_name: &str) -> Result<()> {
-    let Some(port) = required_host_port(package_id) else {
+async fn ensure_host_port_listener(
+    package_id: &str,
+    container_name: &str,
+    runtime_ports: &[String],
+) -> Result<()> {
+    let Some(port) = runtime_ports
+        .first()
+        .and_then(|p| p.split(':').next())
+        .and_then(|p| p.parse::<u16>().ok())
+        .or_else(|| published_host_port(container_name))
+        .or_else(|| required_host_port(package_id))
+    else {
        return Ok(());
    };

@@ -2015,6 +2025,22 @@ async fn ensure_host_port_listener(package_id: &str, container_name: &str) -> Re
    ))
 }

+fn published_host_port(container_name: &str) -> Option<u16> {
+    let output = std::process::Command::new("podman")
+        .args(["port", container_name])
+        .output()
+        .ok()?;
+    if !output.status.success() {
+        return None;
+    }
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    stdout.lines().find_map(|line| {
+        line.rsplit(':')
+            .next()
+            .and_then(|p| p.trim().parse::<u16>().ok())
+    })
+}
+
 async fn ensure_user_podman_socket() -> Result<()> {
    let socket_path = "/run/user/1000/podman/podman.sock";
    if tokio::fs::try_exists(socket_path).await.unwrap_or(false) {
@@ -2048,7 +2074,7 @@ fn required_host_port(package_id: &str) -> Option<u16> {
        "uptime-kuma" => Some(3002),
        "gitea" => Some(3001),
        "nextcloud" => Some(8085),
-        "nginx-proxy-manager" => Some(81),
+        "nginx-proxy-manager" => Some(8081),
        _ => None,
    }
 }
@@ -366,6 +366,10 @@ impl RpcHandler {
        {
            let mut allocator = self.port_allocator.lock().await;
            let _ = allocator.release(package_id).await;
+            if package_id == "nginx-proxy-manager" {
+                let _ = allocator.release("nginx-proxy-manager-http").await;
+                let _ = allocator.release("nginx-proxy-manager-https").await;
+            }
        }

        // Clean data directories unless preserve_data
@@ -916,7 +920,7 @@ fn runtime_required_host_port(container_name: &str) -> Option<u16> {
        "vaultwarden" => Some(8082),
        "gitea" => Some(3001),
        "nextcloud" => Some(8085),
-        "nginx-proxy-manager" => Some(81),
+        "nginx-proxy-manager" => Some(8081),
        _ => None,
    }
 }
@@ -1072,7 +1076,7 @@ async fn cleanup_start_conflict(container_name: &str, stderr: &str) {
        "vaultwarden" => cleanup_stale_pasta_port("8082").await,
        "nextcloud" => cleanup_stale_pasta_port("8085").await,
        "nginx-proxy-manager" => {
-            cleanup_stale_pasta_port("81").await;
+            cleanup_stale_pasta_port("8081").await;
            cleanup_stale_pasta_port("8084").await;
            cleanup_stale_pasta_port("8444").await;
        }
@@ -353,7 +353,7 @@ pub(in crate::api::rpc) fn known_service_port(name: &str) -> u16 {
        "immich" => 2283,
        "photoprism" => 2342,
        "penpot" => 9001,
-        "nginx-proxy-manager" => 81,
+        "nginx-proxy-manager" => 8081,
        "vaultwarden" => 8343,
        "indeedhub" => 7778,
        _ => 0,
@@ -381,14 +381,14 @@ async fn change_ssh_password(new_password: &str) -> Result<()> {

    // usermod -p writes directly to /etc/shadow, bypassing PAM
    // Use /usr/sbin/usermod - not always in systemd's PATH
-    let status = tokio::process::Command::new("/usr/sbin/usermod")
-        .args(["-p", &hash, &ssh_user])
+    let status = tokio::process::Command::new("/usr/bin/sudo")
+        .args(["-n", "/usr/sbin/usermod", "-p", &hash, &ssh_user])
        .output()
        .await?;

    if !status.status.success() {
        let stderr = String::from_utf8_lossy(&status.stderr);
-        anyhow::bail!("usermod failed: {}", stderr);
+        anyhow::bail!("sudo usermod failed: {}", stderr);
    }

    tracing::info!("SSH password updated for user {}", ssh_user);
@@ -65,7 +65,9 @@ pub async fn ensure_doctor_installed() {
        Err(e) => warn!("Nginx bootstrap failed (non-fatal): {:#}", e),
    }
    match run_bitcoin_rpc_repair().await {
-        Ok(true) => info!("Repaired Bitcoin RPC bind settings and restarted Bitcoin containers"),
+        Ok(true) => {
+            info!("Repaired Bitcoin RPC bind settings; running Bitcoin containers left untouched")
+        }
        Ok(false) => debug!("Bitcoin RPC bind settings already usable"),
        Err(e) => warn!("Bitcoin RPC repair failed (non-fatal): {:#}", e),
    }
@@ -334,15 +336,11 @@ exit 2
        .context("repair bitcoin.conf RPC bind settings")?;
    match status.code() {
        Some(0) => Ok(false),
-        Some(2) => {
-            for name in ["bitcoin-knots", "bitcoin-core", "archy-bitcoin-ui"] {
-                let _ = tokio::process::Command::new("podman")
-                    .args(["restart", name])
-                    .status()
-                    .await;
-            }
-            Ok(true)
-        }
+        // Do not restart Bitcoin from bootstrap. During IBD, an automatic
+        // restart can cost hours of progress. The repaired file is only a
+        // fallback for future starts; current containers keep their command-line
+        // RPC args until an operator or update intentionally restarts them.
+        Some(2) => Ok(true),
        _ => {
            warn!("Bitcoin RPC repair helper exited with {}", status);
            Ok(false)
@@ -61,6 +61,7 @@ impl DockerPackageScanner {
            "indeedhub-build_minio-init_1",
            "indeedhub-build_relay_1",
            "indeedhub-build_ffmpeg-worker_1",
+            "buildx_buildkit_default",
        ];

        // First pass: collect running UI containers. Custom UI-backed apps must
@@ -123,6 +124,11 @@ impl DockerPackageScanner {
                continue;
            }

+            if app_id.starts_with("buildx_buildkit") {
+                debug!("Skipping BuildKit helper container: {}", app_id);
+                continue;
+            }
+
            // Skip UI containers (they're merged with their parent apps)
            if app_id.ends_with("-ui") {
                debug!("Skipping UI container: {}", app_id);
@@ -140,8 +146,13 @@ impl DockerPackageScanner {
            } else {
                // Prefer the known web UI port over arbitrary first binding
                // (for example Gitea exposes SSH on 2222 before web on 3001).
-                let candidate = PodmanClient::lan_address_for(&app_id)
-                    .or_else(|| extract_lan_address(&container.ports));
+                let candidate = if uses_allocated_launch_port(&app_id) {
+                    extract_lan_address(&container.ports)
+                        .or_else(|| PodmanClient::lan_address_for(&app_id))
+                } else {
+                    PodmanClient::lan_address_for(&app_id)
+                        .or_else(|| extract_lan_address(&container.ports))
+                };
                reachable_lan_address(&app_id, candidate).await
            };

@@ -673,6 +684,13 @@ fn companion_lan_address(app_id: &str) -> Option<String> {
    }
 }

+fn uses_allocated_launch_port(app_id: &str) -> bool {
+    matches!(
+        app_id,
+        "filebrowser" | "nextcloud" | "nginx-proxy-manager" | "vaultwarden"
+    )
+}
+
 fn convert_state(container_state: &ContainerState) -> (PackageState, ServiceStatus) {
    match container_state {
        ContainerState::Running => (PackageState::Running, ServiceStatus::Running),
@@ -62,6 +62,19 @@ fn is_required_baseline_app(app_id: &str) -> bool {
    )
 }

+fn is_restart_sensitive_app(app_id: &str) -> bool {
+    matches!(
+        app_id,
+        "bitcoin-knots"
+            | "bitcoin-core"
+            | "bitcoin"
+            | "lnd"
+            | "btcpay-server"
+            | "fedimint"
+            | "fedimint-gateway"
+    )
+}
+
 fn requires_archival_bitcoin(app_id: &str) -> bool {
    matches!(
        app_id,
@@ -713,6 +726,17 @@ impl ProdContainerOrchestrator {
                            return Ok(ReconcileAction::Started);
                        }
                        if self.container_env_drifted(&name, &resolved_manifest).await {
+                            if mode == ReconcileMode::ExistingOnly
+                                && is_restart_sensitive_app(&app_id)
+                            {
+                                tracing::info!(
+                                    app_id = %app_id,
+                                    container = %name,
+                                    "container drift detected during boot reconcile; leaving running restart-sensitive app untouched"
+                                );
+                                self.run_post_start_hooks(&app_id).await?;
+                                return Ok(ReconcileAction::NoOp);
+                            }
                            tracing::info!(app_id = %app_id, container = %name, "container env drift detected — recreating");
                            let _ = self.runtime.stop_container(&name).await;
                            let _ = self.runtime.remove_container(&name).await;
@@ -2252,6 +2276,7 @@ mod tests {
            runtime,
            PathBuf::from("/nonexistent-for-tests"),
        );
+        orch.set_data_dir(PathBuf::from("/nonexistent-for-tests"));
        // Redirect the bitcoin-ui pre-start hook to a test-scoped
        // tmpdir, seeded with a fake password file. Shared across
        // every test in this module (OnceLock), so the hook can run
@@ -2259,6 +2284,7 @@ mod tests {
        // this redirection, any test that installs the bitcoin-ui
        // fixture would try to write under /var/lib/archipelago.
        orch.set_bitcoin_ui_paths(test_bitcoin_ui_paths());
+        orch.set_filebrowser_paths(test_filebrowser_paths());
        orch
    }

@@ -2339,6 +2365,17 @@ app:
        }
    }

+    fn test_filebrowser_paths() -> filebrowser::EnsurePaths {
+        use std::sync::OnceLock;
+        static DIR: OnceLock<tempfile::TempDir> = OnceLock::new();
+        let dir = DIR.get_or_init(|| tempfile::TempDir::new().expect("test tmpdir"));
+        filebrowser::EnsurePaths {
+            srv_root: dir.path().join("filebrowser"),
+            data_dir: dir.path().join("filebrowser-data"),
+            config_path: dir.path().join("filebrowser-data/.filebrowser.json"),
+        }
+    }
+
    #[tokio::test]
    async fn install_fresh_pull() {
        let rt = Arc::new(MockRuntime::default());
@@ -222,7 +222,7 @@ impl QuadletUnit {
        for env in &self.environment {
            // env entries already arrive shaped as "KEY=VALUE"; quadlet
            // accepts that form on a single Environment= line per pair.
-            let _ = writeln!(s, "Environment={env}");
+            let _ = writeln!(s, "Environment={}", quote_environment(env));
        }
        for dev in &self.devices {
            let _ = writeln!(s, "AddDevice={dev}");
@@ -296,6 +296,23 @@ fn shell_join(parts: &[String]) -> String {
        .join(" ")
 }

+fn quote_environment(env: &str) -> String {
+    let env = env.replace(['\r', '\n'], " ");
+    if env.is_empty()
+        || env
+            .chars()
+            .any(|c| c.is_whitespace() || "\"\\$`".contains(c))
+    {
+        let escaped = env
+            .replace('\\', "\\\\")
+            .replace('"', "\\\"")
+            .replace('$', "$$");
+        format!("\"{escaped}\"")
+    } else {
+        env
+    }
+}
+
 impl QuadletUnit {
    /// Build a backend-flavour QuadletUnit from a parsed AppManifest.
    /// Wired through `prod_orchestrator::install_via_quadlet`, gated by
@@ -778,6 +795,22 @@ mod tests {
        );
    }

+    #[test]
+    fn quote_environment_quotes_values_with_spaces() {
+        assert_eq!(
+            quote_environment("BITCOIN_RPC_PASS=secret"),
+            "BITCOIN_RPC_PASS=secret"
+        );
+        assert_eq!(
+            quote_environment("RELAY_NAME=Archipelago Nostr Relay"),
+            "\"RELAY_NAME=Archipelago Nostr Relay\""
+        );
+        assert_eq!(
+            quote_environment("GREETING=say \"hi\""),
+            "\"GREETING=say \\\"hi\\\"\""
+        );
+    }
+
    #[test]
    fn restart_policy_emits_correct_systemd_string() {
        assert_eq!(RestartPolicy::Always.as_systemd(), "always");
@@ -797,6 +830,7 @@ mod tests {
            environment: vec![
                "BITCOIN_RPC_USER=archipelago".into(),
                "BITCOIN_RPC_PASS=secret".into(),
+                "RELAY_NAME=Archipelago Nostr Relay".into(),
            ],
            devices: vec!["/dev/kvm".into()],
            add_hosts: vec![("host.archipelago".into(), "10.89.0.1".into())],
@@ -813,6 +847,7 @@ mod tests {
        assert!(s.contains("PublishPort=8333:8333/tcp"));
        assert!(s.contains("Environment=BITCOIN_RPC_USER=archipelago"));
        assert!(s.contains("Environment=BITCOIN_RPC_PASS=secret"));
+        assert!(s.contains("Environment=\"RELAY_NAME=Archipelago Nostr Relay\""));
        assert!(s.contains("AddDevice=/dev/kvm"));
        assert!(s.contains("AddHost=host.archipelago:10.89.0.1"));
        assert!(s.contains("ReadOnly=true"));
@@ -8,7 +8,7 @@ use crate::data_model::{Notification, NotificationLevel, PackageState};
 use crate::state::StateManager;
 use crate::webhooks::{self, WebhookEvent};
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 use std::time::Instant;
@@ -420,6 +420,9 @@ async fn check_containers() -> Vec<ContainerHealth> {
    let stdout = String::from_utf8_lossy(&output.stdout);
    let containers: Vec<serde_json::Value> = serde_json::from_str(&stdout).unwrap_or_default();

+    let live_container_ids = live_container_ids(&containers);
+    cleanup_stale_podman_healthcheck_units(&live_container_ids).await;
+
    // Monitor ALL long-running containers for health — backend services (databases,
    // nbxplorer, mempool-api) and UI containers need auto-restart too.
    // Only skip ephemeral containers (build infrastructure, init one-shots).
@@ -462,6 +465,161 @@ async fn check_containers() -> Vec<ContainerHealth> {
        .collect()
 }

+fn live_container_ids(containers: &[serde_json::Value]) -> HashSet<String> {
+    containers
+        .iter()
+        .filter_map(|c| {
+            c.get("Id")
+                .or_else(|| c.get("ID"))
+                .and_then(|v| v.as_str())
+                .map(|s| s.to_string())
+        })
+        .collect()
+}
+
+async fn cleanup_stale_podman_healthcheck_units(live_container_ids: &HashSet<String>) {
+    if live_container_ids.is_empty() {
+        return;
+    }
+
+    let mut units = stale_healthcheck_units_from_systemd(live_container_ids).await;
+    if units.is_empty() {
+        return;
+    }
+    units.sort();
+    units.dedup();
+
+    let mut cleaned = 0;
+    for unit in units {
+        let Some(container_id) = parse_podman_healthcheck_unit(&unit) else {
+            continue;
+        };
+        let service = format!("{}.service", unit.trim_end_matches(".timer"));
+        if stop_user_unit(&unit).await {
+            cleaned += 1;
+        }
+        let _ = stop_user_unit(&service).await;
+        let _ = reset_failed_user_unit(&service).await;
+        debug!(
+            "Stopped stale Podman healthcheck unit {} for removed container {}",
+            unit, container_id
+        );
+    }
+
+    if cleaned > 0 {
+        info!("Cleaned {} stale Podman healthcheck timer(s)", cleaned);
+    }
+}
+
+async fn stale_healthcheck_units_from_systemd(live_container_ids: &HashSet<String>) -> Vec<String> {
+    let mut units = Vec::new();
+    for args in [
+        [
+            "--user",
+            "list-timers",
+            "--all",
+            "--no-legend",
+            "--no-pager",
+        ]
+        .as_slice(),
+        ["--user", "list-units", "--all", "--no-legend", "--no-pager"].as_slice(),
+    ] {
+        let output = match tokio::time::timeout(
+            std::time::Duration::from_secs(20),
+            tokio::process::Command::new("systemctl")
+                .args(args.iter().copied())
+                .output(),
+        )
+        .await
+        {
+            Ok(Ok(output)) if output.status.success() => output,
+            Ok(Ok(output)) => {
+                let stderr = String::from_utf8_lossy(&output.stderr);
+                debug!("systemctl {} failed: {}", args.join(" "), stderr.trim());
+                continue;
+            }
+            Ok(Err(e)) => {
+                debug!("Failed to run systemctl {}: {}", args.join(" "), e);
+                continue;
+            }
+            Err(_) => {
+                debug!("systemctl {} timed out", args.join(" "));
+                continue;
+            }
+        };
+
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        units.extend(stale_healthcheck_units(&stdout, live_container_ids));
+    }
+    units
+}
+
+fn stale_healthcheck_units(output: &str, live_container_ids: &HashSet<String>) -> Vec<String> {
+    output
+        .lines()
+        .flat_map(|line| line.split_whitespace())
+        .filter_map(|token| {
+            let unit = token.trim_start_matches('●');
+            let id = parse_podman_healthcheck_unit(unit)?;
+            (!live_container_ids.contains(id)).then(|| unit.to_string())
+        })
+        .collect()
+}
+
+fn parse_podman_healthcheck_unit(unit: &str) -> Option<&str> {
+    let unit = unit
+        .strip_suffix(".timer")
+        .or_else(|| unit.strip_suffix(".service"))?;
+    let (container_id, _suffix) = unit.split_once('-')?;
+    if container_id.len() == 64 && container_id.bytes().all(|b| b.is_ascii_hexdigit()) {
+        Some(container_id)
+    } else {
+        None
+    }
+}
+
+async fn stop_user_unit(unit: &str) -> bool {
+    run_systemctl_user(["stop", unit]).await
+}
+
+async fn reset_failed_user_unit(unit: &str) -> bool {
+    run_systemctl_user(["reset-failed", unit]).await
+}
+
+async fn run_systemctl_user<const N: usize>(args: [&str; N]) -> bool {
+    let output = match tokio::time::timeout(
+        std::time::Duration::from_secs(10),
+        tokio::process::Command::new("systemctl")
+            .arg("--user")
+            .args(args.iter().copied())
+            .output(),
+    )
+    .await
+    {
+        Ok(Ok(output)) => output,
+        Ok(Err(e)) => {
+            debug!("Failed to run systemctl --user {}: {}", args.join(" "), e);
+            return false;
+        }
+        Err(_) => {
+            debug!("systemctl --user {} timed out", args.join(" "));
+            return false;
+        }
+    };
+
+    if output.status.success() {
+        true
+    } else {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        debug!(
+            "systemctl --user {} failed: {}",
+            args.join(" "),
+            stderr.trim()
+        );
+        false
+    }
+}
+
 fn parse_podman_health(c: &serde_json::Value, state: &str) -> Option<String> {
    c.get("Status")
        .and_then(|v| v.as_str())
@@ -625,6 +783,14 @@ pub fn spawn_health_monitor(state: Arc<StateManager>, data_dir: PathBuf) {
                }

                if container.healthy {
+                    let before = data.notifications.len();
+                    data.notifications.retain(|n| {
+                        n.app_id.as_deref() != Some(&container.app_id)
+                            && !n.title.contains(&container.app_id)
+                    });
+                    if data.notifications.len() != before {
+                        state_changed = true;
+                    }
                    if tracker.attempt_count(&container.name) > 0 {
                        info!(
                            "Container {} is healthy again after restart",
@@ -674,6 +840,21 @@ pub fn spawn_health_monitor(state: Arc<StateManager>, data_dir: PathBuf) {
                }
            }

+            let unhealthy_app_ids: HashSet<&str> = unhealthy
+                .iter()
+                .map(|container| container.app_id.as_str())
+                .collect();
+            let before = data.notifications.len();
+            data.notifications.retain(|n| {
+                !n.id.starts_with("health-")
+                    || n.app_id
+                        .as_deref()
+                        .is_some_and(|app_id| unhealthy_app_ids.contains(app_id))
+            });
+            if data.notifications.len() != before {
+                state_changed = true;
+            }
+
            // Sort by startup tier: databases first, then core, then dependent, then apps, then UIs
            unhealthy.sort_by_key(|c| container_tier(&c.name));

@@ -1173,4 +1354,49 @@ mod tests {
            Some("unhealthy")
        );
    }
+
+    #[test]
+    fn parses_podman_healthcheck_systemd_units() {
+        let id = "c1f44a6369c91d65f9e9f6134a5591aa02792cff2f1a4e0f689b5a6c03b6c77c";
+        assert_eq!(
+            parse_podman_healthcheck_unit(&format!("{}-15c66ddfefa8a763.timer", id)),
+            Some(id)
+        );
+        assert_eq!(
+            parse_podman_healthcheck_unit(&format!("{}-15c66ddfefa8a763.service", id)),
+            Some(id)
+        );
+        assert_eq!(parse_podman_healthcheck_unit("grafana.service"), None);
+        assert_eq!(
+            parse_podman_healthcheck_unit(
+                "nothexzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz-x.timer"
+            ),
+            None
+        );
+    }
+
+    #[test]
+    fn stale_healthcheck_units_filters_only_removed_container_ids() {
+        let live = "6467e25fd87d791a63fe9dbf6e2fabc7bf26533aa2c402b1089effeacf7ebbba";
+        let stale = "c1f44a6369c91d65f9e9f6134a5591aa02792cff2f1a4e0f689b5a6c03b6c77c";
+        let mut live_ids = HashSet::new();
+        live_ids.insert(live.to_string());
+
+        let output = format!(
+            "  {live}-6fdc497fd3ba3b62.timer loaded active waiting\n\
+             ● {stale}-15c66ddfefa8a763.service loaded failed failed\n\
+             grafana.service loaded active running\n\
+             {stale}-1898d85de0bb707f.timer loaded active waiting\n"
+        );
+
+        let mut units = stale_healthcheck_units(&output, &live_ids);
+        units.sort();
+        assert_eq!(
+            units,
+            vec![
+                format!("{stale}-15c66ddfefa8a763.service"),
+                format!("{stale}-1898d85de0bb707f.timer"),
+            ]
+        );
+    }
 }
@@ -28,7 +28,6 @@ const RESERVED_PORTS: &[u16] = &[
    8888, // SearXNG
    8096, 2342, 2283, // Jellyfin, Photoprism, Immich
    8443, // FIPS TCP fallback
-    8444, 8084, // NPM
 ];

 /// Start of range for allocating web app ports when preferred is taken.
@@ -94,8 +93,12 @@ impl PortAllocator {
            .any(|m| m.host_port == port)
    }

+    fn can_bind(port: u16) -> bool {
+        std::net::TcpListener::bind(("0.0.0.0", port)).is_ok()
+    }
+
    fn is_available(&self, port: u16) -> bool {
-        !self.is_reserved(port) && !self.is_allocated(port)
+        !self.is_reserved(port) && !self.is_allocated(port) && Self::can_bind(port)
    }

    /// Allocate a host port for an app. Uses preferred_port if available, else finds next free.
@@ -127,7 +127,7 @@ impl PodmanClient {
            "photoprism" => "http://localhost:2342",
            "immich_server" | "immich" => "http://localhost:2283",
            "filebrowser" => "http://localhost:8083",
-            "nginx-proxy-manager" => "http://localhost:81",
+            "nginx-proxy-manager" => "http://localhost:8081",
            "portainer" => "http://localhost:9000",
            "uptime-kuma" => "http://localhost:3002",
            "fedimint" | "fedimintd" => "http://localhost:8175",
@@ -316,9 +316,15 @@ RUN apt-get update && apt-get -y full-upgrade && apt-get install -y --no-install
    dbus \
    sudo \
    network-manager \
+    wpasupplicant \
+    wireless-regdb \
+    iw \
+    rfkill \
+    polkitd \
    openssh-server \
    nginx \
    podman \
+    catatonit \
    uidmap \
    slirp4netns \
    passt \
@@ -455,8 +461,21 @@ RUN mkdir -p /etc/systemd/system/user@.service.d && \
 # Allow unprivileged ping inside rootless containers
 RUN printf 'net.ipv4.ping_group_range=0 2147483647\n' > /etc/sysctl.d/90-podman-ping.conf

+# Archipelago's web UI manages Wi-Fi through the backend service, not a local
+# desktop seat. Allow the dedicated system user to control NetworkManager.
+RUN mkdir -p /etc/polkit-1/rules.d && \
+    printf '%s\n' \
+      'polkit.addRule(function(action, subject) {' \
+      '    if (subject.user == "archipelago" && action.id.indexOf("org.freedesktop.NetworkManager.") == 0) {' \
+      '        return polkit.Result.YES;' \
+      '    }' \
+      '});' \
+      > /etc/polkit-1/rules.d/49-archipelago-networkmanager.rules && \
+    chmod 644 /etc/polkit-1/rules.d/49-archipelago-networkmanager.rules
+
 # Enable services
 RUN systemctl enable NetworkManager || true && \
+    systemctl enable polkit || systemctl enable polkit.service || true && \
    systemctl enable ssh || true && \
    systemctl enable nginx || true && \
    systemctl enable archipelago || true && \
@@ -696,6 +715,7 @@ kmod,procps,iproute2,ca-certificates,gdisk,\
 cryptsetup,cryptsetup-initramfs,parted,dosfstools,e2fsprogs,\
 linux-image-${DEB_ARCH},grub-efi-${DEB_ARCH},grub-pc-bin,\
 ifupdown,isc-dhcp-client,\
+wpasupplicant,wireless-regdb,iw,rfkill,\
 pciutils,usbutils,less,nano \
    trixie /installer http://deb.debian.org/debian

@@ -1100,12 +1120,15 @@ if [ "$BACKEND_CAPTURED" = "0" ]; then
 FROM rust:1.93-trixie as builder
 WORKDIR /build
 COPY core ./core
+COPY scripts ./scripts
+COPY image-recipe/configs ./image-recipe/configs
 RUN cd core && cargo build --release --bin archipelago
 BACKENDFILE

-    if $CONTAINER_CMD build --platform $CONTAINER_PLATFORM -t archipelago-backend -f "$BACKEND_DOCKERFILE" "$SCRIPT_DIR/.." 2>&1 | tail -20; then
+    BACKEND_IMAGE="localhost/archipelago-backend:iso"
+    if $CONTAINER_CMD build --platform $CONTAINER_PLATFORM -t "$BACKEND_IMAGE" -f "$BACKEND_DOCKERFILE" "$SCRIPT_DIR/.."; then
        echo "   Extracting backend binary..."
-        BACKEND_CONTAINER=$($CONTAINER_CMD create --platform $CONTAINER_PLATFORM archipelago-backend)
+        BACKEND_CONTAINER=$($CONTAINER_CMD create --platform $CONTAINER_PLATFORM "$BACKEND_IMAGE")
        $CONTAINER_CMD cp "$BACKEND_CONTAINER:/build/core/target/release/archipelago" "$ARCH_DIR/bin/" && \
            echo "   ✅ Backend binary built ($(du -h "$ARCH_DIR/bin/archipelago" | cut -f1))"
        $CONTAINER_CMD rm "$BACKEND_CONTAINER"
@@ -166,7 +166,14 @@ chroot /mnt/archipelago apt-get install -y linux-image-amd64 grub-efi-amd64 grub
 echo "📦 Installing essential packages..."
 chroot /mnt/archipelago apt-get install -y \
    sudo \
-    networkmanager \
+    network-manager \
+    wpasupplicant \
+    wireless-regdb \
+    iw \
+    rfkill \
+    pciutils \
+    usbutils \
+    polkitd \
    openssh-server \
    curl \
    wget \
@@ -176,7 +183,7 @@ chroot /mnt/archipelago apt-get install -y \
    chrony

 echo "📦 Installing container tools..."
-chroot /mnt/archipelago apt-get install -y podman || echo "⚠️  Podman not available in base repos, will use containers.io later"
+chroot /mnt/archipelago apt-get install -y podman catatonit || echo "⚠️  Podman/catatonit not available in base repos, will use containers.io later"

 echo "🔧 Installing GRUB bootloader..."
 # Need to run grub-install inside chroot with proper environment
@@ -198,9 +205,20 @@ echo "archipelago:archipelago" | chroot /mnt/archipelago chpasswd

 echo "⚙️  Enabling services..."
 chroot /mnt/archipelago systemctl enable NetworkManager || true
+chroot /mnt/archipelago systemctl enable polkit || chroot /mnt/archipelago systemctl enable polkit.service || true
 chroot /mnt/archipelago systemctl enable ssh || chroot /mnt/archipelago systemctl enable sshd || true
 chroot /mnt/archipelago systemctl enable chrony || true

+mkdir -p /mnt/archipelago/etc/polkit-1/rules.d
+cat > /mnt/archipelago/etc/polkit-1/rules.d/49-archipelago-networkmanager.rules <<'EOF'
+polkit.addRule(function(action, subject) {
+    if (subject.user == "archipelago" && action.id.indexOf("org.freedesktop.NetworkManager.") == 0) {
+        return polkit.Result.YES;
+    }
+});
+EOF
+chmod 644 /mnt/archipelago/etc/polkit-1/rules.d/49-archipelago-networkmanager.rules
+
 # Remove policy-rc.d so services can start on first boot
 rm -f /mnt/archipelago/usr/sbin/policy-rc.d

@@ -741,7 +741,7 @@ server {
        sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
    }
    location /app/nginx-proxy-manager/ {
-        proxy_pass http://127.0.0.1:81/;
+        proxy_pass http://127.0.0.1:8081/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
@@ -873,6 +873,23 @@ server {
    }
 }

+# Compatibility proxy for cached PWA bundles that still launch Nginx Proxy
+# Manager on :81. Rootless Podman cannot bind host ports below 1024, so the
+# container admin UI runs on :8081 and host nginx owns the old :81 entrypoint.
+server {
+    listen 81;
+    server_name _;
+
+    location / {
+        proxy_pass http://127.0.0.1:8081/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
 # HTTPS - required for PWA install (Add to Home Screen) from dev servers
 server {
    listen 443 ssl;
@@ -358,7 +358,7 @@ location /app/indeedhub/ {
    sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
 }
 location /app/nginx-proxy-manager/ {
-    proxy_pass http://127.0.0.1:81/;
+    proxy_pass http://127.0.0.1:8081/;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
@@ -1,12 +1,12 @@
 {
  "name": "neode-ui",
-  "version": "1.7.55-alpha",
+  "version": "1.7.57-alpha",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "neode-ui",
-      "version": "1.7.55-alpha",
+      "version": "1.7.57-alpha",
      "dependencies": {
        "@types/dompurify": "^3.0.5",
        "@vue-leaflet/vue-leaflet": "^0.10.1",
@@ -1,7 +1,7 @@
 {
  "name": "neode-ui",
  "private": true,
-  "version": "1.7.55-alpha",
+  "version": "1.7.57-alpha",
  "type": "module",
  "scripts": {
    "start": "./start-dev.sh",
@@ -161,7 +161,7 @@ function onKeyDown(e: KeyboardEvent) {
  }
  // 's' key activates screensaver when authenticated (skip if typing in input)
  if (e.key === 's' || e.key === 'S') {
-    if (!isInput && appStore.isAuthenticated && !screensaverStore.isActive) {
+    if (!isInput && appStore.isAuthenticated && !screensaverStore.isActive && !screensaverStore.isSuppressed) {
      e.preventDefault()
      screensaverStore.activate()
    }
@@ -98,7 +98,7 @@ describe('useAppLauncherStore', () => {
    expect(store.panelAppId).toBe('btcpay-server')
  })

-  it('opens Nginx Proxy Manager in new tab even when URL resolves', () => {
+  it('normalizes old Nginx Proxy Manager port 81 to 8081', () => {
    const store = useAppLauncherStore()

    store.open({ url: 'http://192.168.1.228:81', title: 'Nginx Proxy Manager' })
@@ -106,7 +106,7 @@ describe('useAppLauncherStore', () => {
    expect(store.isOpen).toBe(false)
    expect(store.panelAppId).toBe(null)
    expect(mockWindowOpen).toHaveBeenCalledWith(
-      'http://192.168.1.228:81',
+      'http://192.168.1.228:8081',
      '_blank',
      'noopener,noreferrer',
    )
@@ -125,13 +125,13 @@ describe('useAppLauncherStore', () => {
    expect(store.panelAppId).toBe(null)
  })

-  it('normalizes legacy Nginx Proxy Manager port 8181 to 81', () => {
+  it('normalizes legacy Nginx Proxy Manager ports to 8081', () => {
    const store = useAppLauncherStore()

    store.open({ url: 'http://192.168.1.228:8181', title: 'Nginx Proxy Manager' })

    expect(mockWindowOpen).toHaveBeenCalledWith(
-      'http://192.168.1.228:81',
+      'http://192.168.1.228:8081',
      '_blank',
      'noopener,noreferrer',
    )
@@ -68,6 +68,24 @@ describe('useScreensaverStore', () => {
    expect(store.isActive).toBe(false)
  })

+  it('suppression prevents automatic and manual activation until resumed', () => {
+    const store = useScreensaverStore()
+    store.suppress('video')
+    expect(store.isSuppressed).toBe(true)
+
+    store.resetInactivityTimer()
+    vi.advanceTimersByTime(5 * 60 * 1000)
+    expect(store.isActive).toBe(false)
+
+    store.activate()
+    expect(store.isActive).toBe(false)
+
+    store.resume('video')
+    expect(store.isSuppressed).toBe(false)
+    vi.advanceTimersByTime(3 * 60 * 1000)
+    expect(store.isActive).toBe(true)
+  })
+
  it('activate clears any pending timer', () => {
    const store = useScreensaverStore()
    store.deactivate()
@@ -61,8 +61,8 @@ function normalizeLaunchUrl(urlStr: string, appIdHint?: string | null): string {
      return rebuilt('3002')
    }

-    if (sameHost && appIdHint === 'nginx-proxy-manager' && u.port === '8181') {
-      return rebuilt('81')
+    if (sameHost && appIdHint === 'nginx-proxy-manager' && (u.port === '81' || u.port === '8181')) {
+      return rebuilt('8081')
    }

    return rewrittenLocalhost ? u.toString() : urlStr
@@ -74,6 +74,7 @@ function normalizeLaunchUrl(urlStr: string, appIdHint?: string | null): string {
 /** Port → app ID for resolving URLs to AppSession routes */
 const PORT_TO_APP_ID: Record<string, string> = {
  '81': 'nginx-proxy-manager',
+  '8081': 'nginx-proxy-manager',
  '8181': 'nginx-proxy-manager',
  '3000': 'grafana',
  '3002': 'uptime-kuma',
@@ -6,12 +6,15 @@ const INACTIVITY_MS = 3 * 60 * 1000 // 3 minutes
 export const useScreensaverStore = defineStore('screensaver', () => {
  const isActive = ref(false)
  const activationCount = ref(0)
+  const suppressionReasons = ref<Set<string>>(new Set())
  let inactivityTimer: ReturnType<typeof setTimeout> | null = null

  /** True when the current activation is the ASCII variant (every 3rd time) */
  const isAsciiMode = computed(() => activationCount.value > 0 && activationCount.value % 3 === 0)
+  const isSuppressed = computed(() => suppressionReasons.value.size > 0)

  function activate() {
+    if (isSuppressed.value) return
    activationCount.value++
    isActive.value = true
    clearInactivityTimer()
@@ -24,8 +27,10 @@ export const useScreensaverStore = defineStore('screensaver', () => {

  function resetInactivityTimer() {
    clearInactivityTimer()
+    if (isSuppressed.value) return
    inactivityTimer = setTimeout(() => {
      inactivityTimer = null
+      if (isSuppressed.value) return
      isActive.value = true
    }, INACTIVITY_MS)
  }
@@ -37,13 +42,30 @@ export const useScreensaverStore = defineStore('screensaver', () => {
    }
  }

+  function suppress(reason: string) {
+    suppressionReasons.value = new Set(suppressionReasons.value).add(reason)
+    clearInactivityTimer()
+    isActive.value = false
+  }
+
+  function resume(reason: string) {
+    if (!suppressionReasons.value.has(reason)) return
+    const next = new Set(suppressionReasons.value)
+    next.delete(reason)
+    suppressionReasons.value = next
+    if (next.size === 0) resetInactivityTimer()
+  }
+
  return {
    isActive,
    isAsciiMode,
+    isSuppressed,
    activationCount,
    activate,
    deactivate,
    resetInactivityTimer,
    clearInactivityTimer,
+    suppress,
+    resume,
  }
 })
@@ -140,6 +140,8 @@ import { rpcClient } from '@/api/rpc-client'
 import AppHeroSection from './appDetails/AppHeroSection.vue'
 import AppContentSection from './appDetails/AppContentSection.vue'
 import AppSidebar from './appDetails/AppSidebar.vue'
+import { resolveAppUrl } from './appSession/appSessionConfig'
+import { isWebsitePackage, resolveRuntimeLaunchUrl } from './apps/appsConfig'
 import {
  WEB_ONLY_APP_URLS,
  PACKAGE_ALIASES,
@@ -266,7 +268,9 @@ const backButtonText = computed(() => {
 const canLaunch = computed(() => {
  if (!pkg.value) return false
  if (isWebOnly.value) return true
-  const hasUI = !!(pkg.value.manifest.interfaces?.main?.ui || pkg.value.installed?.['interface-addresses']?.main)
+  const hasRuntimeAddress = !!pkg.value.installed?.['interface-addresses']?.main?.['lan-address']
+  const hasKnownLaunchUrl = typeof window !== 'undefined' && !!resolveAppUrl(pkg.value.manifest.id)
+  const hasUI = !!(pkg.value.manifest.interfaces?.main?.ui || hasRuntimeAddress || hasKnownLaunchUrl)
  return hasUI && pkg.value.state === 'running' && pkg.value.health !== 'starting' && pkg.value.health !== 'unhealthy'
 })

@@ -291,6 +295,18 @@ function launchApp() {
    return
  }

+  if (isWebsitePackage(id, pkg.value)) {
+    const url = resolveRuntimeLaunchUrl(pkg.value)
+    if (url) window.open(url, '_blank', 'noopener,noreferrer')
+    return
+  }
+
+  const runtimeUrl = resolveRuntimeLaunchUrl(pkg.value)
+  if (runtimeUrl) {
+    useAppLauncherStore().open({ url: runtimeUrl, title: pkg.value.manifest.title })
+    return
+  }
+
  // Container apps should launch through session routing so protocol/path
  // handling stays centralized in appSessionConfig.
  useAppLauncherStore().openSession(id)
@@ -91,6 +91,7 @@
 import { ref, computed, onMounted, onBeforeUnmount, watch } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 import { useAppLauncherStore } from '@/stores/appLauncher'
+import { useScreensaverStore } from '@/stores/screensaver'
 import NostrIdentityPicker from '@/components/NostrIdentityPicker.vue'
 import AppSessionHeader from './appSession/AppSessionHeader.vue'
 import AppSessionFrame from './appSession/AppSessionFrame.vue'
@@ -115,6 +116,7 @@ const isInlinePanel = computed(() => !!props.appIdProp)

 const route = useRoute()
 const router = useRouter()
+const screensaverStore = useScreensaverStore()

 const sessionRef = ref<HTMLElement | null>(null)
 const frameRef = ref<InstanceType<typeof AppSessionFrame> | null>(null)
@@ -145,6 +147,14 @@ const appId = computed(() => {
 const appTitle = computed(() => resolveAppTitle(appId.value))
 const isMobile = typeof window !== 'undefined' && window.innerWidth < 768
 const mustOpenNewTab = computed(() => NEW_TAB_APPS.has(appId.value))
+const screensaverReason = computed(() => `app-session:${appId.value}`)
+const screensaverSuppressedApps = new Set([
+  'indeedhub',
+  'jellyfin',
+  'immich',
+  'photoprism',
+  'filebrowser',
+])

 const appUrl = computed(() => {
  return resolveAppUrl(appId.value, route.query.path as string | undefined)
@@ -306,6 +316,8 @@ function onFullscreenChange() {
 function onMessage(e: MessageEvent) {
  if (e.data?.type === 'nostr-request') nostrBridge.handleNostrRequest(e)
  if (e.data?.type === 'archipelago:identity:request') identity.handleIdentityRequest()
+  if (e.data?.type === 'archipelago:media:playing') screensaverStore.suppress(screensaverReason.value)
+  if (e.data?.type === 'archipelago:media:idle') screensaverStore.resume(screensaverReason.value)
 }

 // Enter fullscreen on mount if mode is fullscreen
@@ -338,6 +350,9 @@ onMounted(() => {
      sessionRef.value?.requestFullscreen().catch(() => {})
    })
  }
+  if (screensaverSuppressedApps.has(appId.value)) {
+    screensaverStore.suppress(screensaverReason.value)
+  }
 })

 onBeforeUnmount(() => {
@@ -347,6 +362,7 @@ onBeforeUnmount(() => {
  window.removeEventListener('keydown', onKeyDown, true)
  window.removeEventListener('message', onMessage)
  document.removeEventListener('fullscreenchange', onFullscreenChange)
+  screensaverStore.resume(screensaverReason.value)
  if (document.fullscreenElement) document.exitFullscreen().catch(() => {})
 })
 </script>
@@ -7,7 +7,7 @@
        <div class="mode-switcher flex-shrink-0">
          <button class="mode-switcher-btn" :class="{ 'mode-switcher-btn-active': activeTab === 'apps' }" @click="activeTab = 'apps'; router.replace({ query: {} })">My Apps</button>
          <RouterLink to="/dashboard/discover" class="mode-switcher-btn">App Store</RouterLink>
-          <button class="mode-switcher-btn" :class="{ 'mode-switcher-btn-active': activeTab === 'services' }" @click="activeTab = 'services'; router.replace({ query: { tab: 'services' } })">Services</button>
+          <button class="mode-switcher-btn" :class="{ 'mode-switcher-btn-active': activeTab === 'websites' }" @click="activeTab = 'websites'; router.replace({ query: { tab: 'websites' } })">Websites</button>
        </div>
        <div v-if="activeTab === 'apps' && categoriesWithApps.length > 1" class="mode-switcher flex-shrink-0">
          <button
@@ -155,7 +155,7 @@ import AppIconGrid from './apps/AppIconGrid.vue'
 import AppsUninstallModal from './apps/AppsUninstallModal.vue'
 import { useAppsActions } from './apps/useAppsActions'
 import {
-  filterEntriesForTab, isWebOnlyApp,
+  type AppsTab, filterEntriesForTab, isWebOnlyApp, isWebsitePackage, opensInTab, resolveRuntimeLaunchUrl,
  WEB_ONLY_APPS, buildAllCategories, useCategoriesWithApps,
 } from './apps/appsConfig'

@@ -170,8 +170,8 @@ const actions = useAppsActions()
 const showStagger = !appsAnimationDone

 // Tabs
-const activeTab = ref<'apps' | 'services'>(
-  route.query.tab === 'services' ? 'services' : 'apps'
+const activeTab = ref<AppsTab>(
+  route.query.tab === 'websites' || route.query.tab === 'services' ? 'websites' : 'apps'
 )

 // Search (debounced)
@@ -285,6 +285,19 @@ function goToApp(id: string) {
 }

 function launchApp(id: string) {
+  const pkg = packages.value[id]
+  if (pkg && isWebsitePackage(id, pkg)) {
+    const url = resolveRuntimeLaunchUrl(pkg)
+    if (url) window.open(url, '_blank', 'noopener,noreferrer')
+    return
+  }
+  if (pkg && opensInTab(id)) {
+    const url = resolveRuntimeLaunchUrl(pkg)
+    if (url) {
+      window.open(url, '_blank', 'noopener,noreferrer')
+      return
+    }
+  }
  useAppLauncherStore().openSession(id)
 }

@@ -7,7 +7,7 @@
        <div class="mode-switcher flex-shrink-0">
          <RouterLink to="/dashboard/apps" class="mode-switcher-btn">My Apps</RouterLink>
          <RouterLink to="/dashboard/discover" class="mode-switcher-btn mode-switcher-btn-active">App Store</RouterLink>
-          <RouterLink to="/dashboard/apps?tab=services" class="mode-switcher-btn">Services</RouterLink>
+          <RouterLink to="/dashboard/apps?tab=websites" class="mode-switcher-btn">Websites</RouterLink>
        </div>
        <div class="mode-switcher flex-shrink-0">
          <RouterLink
@@ -7,7 +7,7 @@
        <div class="mode-switcher flex-shrink-0">
          <RouterLink to="/dashboard/apps" class="mode-switcher-btn">My Apps</RouterLink>
          <RouterLink to="/dashboard/discover" class="mode-switcher-btn mode-switcher-btn-active">App Store</RouterLink>
-          <RouterLink to="/dashboard/apps?tab=services" class="mode-switcher-btn">Services</RouterLink>
+          <RouterLink to="/dashboard/apps?tab=websites" class="mode-switcher-btn">Websites</RouterLink>
        </div>
        <div class="mode-switcher flex-shrink-0">
          <RouterLink
@@ -83,7 +83,7 @@ export const APP_URLS: Record<string, { dev: string; prod: string }> = {
  'photoprism': { dev: 'http://localhost:2342', prod: 'http://localhost:2342' },
  'immich': { dev: 'http://localhost:2283', prod: 'http://localhost:2283' },
  'filebrowser': { dev: 'http://localhost:8083', prod: 'http://localhost:8083' },
-  'nginx-proxy-manager': { dev: 'http://localhost:81', prod: 'http://localhost:81' },
+  'nginx-proxy-manager': { dev: 'http://localhost:8081', prod: 'http://localhost:8081' },
  'gitea': { dev: 'http://localhost:3001', prod: 'http://localhost:3001' },
  'portainer': { dev: 'http://localhost:9000', prod: 'http://localhost:9000' },
  'uptime-kuma': { dev: 'http://localhost:3002', prod: 'http://localhost:3002' },
@@ -160,7 +160,7 @@ export function getStatusLabel(state: PackageState, health?: string | null, exit
  if (state === PackageState.Running && health === 'unhealthy') return 'unhealthy'
  if (state === PackageState.Running && health === 'healthy') return 'healthy'
  if (state === PackageState.Exited) {
-    if (exitCode === 137) return 'killed (OOM)'
+    if (exitCode === 137) return 'killed (SIGKILL)'
    if (exitCode != null && exitCode !== 0) return 'crashed'
    return 'stopped'
  }
@@ -31,7 +31,7 @@ export const APP_PORTS: Record<string, number> = {
  'immich':        2283,
  'immich_server': 2283,
  'filebrowser':   8083,
-  'nginx-proxy-manager': 81,
+  'nginx-proxy-manager': 8081,
  'gitea':         3001,
  'portainer':     9000,
  'tailscale':     8240,
@@ -79,7 +79,7 @@ import { useServerStore } from '@/stores/server'
 import { useAppLauncherStore } from '@/stores/appLauncher'
 import type { PackageDataEntry } from '@/types/api'
 import { resolveAppUrl } from '@/views/appSession/appSessionConfig'
-import { canLaunch, handleImageError, opensInTab, resolveAppIcon } from './appsConfig'
+import { canLaunch, handleImageError, isWebsitePackage, opensInTab, resolveAppIcon, resolveRuntimeLaunchUrl } from './appsConfig'
 import { getCuratedAppList } from '../discover/curatedApps'

 const ITEMS_PER_PAGE = 16 // 4 columns x 4 rows
@@ -120,8 +120,15 @@ function getIcon(id: string, pkg: PackageDataEntry): string {

 function handleTap(id: string, pkg: PackageDataEntry) {
  if (canLaunch(pkg)) {
+    if (isWebsitePackage(id, pkg)) {
+      const url = resolveRuntimeLaunchUrl(pkg)
+      if (url) {
+        window.open(url, '_blank', 'noopener,noreferrer')
+        return
+      }
+    }
    if (opensInTab(id)) {
-      const appUrl = resolveAppUrl(id)
+      const appUrl = resolveRuntimeLaunchUrl(pkg) || resolveAppUrl(id)
      if (appUrl) {
        window.open(appUrl, '_blank', 'noopener,noreferrer')
        return
@@ -3,6 +3,9 @@
 import type { Ref } from 'vue'
 import { computed } from 'vue'
 import { PackageState, type PackageDataEntry } from '@/types/api'
+import { resolveAppUrl } from '../appSession/appSessionConfig'
+
+export type AppsTab = 'apps' | 'websites' | 'services'

 // Service container name patterns (backend/infra, not user-facing)
 export const SERVICE_NAMES = new Set([
@@ -21,6 +24,15 @@ export const SERVICE_NAMES = new Set([
  'syntropy-institute', 't-zero', 'arch-presentation',
 ])

+const INTERNAL_TOOLING_NAMES = new Set([
+  'buildx_buildkit_default',
+])
+
+export function isInternalToolingPackage(id: string, pkg?: PackageDataEntry): boolean {
+  const manifestId = pkg?.manifest?.id || ''
+  return INTERNAL_TOOLING_NAMES.has(id) || INTERNAL_TOOLING_NAMES.has(manifestId) || id.startsWith('buildx_buildkit') || manifestId.startsWith('buildx_buildkit')
+}
+
 export function isServiceContainer(id: string): boolean {
  if (SERVICE_NAMES.has(id)) return true
  if (id.startsWith('indeedhub-build_')) return true
@@ -57,14 +69,32 @@ export function getAppCategory(id: string, pkg: PackageDataEntry): string {
  return cat || 'other'
 }

+export function runtimeLanAddress(pkg: PackageDataEntry): string {
+  return pkg.installed?.['interface-addresses']?.main?.['lan-address'] || ''
+}
+
+export function isKnownApp(id: string, pkg?: PackageDataEntry): boolean {
+  const manifestId = pkg?.manifest?.id
+  return !!(APP_CATEGORY_MAP[id] || (manifestId && APP_CATEGORY_MAP[manifestId]) || isWebOnlyApp(id))
+}
+
+export function isWebsitePackage(id: string, pkg?: PackageDataEntry): boolean {
+  if (isInternalToolingPackage(id, pkg)) return false
+  if (isServicePackage(id, pkg)) return true
+  if (isKnownApp(id, pkg)) return false
+  return !!pkg && !!runtimeLanAddress(pkg)
+}
+
 export function filterEntriesForTab(
  entries: Array<[string, PackageDataEntry]>,
-  activeTab: 'apps' | 'services',
+  activeTab: AppsTab,
  selectedCategory: string,
 ): Array<[string, PackageDataEntry]> {
  return entries.filter(([id, pkg]) => {
-    const isSvc = isServicePackage(id, pkg)
-    if (activeTab === 'services' ? !isSvc : isSvc) return false
+    if (isInternalToolingPackage(id, pkg)) return false
+    const wantsWebsites = activeTab === 'websites' || activeTab === 'services'
+    const isWebsite = isWebsitePackage(id, pkg)
+    if (wantsWebsites ? !isWebsite : isWebsite) return false
    if (activeTab === 'apps' && selectedCategory !== 'all') {
      return getAppCategory(id, pkg) === selectedCategory
    }
@@ -144,10 +174,18 @@ export function resolveAppIcon(id: string, pkg: PackageDataEntry, curatedIcon?:

 export function canLaunch(pkg: PackageDataEntry): boolean {
  if (isWebOnlyApp(pkg.manifest.id)) return true
-  const hasUI = pkg.manifest.interfaces?.main?.ui || pkg.installed?.['interface-addresses']?.main
+  const hasRuntimeAddress = !!pkg.installed?.['interface-addresses']?.main?.['lan-address']
+  const hasKnownLaunchUrl = typeof window !== 'undefined' && !!resolveAppUrl(pkg.manifest.id)
+  const hasUI = pkg.manifest.interfaces?.main?.ui || hasRuntimeAddress || hasKnownLaunchUrl
  return !!hasUI && pkg.state === 'running' && pkg.health !== 'starting' && pkg.health !== 'unhealthy'
 }

+export function resolveRuntimeLaunchUrl(pkg: PackageDataEntry): string {
+  const addr = runtimeLanAddress(pkg)
+  if (!addr || typeof window === 'undefined') return addr
+  return addr.replace(/^http:\/\/(localhost|127\.0\.0\.1)(?=[:/]|$)/, `http://${window.location.hostname}`)
+}
+
 export function getStatusClass(state: PackageState, health?: string | null, exitCode?: number | null): string {
  if (state === PackageState.Running && health === 'starting') return 'bg-yellow-500/20 text-yellow-200'
  if (state === PackageState.Running && health === 'unhealthy') return 'bg-orange-500/20 text-orange-200'
@@ -181,7 +219,7 @@ export function getStatusLabel(state: PackageState, health?: string | null, exit
  if (state === PackageState.Updating) return 'updating...'
  if (state === PackageState.Running) return 'running'
  if (state === PackageState.Exited || state === PackageState.Stopped) {
-    if (exitCode === 137) return 'killed (OOM)'
+    if (exitCode === 137) return 'killed (SIGKILL)'
    if (exitCode != null && exitCode !== 0) return 'crashed'
    return 'stopped'
  }
@@ -209,7 +247,7 @@ export function useCategoriesWithApps(
  allCategories: Ref<Array<{ id: string; name: string }>>,
 ) {
  return computed(() => {
-    const entries = Object.entries(packages.value).filter(([id, pkg]) => !isServicePackage(id, pkg))
+    const entries = Object.entries(packages.value).filter(([id, pkg]) => !isWebsitePackage(id, pkg) && !isInternalToolingPackage(id, pkg))
    return allCategories.value.filter(cat => {
      if (cat.id === 'all') return true
      return entries.some(([id, pkg]) => getAppCategory(id, pkg) === cat.id)
@@ -10,7 +10,7 @@
      <RouterLink
        to="/dashboard/apps"
        class="mode-switcher-btn"
-        :class="{ 'mode-switcher-btn-active': (route.path === '/dashboard/apps' || route.path.startsWith('/dashboard/apps/')) && route.query.tab !== 'services' }"
+        :class="{ 'mode-switcher-btn-active': (route.path === '/dashboard/apps' || route.path.startsWith('/dashboard/apps/')) && route.query.tab !== 'services' && route.query.tab !== 'websites' }"
        @click.prevent="router.push({ path: '/dashboard/apps', query: {} })"
      >My Apps</RouterLink>
      <RouterLink
@@ -19,10 +19,10 @@
        :class="{ 'mode-switcher-btn-active': route.path === '/dashboard/marketplace' || route.path.startsWith('/dashboard/marketplace/') || route.path === '/dashboard/discover' }"
      >App Store</RouterLink>
      <RouterLink
-        to="/dashboard/apps?tab=services"
+        to="/dashboard/apps?tab=websites"
        class="mode-switcher-btn"
-        :class="{ 'mode-switcher-btn-active': route.query.tab === 'services' }"
-      >Services</RouterLink>
+        :class="{ 'mode-switcher-btn-active': route.query.tab === 'services' || route.query.tab === 'websites' }"
+      >Websites</RouterLink>
    </div>
  </div>

@@ -96,8 +96,8 @@ export function useRouteTransitions() {

    // Mobile: Horizontal slide transitions between sub-tabs
    if (typeof window !== 'undefined' && window.innerWidth < 768) {
-      const isServices = currentPath === '/dashboard/apps' && currentRoute.query.tab === 'services'
-      const wasServices = previousTab === 'services'
+      const isServices = currentPath === '/dashboard/apps' && (currentRoute.query.tab === 'services' || currentRoute.query.tab === 'websites')
+      const wasServices = previousTab === 'services' || previousTab === 'websites'
      const currentAppsIdx = isServices ? 2
        : currentPath === '/dashboard/marketplace' ? 1
        : currentPath === '/dashboard/apps' ? 0 : -1
@@ -38,6 +38,7 @@ export default defineConfig({
      },
      workbox: {
        navigateFallbackDenylist: [/^\/app\//, /^\/rpc\//, /^\/ws/, /^\/aiui\//],
+        cleanupOutdatedCaches: true,
        globPatterns: ['**/*.{js,css,html,ico,png,svg,jpg,jpeg,mp4,webp}'],
        globIgnores: [
          '**/*-backup-*.mp4',
@@ -1,27 +1,29 @@
 {
-  "version": "1.7.55-alpha",
-  "release_date": "2026-05-13",
+  "version": "1.7.57-alpha",
+  "release_date": "2026-05-17",
  "changelog": [
-    "Container reconcile now force-recreates Podman records stuck in `Stopping`, preserving bind-mounted app data while recovering wedged containers automatically.",
-    "`.198` is green after the container-layer hardening pass: focused and broad non-destructive lifecycle audits pass, raw Podman health/state sweep is clean, and direct app probes return healthy responses.",
-    "Release-candidate artifacts are staged separately from live update publishing while Gitea artifact hosting is repaired."
+    "Nginx Proxy Manager now avoids privileged rootless Podman host port `81`, preferring `8081:81` while host nginx keeps a compatibility proxy on `:81` for stale cached launch buttons.",
+    "App installs now allocate ports by checking live host bind availability, falling back to a free high port when preferred ports are already occupied.",
+    "Portainer-created launchable containers are separated into a `Websites` tab and launch through their discovered published host port instead of hard-coded app URLs.",
+    "Internal BuildKit helper containers such as `buildx_buildkit_default` are hidden from the Apps UI.",
+    "Portainer works out of the box on Debian 13/Podman installs by including `catatonit` and by preserving the Podman socket mount as a socket rather than creating it as a directory."
  ],
  "components": [
    {
      "name": "archipelago",
-      "current_version": "1.7.55-alpha",
-      "new_version": "1.7.55-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.55-alpha/archipelago",
-      "sha256": "f2caba778f63c7435431fb1b95cf6470bd43c4769ebe6adee2cbd2721707a663",
-      "size_bytes": 42580880
+      "current_version": "1.7.57-alpha",
+      "new_version": "1.7.57-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.57-alpha/archipelago",
+      "sha256": "e96d657c28f84c72c1358fdbbc014184530763341a2d02242b3a479f36dc2aef",
+      "size_bytes": 42647224
    },
    {
-      "name": "archipelago-frontend-1.7.55-alpha.tar.gz",
-      "current_version": "1.7.55-alpha",
-      "new_version": "1.7.55-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.55-alpha/archipelago-frontend-1.7.55-alpha.tar.gz",
-      "sha256": "fe37425aad25724db49ec2be8d602342cfdc5fb99f08b4a3f04709751a3ed560",
-      "size_bytes": 166464949
+      "name": "archipelago-frontend-1.7.57-alpha.tar.gz",
+      "current_version": "1.7.57-alpha",
+      "new_version": "1.7.57-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.57-alpha/archipelago-frontend-1.7.57-alpha.tar.gz",
+      "sha256": "a09c1507afb4b7e9f5279b92215e92ebc0b86155ae53ac2c0baaecd07522c7ee",
+      "size_bytes": 78322316
    }
  ]
 }
@@ -1,27 +1,29 @@
 {
-  "version": "1.7.55-alpha",
-  "release_date": "2026-05-13",
+  "version": "1.7.57-alpha",
+  "release_date": "2026-05-17",
  "changelog": [
-    "Container reconcile now force-recreates Podman records stuck in `Stopping`, preserving bind-mounted app data while recovering wedged containers automatically.",
-    "`.198` is green after the container-layer hardening pass: focused and broad non-destructive lifecycle audits pass, raw Podman health/state sweep is clean, and direct app probes return healthy responses.",
-    "Release-candidate artifacts are staged separately from live update publishing while Gitea artifact hosting is repaired."
+    "Nginx Proxy Manager now avoids privileged rootless Podman host port `81`, preferring `8081:81` while host nginx keeps a compatibility proxy on `:81` for stale cached launch buttons.",
+    "App installs now allocate ports by checking live host bind availability, falling back to a free high port when preferred ports are already occupied.",
+    "Portainer-created launchable containers are separated into a `Websites` tab and launch through their discovered published host port instead of hard-coded app URLs.",
+    "Internal BuildKit helper containers such as `buildx_buildkit_default` are hidden from the Apps UI.",
+    "Portainer works out of the box on Debian 13/Podman installs by including `catatonit` and by preserving the Podman socket mount as a socket rather than creating it as a directory."
  ],
  "components": [
    {
      "name": "archipelago",
-      "current_version": "1.7.55-alpha",
-      "new_version": "1.7.55-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.55-alpha/archipelago",
-      "sha256": "f2caba778f63c7435431fb1b95cf6470bd43c4769ebe6adee2cbd2721707a663",
-      "size_bytes": 42580880
+      "current_version": "1.7.57-alpha",
+      "new_version": "1.7.57-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.57-alpha/archipelago",
+      "sha256": "e96d657c28f84c72c1358fdbbc014184530763341a2d02242b3a479f36dc2aef",
+      "size_bytes": 42647224
    },
    {
-      "name": "archipelago-frontend-1.7.55-alpha.tar.gz",
-      "current_version": "1.7.55-alpha",
-      "new_version": "1.7.55-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.55-alpha/archipelago-frontend-1.7.55-alpha.tar.gz",
-      "sha256": "fe37425aad25724db49ec2be8d602342cfdc5fb99f08b4a3f04709751a3ed560",
-      "size_bytes": 166464949
+      "name": "archipelago-frontend-1.7.57-alpha.tar.gz",
+      "current_version": "1.7.57-alpha",
+      "new_version": "1.7.57-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.57-alpha/archipelago-frontend-1.7.57-alpha.tar.gz",
+      "sha256": "a09c1507afb4b7e9f5279b92215e92ebc0b86155ae53ac2c0baaecd07522c7ee",
+      "size_bytes": 78322316
    }
  ]
 }
@@ -99,6 +99,10 @@ reset_spec() {
  SPEC_ENTRYPOINT=""
 }

+if ! declare -F alloc_port >/dev/null 2>&1; then
+  alloc_port() { printf '%s' "$2"; }
+fi
+
 # ── Tier 0: Databases ────────────────────────────────────────────────

 load_spec_archy-mempool-db() {
@@ -173,9 +177,9 @@ load_spec_bitcoin-knots() {
  SPEC_DATA_UID="100101:100101"
  # Dynamic: prune on small disk
  if [ "${DISK_GB:-0}" -lt 1000 ]; then
-    SPEC_CUSTOM_ARGS="-server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=512"
+    SPEC_CUSTOM_ARGS="-server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125"
  else
-    SPEC_CUSTOM_ARGS="-server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096"
+    SPEC_CUSTOM_ARGS="-server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125"
  fi
 }

@@ -493,13 +497,17 @@ load_spec_nginx-proxy-manager() {
  reset_spec
  SPEC_NAME="nginx-proxy-manager"
  SPEC_IMAGE="${NPM_IMAGE}"
-  SPEC_PORTS="81:81 8084:80 8444:443"
+  local admin_port http_port https_port
+  admin_port=$(alloc_port nginx-proxy-manager 8081 81)
+  http_port=$(alloc_port nginx-proxy-manager-http 8084 80)
+  https_port=$(alloc_port nginx-proxy-manager-https 8444 443)
+  SPEC_PORTS="$admin_port:81 $http_port:80 $https_port:443"
  SPEC_VOLUMES="/var/lib/archipelago/nginx-proxy-manager/data:/data /var/lib/archipelago/nginx-proxy-manager/letsencrypt:/etc/letsencrypt"
  SPEC_MEMORY="$(mem_limit nginx-proxy-manager)"
  SPEC_HEALTH_CMD="curl -sf http://localhost:81/ || exit 1"
  SPEC_TIER="3"
  SPEC_DATA_DIR="/var/lib/archipelago/nginx-proxy-manager"
-  SPEC_CAPS="CHOWN SETUID SETGID NET_BIND_SERVICE"
+  SPEC_CAPS="CHOWN FOWNER SETUID SETGID DAC_OVERRIDE NET_BIND_SERVICE"
  SPEC_OPTIONAL="true"
 }

@@ -914,7 +914,7 @@ LNDCONF
                        --health-cmd 'curl -sf http://localhost:81/'  --health-interval=30s --health-timeout=5s --health-retries=3 \
                        --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID --cap-add NET_BIND_SERVICE \
                        --security-opt no-new-privileges:true \
-                        -p 81:81 -p 8084:80 -p 8444:443 \
+                        -p 8081:81 -p 8084:80 -p 8444:443 \
                        -v /var/lib/archipelago/nginx-proxy-manager/data:/data \
                        -v /var/lib/archipelago/nginx-proxy-manager/letsencrypt:/etc/letsencrypt \
                        $NPM_IMAGE
@@ -48,6 +48,37 @@ SCRIPT_DIR_FBC="$(cd "$(dirname "$0")" && pwd)"
 # as root (rootful podman), the backend can't see them at all.
 DOCKER="runuser -u archipelago -- env XDG_RUNTIME_DIR=/run/user/$(id -u archipelago) podman"

+PORT_ALLOC_FILE="/var/lib/archipelago/port-allocations.env"
+mkdir -p /var/lib/archipelago 2>/dev/null || true
+[ -f "$PORT_ALLOC_FILE" ] && . "$PORT_ALLOC_FILE"
+
+port_available() {
+  local port="$1"
+  ss -ltn 2>/dev/null | awk -v p=":$port" '$4 == p || $4 ~ p "$" { found=1 } END { exit found ? 1 : 0 }'
+}
+
+alloc_port() {
+  local key="$1" preferred="$2" var="PORT_${key//[^A-Za-z0-9]/_}" cur=""
+  eval "cur=\${$var:-}"
+  if [ -n "$cur" ] && port_available "$cur"; then
+    printf '%s' "$cur"
+    return
+  fi
+  if port_available "$preferred"; then
+    cur="$preferred"
+  else
+    cur=""
+    for p in $(seq 8085 9999); do
+      if port_available "$p"; then cur="$p"; break; fi
+    done
+  fi
+  [ -n "$cur" ] || cur="$preferred"
+  if ! grep -q "^$var=" "$PORT_ALLOC_FILE" 2>/dev/null; then
+    printf '%s=%s\n' "$var" "$cur" >> "$PORT_ALLOC_FILE"
+  fi
+  printf '%s' "$cur"
+}
+
 # UNBUNDLED mode: only create FileBrowser, skip all other containers.
 # Users install apps on-demand from the Marketplace.
 UNBUNDLED_MARKER="/opt/archipelago/.unbundled"
@@ -557,11 +588,11 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -qE 'bitcoin-knots|arch
  [ -z "$DISK_GB" ] && DISK_GB=$(df --output=size -BG / 2>/dev/null | tail -1 | tr -dc '0-9')
  if [ "${DISK_GB:-0}" -lt 1000 ]; then
    BTC_EXTRA_ARGS="-prune=550"
-    BTC_DBCACHE=512
+    BTC_DBCACHE=2048
    log "  Small disk (${DISK_GB}GB) — enabling pruning"
  else
    BTC_EXTRA_ARGS="-txindex=1"
-    BTC_DBCACHE=2048
+    BTC_DBCACHE=4096
    log "  Large disk (${DISK_GB}GB) — enabling txindex"
  fi
  if $DOCKER run -d --name bitcoin-knots --restart unless-stopped \
@@ -574,7 +605,7 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -qE 'bitcoin-knots|arch
    -v /var/lib/archipelago/bitcoin:/home/bitcoin/.bitcoin \
    "${BITCOIN_KNOTS_IMAGE}" \
    $BTC_EXTRA_ARGS \
-    -printtoconsole=1 -dbcache=$BTC_DBCACHE 2>>"$LOG"; then
+    -printtoconsole=1 -dbcache=$BTC_DBCACHE -par=0 -maxconnections=125 2>>"$LOG"; then
    log "Bitcoin Knots started"
  else
    log "Bitcoin Knots failed (may already exist)"
@@ -1146,12 +1177,15 @@ track_container "filebrowser"
 if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q nginx-proxy-manager; then
  log "Creating Nginx Proxy Manager..."
  mkdir -p /var/lib/archipelago/nginx-proxy-manager/data /var/lib/archipelago/nginx-proxy-manager/letsencrypt
+  NPM_ADMIN_PORT=$(alloc_port nginx-proxy-manager 8081)
+  NPM_HTTP_PORT=$(alloc_port nginx-proxy-manager-http 8084)
+  NPM_HTTPS_PORT=$(alloc_port nginx-proxy-manager-https 8444)
  $DOCKER run -d --name nginx-proxy-manager --restart unless-stopped \
    --health-cmd="curl -sf http://localhost:81/ || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
    --memory=$(mem_limit nginx-proxy-manager) \
-    --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID --cap-add NET_BIND_SERVICE \
+    --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE --cap-add NET_BIND_SERVICE \
    --security-opt no-new-privileges:true \
-    -p 81:81 -p 8084:80 -p 8444:443 \
+    -p ${NPM_ADMIN_PORT}:81 -p ${NPM_HTTP_PORT}:80 -p ${NPM_HTTPS_PORT}:443 \
    -v /var/lib/archipelago/nginx-proxy-manager/data:/data \
    -v /var/lib/archipelago/nginx-proxy-manager/letsencrypt:/etc/letsencrypt \
    "${NPM_IMAGE}" 2>>"$LOG" || true
@@ -204,7 +204,7 @@ location /app/electrs-ui/ {
    proxy_hide_header Content-Security-Policy;
 }
 location /app/nginx-proxy-manager/ {
-    proxy_pass http://127.0.0.1:81/;
+    proxy_pass http://127.0.0.1:8081/;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
@@ -63,6 +63,37 @@ header(){ echo -e "\n${BOLD}$*${NC}"; }
 source "$SCRIPT_DIR/container-specs.sh" || { echo "Cannot source container-specs.sh"; exit 1; }
 detect_environment

+PORT_ALLOC_FILE="/var/lib/archipelago/port-allocations.env"
+[ -f "$PORT_ALLOC_FILE" ] && . "$PORT_ALLOC_FILE"
+
+port_available() {
+  local port="$1"
+  ss -ltn 2>/dev/null | awk -v p=":$port" '$4 == p || $4 ~ p "$" { found=1 } END { exit found ? 1 : 0 }'
+}
+
+alloc_port() {
+  local key="$1" preferred="$2" var="PORT_${key//[^A-Za-z0-9]/_}" cur=""
+  eval "cur=\${$var:-}"
+  if [ -n "$cur" ] && port_available "$cur"; then
+    printf '%s' "$cur"
+    return
+  fi
+  if port_available "$preferred"; then
+    cur="$preferred"
+  else
+    cur=""
+    for p in $(seq 8085 9999); do
+      if port_available "$p"; then cur="$p"; break; fi
+    done
+  fi
+  [ -n "$cur" ] || cur="$preferred"
+  sudo mkdir -p "$(dirname "$PORT_ALLOC_FILE")" 2>/dev/null || true
+  if ! grep -q "^$var=" "$PORT_ALLOC_FILE" 2>/dev/null; then
+    printf '%s=%s\n' "$var" "$cur" | sudo tee -a "$PORT_ALLOC_FILE" >/dev/null
+  fi
+  printf '%s' "$cur"
+}
+
 # ── Podman command ───────────────────────────────────────────────────
 # Run as archipelago user — podman sees rootless containers directly.
 # Use sudo only for chown/mkdir operations.
@@ -154,6 +185,39 @@ host_port_listening() {
  '
 }

+prepare_bind_source() {
+  local source="$1"
+  [ -n "$source" ] || return 0
+
+  case "$source" in
+    /run/user/*/podman/podman.sock)
+      if [ ! -S "$source" ]; then
+        local runtime_dir="${source%/podman/podman.sock}"
+        XDG_RUNTIME_DIR="$runtime_dir" systemctl --user start podman.socket 2>/dev/null || true
+        for _ in 1 2 3 4 5 6 7 8 9 10; do
+          [ -S "$source" ] && return 0
+          sleep 0.25
+        done
+      fi
+      ;;
+  esac
+
+  case "$source" in
+    /var/lib/archipelago/*)
+      sudo mkdir -p "$source" 2>/dev/null
+      ;;
+    *)
+      # Non-data bind mounts can be files/sockets/devices. Creating the full
+      # path would turn e.g. podman.sock into a directory and break Portainer.
+      if [ -e "$source" ]; then
+        return 0
+      fi
+      fail "bind source missing: $source"
+      return 1
+      ;;
+  esac
+}
+
 container_has_mount() {
  local name="$1" source="$2" target="$3"
  $PODMAN inspect "$name" --format '{{range .Mounts}}{{println .Source "|" .Destination}}{{end}}' 2>/dev/null \
@@ -536,7 +600,11 @@ reconcile() {
      else
        for v in $SPEC_VOLUMES; do
          local host_dir="${v%%:*}"
-          [ -n "$host_dir" ] && sudo mkdir -p "$host_dir" 2>/dev/null
+          prepare_bind_source "$host_dir" || {
+            COUNT_FAILED=$((COUNT_FAILED + 1))
+            FAILED_LIST+=" $name"
+            return
+          }
        done
        if eval "$(build_run_cmd)" >/dev/null 2>&1; then
          fixed "$name — created"
@@ -178,7 +178,7 @@ launch_url_for() {
    ollama) echo "http://${ARCHY_HOST}:11434/" ;;
    immich|immich_server) echo "http://${ARCHY_HOST}:2283/" ;;
    portainer) echo "http://${ARCHY_HOST}:9000/" ;;
-    nginx-proxy-manager) echo "http://${ARCHY_HOST}:81/" ;;
+    nginx-proxy-manager) echo "http://${ARCHY_HOST}:8081/" ;;
    tailscale) echo "http://${ARCHY_HOST}:8240/" ;;
    uptime-kuma) echo "http://${ARCHY_HOST}:3002/" ;;
    homeassistant) echo "http://${ARCHY_HOST}:8123/" ;;
Author	SHA1	Message	Date
archipelago	7804223152	chore: release v1.7.57-alpha	2026-05-17 17:30:04 -04:00
archipelago	a322b04021	fix(iso): avoid polkit in live debootstrap seed	2026-05-15 18:32:14 -04:00
archipelago	645cf69ed7	chore(release): refresh v1.7.56-alpha manifest after wifi fix	2026-05-15 18:26:17 -04:00
archipelago	01ec0565a6	fix: restore wifi setup and ssh password updates	2026-05-15 18:15:06 -04:00
archipelago	30505f41ff	chore(release): refresh v1.7.56-alpha notes and artifacts	2026-05-15 17:54:32 -04:00
Dorian	5818541721	chore: release v1.7.56-alpha	2026-05-14 09:13:58 -04:00
Dorian	b8053c00ca	fix: clear stale health notifications	2026-05-14 08:57:54 -04:00
Dorian	f95e9a1cd0	fix: quote quadlet environment values	2026-05-14 01:15:22 -04:00
Dorian	be50dc3235	fix: avoid bootstrap bitcoin restarts	2026-05-14 00:03:16 -04:00
Dorian	2ff47f88a7	fix: harden container reconcile and launch behavior	2026-05-13 22:59:55 -04:00