chore: release v1.7.58-alpha

.dockerignore

@@ -7,6 +7,14 @@
 # Allow demo assets (AIUI pre-built dist)
 !demo/
 
+# Allow backend source for ISO source builds
+!core/
+!scripts/
+!image-recipe/
+image-recipe/build/
+image-recipe/results/
+image-recipe/output/
+
 # Exclude nested node_modules (will npm install in container)
 neode-ui/node_modules
 neode-ui/dist

CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## v1.7.58-alpha (2026-05-17)
+
+- Mesh networking now supports Meshtastic radios over the Meshtastic serial API in addition to existing MeshCore Companion USB radios.
+- The mesh listener now probes preferred and auto-detected serial paths for both MeshCore and Meshtastic firmware, preserving the existing reconnect loop so unplug/replug and firmware hot-swap behavior stays consistent.
+- Meshtastic text packets are translated into the existing Archipelago mesh frame pipeline, so current RPC handlers, transport routing, message storage, typed-message decoding, and UI state continue to work without a separate frontend path.
+- Meshtastic node information is surfaced as normal mesh contacts using stable synthetic public keys derived from Meshtastic node numbers, allowing peer refresh and message attribution to reuse existing MeshCore contact handling.
+- Outbound Archipelago mesh messages can now be sent through Meshtastic as channel text packets using the same command path used by MeshCore channel broadcasts.
+- Device status now reports the detected firmware family as `meshcore` or `meshtastic` from the shared listener abstraction.
+- Radio udev rules now include USB CDC ACM serial devices (`ttyACM*`) alongside CP2102, CH340, and FTDI adapters so Meshtastic boards are more likely to appear through the stable `/dev/mesh-radio` symlink.
+- Host nginx now serves `/assets/*` hashed frontend chunks as immutable static files with a hard 404 on misses instead of falling back to `index.html`, preventing strict MIME errors when a browser has a stale pre-update HTML shell.
+- The SPA HTML shell and service-worker files now revalidate on every load, reducing stale frontend references after OTA updates.
+- OTA runtime promotion now installs the bundled `nginx-archipelago.conf` into `/etc/nginx/sites-available/archipelago` and reloads nginx after a successful config test, so frontend cache/fallback fixes reach existing nodes without a manual deploy.
+- Local validation passed with `cargo check -p archipelago`; live SSH testing against `100.70.96.88` was not completed because temporary public-key authentication was rejected on the target.
+
+## v1.7.57-alpha (2026-05-17)
+
+- Nginx Proxy Manager now avoids privileged rootless Podman host port `81`, preferring `8081:81` while host nginx keeps a compatibility proxy on `:81` for stale cached launch buttons.
+- App installs now allocate ports by checking live host bind availability, falling back to a free high port when preferred ports are already occupied.
+- Portainer-created launchable containers are separated into a `Websites` tab and launch through their discovered published host port instead of hard-coded app URLs.
+- Internal BuildKit helper containers such as `buildx_buildkit_default` are hidden from the Apps UI.
+- Portainer works out of the box on Debian 13/Podman installs by including `catatonit` and by preserving the Podman socket mount as a socket rather than creating it as a directory.
+
+## v1.7.56-alpha (2026-05-15)
+
+- Health notifications now clear when an app is no longer unhealthy, including stale alerts for removed containers such as Portainer.
+- Fresh installs now include the full Wi-Fi userspace stack (`wpasupplicant`, `wireless-regdb`, `iw`, `rfkill`, `polkitd`, `pciutils`, and `usbutils`) so NetworkManager can scan and connect with Intel Wi-Fi cards out of the box.
+- The installed system now grants the `archipelago` service user explicit NetworkManager PolicyKit access for web-triggered Wi-Fi scans and connection changes.
+- Wi-Fi connect now replaces stale/partial NetworkManager profiles and creates an explicit WPA-PSK profile with the supplied password, avoiding no-secret retry failures after a failed attempt.
+- Settings password changes now update the Linux/SSH password through non-interactive sudo, so the web password and SSH password stay in sync when the checkbox is enabled.
+- Quadlet environment values with spaces or shell metacharacters are quoted consistently, preventing env drift recreate loops for apps like nostr-rs-relay and Grafana.
+- Boot/bootstrap reconcile avoids restarting running Bitcoin containers while repairing RPC config, preserving IBD progress on active nodes.
+- Exit code 137 is labeled as SIGKILL instead of assuming OOM, avoiding false OOM alerts for orchestrator-managed recreates.
+- Container reconcile force-recreates Podman records stuck in `Stopping`, preserving bind-mounted app data while recovering wedged containers automatically.
+- Container health reporting is honest for running containers: Archipelago surfaces Podman's actual health state instead of marking every running container healthy.
+- Quadlet reconciliation restarts services when stale health gates, port bindings, network aliases, exec commands, or healthchecks drift from the current manifest.
+- Bitcoin Knots sync performance improves on fresh installs and updates with 8Gi container memory, a 4Gi dbcache, and full CPU parallelism.
+- ElectrumX initial indexing gets more headroom: CPU caps are removed, memory is raised to 4Gi, cache is raised to 3Gi, and oversized sends are allowed for heavier wallet/indexing workloads.
+- Mempool/ElectrumX lifecycle qualification respects pruned/non-archival Bitcoin nodes instead of installing a half-running stack with unhealthy dependencies.
+- LND wallet/RPC helpers are more tolerant of container-owned files and updated REST port metadata, improving LND lifecycle and wallet-connect flows.
+- Marketplace/catalog metadata carries richer container config so remote lifecycle tests install apps using the same settings users get from the UI.
+- The app screensaver no longer activates during media-heavy app sessions such as IndeeHub, Jellyfin, Immich, PhotoPrism, and File Browser; apps can also pause/resume it with media playback messages.
+- A fresh `1.7.56-alpha` unbundled installer ISO is built from the same primary VPS2 release line for easy download and USB flashing.
+
 ## v1.7.55-alpha (2026-05-13)
 
 - Container reconcile now force-recreates Podman records stuck in `Stopping`, preserving bind-mounted app data while recovering wedged containers automatically.

apps/bitcoin-knots/manifest.yml

@@ -30,7 +30,7 @@ app:
         RPC_PASS="$(printenv BITCOIN_RPC_PASS)";
         DISK_GB_VALUE="$(printenv DISK_GB || true)";
         if [ "${DISK_GB_VALUE:-0}" -lt 1000 ]; then
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
         else
           exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
         fi

core/Cargo.lock

@@ -80,7 +80,7 @@ checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
 [[package]]
 name = "archipelago"
-version = "1.7.55-alpha"
+version = "1.7.58-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.55-alpha"
+version = "1.7.58-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]

core/archipelago/src/api/rpc/interfaces.rs

@@ -307,14 +307,62 @@ async fn scan_wifi() -> Result<Vec<serde_json::Value>> {
 
 /// Connect to a WiFi network using nmcli.
 async fn connect_wifi(ssid: &str, password: &str) -> Result<()> {
+    let conn_name = format!("archipelago-wifi-{ssid}");
+
+    // Delete prior profiles for this SSID/name first. Failed attempts can leave
+    // a profile with key-mgmt but no saved PSK, causing future retries to fail
+    // with "no secrets" before the supplied password is used.
+    let _ = tokio::process::Command::new("nmcli")
+        .args(["connection", "delete", &conn_name])
+        .output()
+        .await;
+    let _ = tokio::process::Command::new("nmcli")
+        .args(["connection", "delete", ssid])
+        .output()
+        .await;
+
     let output = tokio::process::Command::new("nmcli")
-        .args(["device", "wifi", "connect", ssid, "password", password])
+        .args([
+            "connection",
+            "add",
+            "type",
+            "wifi",
+            "con-name",
+            &conn_name,
+            "ifname",
+            "*",
+            "ssid",
+            ssid,
+            "wifi-sec.key-mgmt",
+            "wpa-psk",
+            "wifi-sec.psk",
+            password,
+            "ipv4.method",
+            "auto",
+            "ipv6.method",
+            "auto",
+        ])
+        .output()
+        .await
+        .context("Failed to run nmcli wifi profile create")?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        anyhow::bail!("WiFi profile create failed: {}", stderr);
+    }
+
+    let activate = tokio::process::Command::new("nmcli")
+        .args(["connection", "up", &conn_name])
         .output()
         .await
         .context("Failed to run nmcli wifi connect")?;
 
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
+    if !activate.status.success() {
+        let stderr = String::from_utf8_lossy(&activate.stderr);
+        let _ = tokio::process::Command::new("nmcli")
+            .args(["connection", "delete", &conn_name])
+            .output()
+            .await;
         anyhow::bail!("WiFi connection failed: {}", stderr);
     }
 

core/archipelago/src/api/rpc/package/config.rs

@@ -153,11 +153,13 @@ pub(super) fn get_app_capabilities(app_id: &str) -> Vec<String> {
             "--cap-add=SETGID".to_string(),
             "--cap-add=DAC_OVERRIDE".to_string(),
         ],
-        // Nginx Proxy Manager needs to bind low ports
+        // Nginx Proxy Manager initializes/chowns mounted state on first boot.
         "nginx-proxy-manager" => vec![
             "--cap-add=CHOWN".to_string(),
+            "--cap-add=FOWNER".to_string(),
             "--cap-add=SETUID".to_string(),
             "--cap-add=SETGID".to_string(),
+            "--cap-add=DAC_OVERRIDE".to_string(),
             "--cap-add=NET_BIND_SERVICE".to_string(),
         ],
         // Bitcoin needs only file-ownership ops + NET_BIND_SERVICE for the
@@ -924,20 +926,34 @@ pub(super) async fn get_app_config(
                 ]),
             )
         }
-        "nginx-proxy-manager" => (
-            vec![
-                "81:81".to_string(),
-                "8084:80".to_string(),
-                "8444:443".to_string(),
-            ],
-            vec![
-                "/var/lib/archipelago/nginx-proxy-manager/data:/data".to_string(),
-                "/var/lib/archipelago/nginx-proxy-manager/letsencrypt:/etc/letsencrypt".to_string(),
-            ],
-            vec![],
-            None,
-            None,
-        ),
+        "nginx-proxy-manager" => {
+            let admin_port = allocator
+                .allocate_or_get(app_id, 8081, 81)
+                .await
+                .unwrap_or(8081);
+            let http_port = allocator
+                .allocate_or_get("nginx-proxy-manager-http", 8084, 80)
+                .await
+                .unwrap_or(8084);
+            let https_port = allocator
+                .allocate_or_get("nginx-proxy-manager-https", 8444, 443)
+                .await
+                .unwrap_or(8444);
+            (
+                vec![
+                    format!("{}:81", admin_port),
+                    format!("{}:80", http_port),
+                    format!("{}:443", https_port),
+                ],
+                vec![
+                    "/var/lib/archipelago/nginx-proxy-manager/data:/data".to_string(),
+                    "/var/lib/archipelago/nginx-proxy-manager/letsencrypt:/etc/letsencrypt".to_string(),
+                ],
+                vec![],
+                None,
+                None,
+            )
+        }
         "portainer" => (
             vec!["9000:9000".to_string()],
             vec![

core/archipelago/src/api/rpc/package/install.rs

@@ -376,7 +376,7 @@ impl RpcHandler {
                             package_id
                         ))
                         .await;
-                        if let Err(e) = ensure_host_port_listener(package_id, package_id).await {
+                        if let Err(e) = ensure_host_port_listener(package_id, package_id, &[]).await {
                             install_log(&format!(
                                 "INSTALL ADOPT RECREATE: {} — host listener repair failed, removing wedged container: {}",
                                 package_id, e
@@ -402,7 +402,7 @@ impl RpcHandler {
                         package_id
                     ))
                     .await;
-                    if let Err(e) = ensure_host_port_listener(package_id, package_id).await {
+                    if let Err(e) = ensure_host_port_listener(package_id, package_id, &[]).await {
                         install_log(&format!(
                             "INSTALL ADOPT RECREATE: {} — host listener repair failed, removing wedged container: {}",
                             package_id, e
@@ -880,7 +880,7 @@ impl RpcHandler {
             repair_nextcloud_permissions().await;
         }
 
-        ensure_host_port_listener(package_id, container_name).await?;
+        ensure_host_port_listener(package_id, container_name, &ports).await?;
 
         install_log(&format!(
             "INSTALL OK: {} (container: {})",
@@ -1866,7 +1866,7 @@ async fn cleanup_stale_package_ports(package_id: &str) {
             cleanup_stale_pasta_port("3000").await;
         }
         "nginx-proxy-manager" => {
-            cleanup_stale_pasta_port("81").await;
+            cleanup_stale_pasta_port("8081").await;
             cleanup_stale_pasta_port("8084").await;
             cleanup_stale_pasta_port("8444").await;
         }
@@ -1914,7 +1914,7 @@ async fn cleanup_start_conflict(package_id: &str, stderr: &str) -> bool {
         "nginx-proxy-manager"
             if stderr.contains("pasta failed") || stderr.contains("address already in use") =>
         {
-            cleanup_stale_pasta_port("81").await;
+            cleanup_stale_pasta_port("8081").await;
             cleanup_stale_pasta_port("8084").await;
             cleanup_stale_pasta_port("8444").await;
             true
@@ -1968,8 +1968,18 @@ async fn repair_nextcloud_permissions() {
     }
 }
 
-async fn ensure_host_port_listener(package_id: &str, container_name: &str) -> Result<()> {
-    let Some(port) = required_host_port(package_id) else {
+async fn ensure_host_port_listener(
+    package_id: &str,
+    container_name: &str,
+    runtime_ports: &[String],
+) -> Result<()> {
+    let Some(port) = runtime_ports
+        .first()
+        .and_then(|p| p.split(':').next())
+        .and_then(|p| p.parse::<u16>().ok())
+        .or_else(|| published_host_port(container_name))
+        .or_else(|| required_host_port(package_id))
+    else {
         return Ok(());
     };
 
@@ -2015,6 +2025,22 @@ async fn ensure_host_port_listener(package_id: &str, container_name: &str) -> Re
     ))
 }
 
+fn published_host_port(container_name: &str) -> Option<u16> {
+    let output = std::process::Command::new("podman")
+        .args(["port", container_name])
+        .output()
+        .ok()?;
+    if !output.status.success() {
+        return None;
+    }
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    stdout.lines().find_map(|line| {
+        line.rsplit(':')
+            .next()
+            .and_then(|p| p.trim().parse::<u16>().ok())
+    })
+}
+
 async fn ensure_user_podman_socket() -> Result<()> {
     let socket_path = "/run/user/1000/podman/podman.sock";
     if tokio::fs::try_exists(socket_path).await.unwrap_or(false) {
@@ -2048,7 +2074,7 @@ fn required_host_port(package_id: &str) -> Option<u16> {
         "uptime-kuma" => Some(3002),
         "gitea" => Some(3001),
         "nextcloud" => Some(8085),
-        "nginx-proxy-manager" => Some(81),
+        "nginx-proxy-manager" => Some(8081),
         _ => None,
     }
 }

core/archipelago/src/api/rpc/package/runtime.rs

@@ -366,6 +366,10 @@ impl RpcHandler {
         {
             let mut allocator = self.port_allocator.lock().await;
             let _ = allocator.release(package_id).await;
+            if package_id == "nginx-proxy-manager" {
+                let _ = allocator.release("nginx-proxy-manager-http").await;
+                let _ = allocator.release("nginx-proxy-manager-https").await;
+            }
         }
 
         // Clean data directories unless preserve_data
@@ -916,7 +920,7 @@ fn runtime_required_host_port(container_name: &str) -> Option<u16> {
         "vaultwarden" => Some(8082),
         "gitea" => Some(3001),
         "nextcloud" => Some(8085),
-        "nginx-proxy-manager" => Some(81),
+        "nginx-proxy-manager" => Some(8081),
         _ => None,
     }
 }
@@ -1072,7 +1076,7 @@ async fn cleanup_start_conflict(container_name: &str, stderr: &str) {
         "vaultwarden" => cleanup_stale_pasta_port("8082").await,
         "nextcloud" => cleanup_stale_pasta_port("8085").await,
         "nginx-proxy-manager" => {
-            cleanup_stale_pasta_port("81").await;
+            cleanup_stale_pasta_port("8081").await;
             cleanup_stale_pasta_port("8084").await;
             cleanup_stale_pasta_port("8444").await;
         }

core/archipelago/src/api/rpc/tor/mod.rs

@@ -353,7 +353,7 @@ pub(in crate::api::rpc) fn known_service_port(name: &str) -> u16 {
         "immich" => 2283,
         "photoprism" => 2342,
         "penpot" => 9001,
-        "nginx-proxy-manager" => 81,
+        "nginx-proxy-manager" => 8081,
         "vaultwarden" => 8343,
         "indeedhub" => 7778,
         _ => 0,

core/archipelago/src/auth.rs

@@ -381,14 +381,14 @@ async fn change_ssh_password(new_password: &str) -> Result<()> {
 
     // usermod -p writes directly to /etc/shadow, bypassing PAM
     // Use /usr/sbin/usermod - not always in systemd's PATH
-    let status = tokio::process::Command::new("/usr/sbin/usermod")
-        .args(["-p", &hash, &ssh_user])
+    let status = tokio::process::Command::new("/usr/bin/sudo")
+        .args(["-n", "/usr/sbin/usermod", "-p", &hash, &ssh_user])
         .output()
         .await?;
 
     if !status.status.success() {
         let stderr = String::from_utf8_lossy(&status.stderr);
-        anyhow::bail!("usermod failed: {}", stderr);
+        anyhow::bail!("sudo usermod failed: {}", stderr);
     }
 
     tracing::info!("SSH password updated for user {}", ssh_user);

core/archipelago/src/bootstrap.rs

@@ -65,7 +65,9 @@ pub async fn ensure_doctor_installed() {
         Err(e) => warn!("Nginx bootstrap failed (non-fatal): {:#}", e),
     }
     match run_bitcoin_rpc_repair().await {
-        Ok(true) => info!("Repaired Bitcoin RPC bind settings and restarted Bitcoin containers"),
+        Ok(true) => {
+            info!("Repaired Bitcoin RPC bind settings; running Bitcoin containers left untouched")
+        }
         Ok(false) => debug!("Bitcoin RPC bind settings already usable"),
         Err(e) => warn!("Bitcoin RPC repair failed (non-fatal): {:#}", e),
     }
@@ -231,6 +233,24 @@ async fn run_runtime_assets() -> Result<bool> {
     }
 
     let configs = runtime_dir.join("image-recipe/configs");
+    let nginx_src = configs.join("nginx-archipelago.conf");
+    if nginx_src.exists() {
+        let src_s = nginx_src.to_string_lossy().to_string();
+        let status = host_sudo(&[
+            "install",
+            "-m",
+            "644",
+            &src_s,
+            "/etc/nginx/sites-available/archipelago",
+        ])
+        .await
+        .context("install nginx-archipelago.conf")?;
+        if !status.success() {
+            anyhow::bail!("install nginx-archipelago.conf exited with {}", status);
+        }
+        changed = true;
+    }
+
     for unit in ["archipelago-doctor.service", "archipelago-doctor.timer"] {
         let src = configs.join(unit);
         if src.exists() {
@@ -248,6 +268,19 @@ async fn run_runtime_assets() -> Result<bool> {
 
     if changed {
         let _ = host_sudo(&["systemctl", "daemon-reload"]).await;
+        if nginx_src.exists() {
+            match host_sudo(&["nginx", "-t"]).await {
+                Ok(status) if status.success() => {
+                    let _ = host_sudo(&["systemctl", "reload", "nginx"]).await;
+                }
+                Ok(status) => {
+                    tracing::warn!("nginx config test failed after runtime sync: {}", status);
+                }
+                Err(e) => {
+                    tracing::warn!("failed to test nginx config after runtime sync: {}", e);
+                }
+            }
+        }
     }
     Ok(changed)
 }
@@ -334,15 +367,11 @@ exit 2
         .context("repair bitcoin.conf RPC bind settings")?;
     match status.code() {
         Some(0) => Ok(false),
-        Some(2) => {
-            for name in ["bitcoin-knots", "bitcoin-core", "archy-bitcoin-ui"] {
-                let _ = tokio::process::Command::new("podman")
-                    .args(["restart", name])
-                    .status()
-                    .await;
-            }
-            Ok(true)
-        }
+        // Do not restart Bitcoin from bootstrap. During IBD, an automatic
+        // restart can cost hours of progress. The repaired file is only a
+        // fallback for future starts; current containers keep their command-line
+        // RPC args until an operator or update intentionally restarts them.
+        Some(2) => Ok(true),
         _ => {
             warn!("Bitcoin RPC repair helper exited with {}", status);
             Ok(false)

core/archipelago/src/container/docker_packages.rs

@@ -61,6 +61,7 @@ impl DockerPackageScanner {
             "indeedhub-build_minio-init_1",
             "indeedhub-build_relay_1",
             "indeedhub-build_ffmpeg-worker_1",
+            "buildx_buildkit_default",
         ];
 
         // First pass: collect running UI containers. Custom UI-backed apps must
@@ -123,6 +124,11 @@ impl DockerPackageScanner {
                 continue;
             }
 
+            if app_id.starts_with("buildx_buildkit") {
+                debug!("Skipping BuildKit helper container: {}", app_id);
+                continue;
+            }
+
             // Skip UI containers (they're merged with their parent apps)
             if app_id.ends_with("-ui") {
                 debug!("Skipping UI container: {}", app_id);
@@ -140,8 +146,13 @@ impl DockerPackageScanner {
             } else {
                 // Prefer the known web UI port over arbitrary first binding
                 // (for example Gitea exposes SSH on 2222 before web on 3001).
-                let candidate = PodmanClient::lan_address_for(&app_id)
-                    .or_else(|| extract_lan_address(&container.ports));
+                let candidate = if uses_allocated_launch_port(&app_id) {
+                    extract_lan_address(&container.ports)
+                        .or_else(|| PodmanClient::lan_address_for(&app_id))
+                } else {
+                    PodmanClient::lan_address_for(&app_id)
+                        .or_else(|| extract_lan_address(&container.ports))
+                };
                 reachable_lan_address(&app_id, candidate).await
             };
 
@@ -673,6 +684,13 @@ fn companion_lan_address(app_id: &str) -> Option<String> {
     }
 }
 
+fn uses_allocated_launch_port(app_id: &str) -> bool {
+    matches!(
+        app_id,
+        "filebrowser" | "nextcloud" | "nginx-proxy-manager" | "vaultwarden"
+    )
+}
+
 fn convert_state(container_state: &ContainerState) -> (PackageState, ServiceStatus) {
     match container_state {
         ContainerState::Running => (PackageState::Running, ServiceStatus::Running),

core/archipelago/src/container/prod_orchestrator.rs

@@ -62,6 +62,19 @@ fn is_required_baseline_app(app_id: &str) -> bool {
     )
 }
 
+fn is_restart_sensitive_app(app_id: &str) -> bool {
+    matches!(
+        app_id,
+        "bitcoin-knots"
+            | "bitcoin-core"
+            | "bitcoin"
+            | "lnd"
+            | "btcpay-server"
+            | "fedimint"
+            | "fedimint-gateway"
+    )
+}
+
 fn requires_archival_bitcoin(app_id: &str) -> bool {
     matches!(
         app_id,
@@ -713,6 +726,17 @@ impl ProdContainerOrchestrator {
                             return Ok(ReconcileAction::Started);
                         }
                         if self.container_env_drifted(&name, &resolved_manifest).await {
+                            if mode == ReconcileMode::ExistingOnly
+                                && is_restart_sensitive_app(&app_id)
+                            {
+                                tracing::info!(
+                                    app_id = %app_id,
+                                    container = %name,
+                                    "container drift detected during boot reconcile; leaving running restart-sensitive app untouched"
+                                );
+                                self.run_post_start_hooks(&app_id).await?;
+                                return Ok(ReconcileAction::NoOp);
+                            }
                             tracing::info!(app_id = %app_id, container = %name, "container env drift detected — recreating");
                             let _ = self.runtime.stop_container(&name).await;
                             let _ = self.runtime.remove_container(&name).await;
@@ -2252,6 +2276,7 @@ mod tests {
             runtime,
             PathBuf::from("/nonexistent-for-tests"),
         );
+        orch.set_data_dir(PathBuf::from("/nonexistent-for-tests"));
         // Redirect the bitcoin-ui pre-start hook to a test-scoped
         // tmpdir, seeded with a fake password file. Shared across
         // every test in this module (OnceLock), so the hook can run
@@ -2259,6 +2284,7 @@ mod tests {
         // this redirection, any test that installs the bitcoin-ui
         // fixture would try to write under /var/lib/archipelago.
         orch.set_bitcoin_ui_paths(test_bitcoin_ui_paths());
+        orch.set_filebrowser_paths(test_filebrowser_paths());
         orch
     }
 
@@ -2339,6 +2365,17 @@ app:
         }
     }
 
+    fn test_filebrowser_paths() -> filebrowser::EnsurePaths {
+        use std::sync::OnceLock;
+        static DIR: OnceLock<tempfile::TempDir> = OnceLock::new();
+        let dir = DIR.get_or_init(|| tempfile::TempDir::new().expect("test tmpdir"));
+        filebrowser::EnsurePaths {
+            srv_root: dir.path().join("filebrowser"),
+            data_dir: dir.path().join("filebrowser-data"),
+            config_path: dir.path().join("filebrowser-data/.filebrowser.json"),
+        }
+    }
+
     #[tokio::test]
     async fn install_fresh_pull() {
         let rt = Arc::new(MockRuntime::default());

core/archipelago/src/container/quadlet.rs

@@ -222,7 +222,7 @@ impl QuadletUnit {
         for env in &self.environment {
             // env entries already arrive shaped as "KEY=VALUE"; quadlet
             // accepts that form on a single Environment= line per pair.
-            let _ = writeln!(s, "Environment={env}");
+            let _ = writeln!(s, "Environment={}", quote_environment(env));
         }
         for dev in &self.devices {
             let _ = writeln!(s, "AddDevice={dev}");
@@ -296,6 +296,23 @@ fn shell_join(parts: &[String]) -> String {
         .join(" ")
 }
 
+fn quote_environment(env: &str) -> String {
+    let env = env.replace(['\r', '\n'], " ");
+    if env.is_empty()
+        || env
+            .chars()
+            .any(|c| c.is_whitespace() || "\"\\$`".contains(c))
+    {
+        let escaped = env
+            .replace('\\', "\\\\")
+            .replace('"', "\\\"")
+            .replace('$', "$$");
+        format!("\"{escaped}\"")
+    } else {
+        env
+    }
+}
+
 impl QuadletUnit {
     /// Build a backend-flavour QuadletUnit from a parsed AppManifest.
     /// Wired through `prod_orchestrator::install_via_quadlet`, gated by
@@ -778,6 +795,22 @@ mod tests {
         );
     }
 
+    #[test]
+    fn quote_environment_quotes_values_with_spaces() {
+        assert_eq!(
+            quote_environment("BITCOIN_RPC_PASS=secret"),
+            "BITCOIN_RPC_PASS=secret"
+        );
+        assert_eq!(
+            quote_environment("RELAY_NAME=Archipelago Nostr Relay"),
+            "\"RELAY_NAME=Archipelago Nostr Relay\""
+        );
+        assert_eq!(
+            quote_environment("GREETING=say \"hi\""),
+            "\"GREETING=say \\\"hi\\\"\""
+        );
+    }
+
     #[test]
     fn restart_policy_emits_correct_systemd_string() {
         assert_eq!(RestartPolicy::Always.as_systemd(), "always");
@@ -797,6 +830,7 @@ mod tests {
             environment: vec![
                 "BITCOIN_RPC_USER=archipelago".into(),
                 "BITCOIN_RPC_PASS=secret".into(),
+                "RELAY_NAME=Archipelago Nostr Relay".into(),
             ],
             devices: vec!["/dev/kvm".into()],
             add_hosts: vec![("host.archipelago".into(), "10.89.0.1".into())],
@@ -813,6 +847,7 @@ mod tests {
         assert!(s.contains("PublishPort=8333:8333/tcp"));
         assert!(s.contains("Environment=BITCOIN_RPC_USER=archipelago"));
         assert!(s.contains("Environment=BITCOIN_RPC_PASS=secret"));
+        assert!(s.contains("Environment=\"RELAY_NAME=Archipelago Nostr Relay\""));
         assert!(s.contains("AddDevice=/dev/kvm"));
         assert!(s.contains("AddHost=host.archipelago:10.89.0.1"));
         assert!(s.contains("ReadOnly=true"));

core/archipelago/src/health_monitor.rs

@@ -8,7 +8,7 @@ use crate::data_model::{Notification, NotificationLevel, PackageState};
 use crate::state::StateManager;
 use crate::webhooks::{self, WebhookEvent};
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 use std::time::Instant;
@@ -420,6 +420,9 @@ async fn check_containers() -> Vec<ContainerHealth> {
     let stdout = String::from_utf8_lossy(&output.stdout);
     let containers: Vec<serde_json::Value> = serde_json::from_str(&stdout).unwrap_or_default();
 
+    let live_container_ids = live_container_ids(&containers);
+    cleanup_stale_podman_healthcheck_units(&live_container_ids).await;
+
     // Monitor ALL long-running containers for health — backend services (databases,
     // nbxplorer, mempool-api) and UI containers need auto-restart too.
     // Only skip ephemeral containers (build infrastructure, init one-shots).
@@ -462,6 +465,161 @@ async fn check_containers() -> Vec<ContainerHealth> {
         .collect()
 }
 
+fn live_container_ids(containers: &[serde_json::Value]) -> HashSet<String> {
+    containers
+        .iter()
+        .filter_map(|c| {
+            c.get("Id")
+                .or_else(|| c.get("ID"))
+                .and_then(|v| v.as_str())
+                .map(|s| s.to_string())
+        })
+        .collect()
+}
+
+async fn cleanup_stale_podman_healthcheck_units(live_container_ids: &HashSet<String>) {
+    if live_container_ids.is_empty() {
+        return;
+    }
+
+    let mut units = stale_healthcheck_units_from_systemd(live_container_ids).await;
+    if units.is_empty() {
+        return;
+    }
+    units.sort();
+    units.dedup();
+
+    let mut cleaned = 0;
+    for unit in units {
+        let Some(container_id) = parse_podman_healthcheck_unit(&unit) else {
+            continue;
+        };
+        let service = format!("{}.service", unit.trim_end_matches(".timer"));
+        if stop_user_unit(&unit).await {
+            cleaned += 1;
+        }
+        let _ = stop_user_unit(&service).await;
+        let _ = reset_failed_user_unit(&service).await;
+        debug!(
+            "Stopped stale Podman healthcheck unit {} for removed container {}",
+            unit, container_id
+        );
+    }
+
+    if cleaned > 0 {
+        info!("Cleaned {} stale Podman healthcheck timer(s)", cleaned);
+    }
+}
+
+async fn stale_healthcheck_units_from_systemd(live_container_ids: &HashSet<String>) -> Vec<String> {
+    let mut units = Vec::new();
+    for args in [
+        [
+            "--user",
+            "list-timers",
+            "--all",
+            "--no-legend",
+            "--no-pager",
+        ]
+        .as_slice(),
+        ["--user", "list-units", "--all", "--no-legend", "--no-pager"].as_slice(),
+    ] {
+        let output = match tokio::time::timeout(
+            std::time::Duration::from_secs(20),
+            tokio::process::Command::new("systemctl")
+                .args(args.iter().copied())
+                .output(),
+        )
+        .await
+        {
+            Ok(Ok(output)) if output.status.success() => output,
+            Ok(Ok(output)) => {
+                let stderr = String::from_utf8_lossy(&output.stderr);
+                debug!("systemctl {} failed: {}", args.join(" "), stderr.trim());
+                continue;
+            }
+            Ok(Err(e)) => {
+                debug!("Failed to run systemctl {}: {}", args.join(" "), e);
+                continue;
+            }
+            Err(_) => {
+                debug!("systemctl {} timed out", args.join(" "));
+                continue;
+            }
+        };
+
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        units.extend(stale_healthcheck_units(&stdout, live_container_ids));
+    }
+    units
+}
+
+fn stale_healthcheck_units(output: &str, live_container_ids: &HashSet<String>) -> Vec<String> {
+    output
+        .lines()
+        .flat_map(|line| line.split_whitespace())
+        .filter_map(|token| {
+            let unit = token.trim_start_matches('●');
+            let id = parse_podman_healthcheck_unit(unit)?;
+            (!live_container_ids.contains(id)).then(|| unit.to_string())
+        })
+        .collect()
+}
+
+fn parse_podman_healthcheck_unit(unit: &str) -> Option<&str> {
+    let unit = unit
+        .strip_suffix(".timer")
+        .or_else(|| unit.strip_suffix(".service"))?;
+    let (container_id, _suffix) = unit.split_once('-')?;
+    if container_id.len() == 64 && container_id.bytes().all(|b| b.is_ascii_hexdigit()) {
+        Some(container_id)
+    } else {
+        None
+    }
+}
+
+async fn stop_user_unit(unit: &str) -> bool {
+    run_systemctl_user(["stop", unit]).await
+}
+
+async fn reset_failed_user_unit(unit: &str) -> bool {
+    run_systemctl_user(["reset-failed", unit]).await
+}
+
+async fn run_systemctl_user<const N: usize>(args: [&str; N]) -> bool {
+    let output = match tokio::time::timeout(
+        std::time::Duration::from_secs(10),
+        tokio::process::Command::new("systemctl")
+            .arg("--user")
+            .args(args.iter().copied())
+            .output(),
+    )
+    .await
+    {
+        Ok(Ok(output)) => output,
+        Ok(Err(e)) => {
+            debug!("Failed to run systemctl --user {}: {}", args.join(" "), e);
+            return false;
+        }
+        Err(_) => {
+            debug!("systemctl --user {} timed out", args.join(" "));
+            return false;
+        }
+    };
+
+    if output.status.success() {
+        true
+    } else {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        debug!(
+            "systemctl --user {} failed: {}",
+            args.join(" "),
+            stderr.trim()
+        );
+        false
+    }
+}
+
 fn parse_podman_health(c: &serde_json::Value, state: &str) -> Option<String> {
     c.get("Status")
         .and_then(|v| v.as_str())
@@ -625,6 +783,14 @@ pub fn spawn_health_monitor(state: Arc<StateManager>, data_dir: PathBuf) {
                 }
 
                 if container.healthy {
+                    let before = data.notifications.len();
+                    data.notifications.retain(|n| {
+                        n.app_id.as_deref() != Some(&container.app_id)
+                            && !n.title.contains(&container.app_id)
+                    });
+                    if data.notifications.len() != before {
+                        state_changed = true;
+                    }
                     if tracker.attempt_count(&container.name) > 0 {
                         info!(
                             "Container {} is healthy again after restart",
@@ -674,6 +840,21 @@ pub fn spawn_health_monitor(state: Arc<StateManager>, data_dir: PathBuf) {
                 }
             }
 
+            let unhealthy_app_ids: HashSet<&str> = unhealthy
+                .iter()
+                .map(|container| container.app_id.as_str())
+                .collect();
+            let before = data.notifications.len();
+            data.notifications.retain(|n| {
+                !n.id.starts_with("health-")
+                    || n.app_id
+                        .as_deref()
+                        .is_some_and(|app_id| unhealthy_app_ids.contains(app_id))
+            });
+            if data.notifications.len() != before {
+                state_changed = true;
+            }
+
             // Sort by startup tier: databases first, then core, then dependent, then apps, then UIs
             unhealthy.sort_by_key(|c| container_tier(&c.name));
 
@@ -1173,4 +1354,49 @@ mod tests {
             Some("unhealthy")
         );
     }
+
+    #[test]
+    fn parses_podman_healthcheck_systemd_units() {
+        let id = "c1f44a6369c91d65f9e9f6134a5591aa02792cff2f1a4e0f689b5a6c03b6c77c";
+        assert_eq!(
+            parse_podman_healthcheck_unit(&format!("{}-15c66ddfefa8a763.timer", id)),
+            Some(id)
+        );
+        assert_eq!(
+            parse_podman_healthcheck_unit(&format!("{}-15c66ddfefa8a763.service", id)),
+            Some(id)
+        );
+        assert_eq!(parse_podman_healthcheck_unit("grafana.service"), None);
+        assert_eq!(
+            parse_podman_healthcheck_unit(
+                "nothexzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz-x.timer"
+            ),
+            None
+        );
+    }
+
+    #[test]
+    fn stale_healthcheck_units_filters_only_removed_container_ids() {
+        let live = "6467e25fd87d791a63fe9dbf6e2fabc7bf26533aa2c402b1089effeacf7ebbba";
+        let stale = "c1f44a6369c91d65f9e9f6134a5591aa02792cff2f1a4e0f689b5a6c03b6c77c";
+        let mut live_ids = HashSet::new();
+        live_ids.insert(live.to_string());
+
+        let output = format!(
+            "  {live}-6fdc497fd3ba3b62.timer loaded active waiting\n\
+             ● {stale}-15c66ddfefa8a763.service loaded failed failed\n\
+             grafana.service loaded active running\n\
+             {stale}-1898d85de0bb707f.timer loaded active waiting\n"
+        );
+
+        let mut units = stale_healthcheck_units(&output, &live_ids);
+        units.sort();
+        assert_eq!(
+            units,
+            vec![
+                format!("{stale}-15c66ddfefa8a763.service"),
+                format!("{stale}-1898d85de0bb707f.timer"),
+            ]
+        );
+    }
 }

core/archipelago/src/mesh/listener/session.rs

@@ -1,42 +1,140 @@
 //! Mesh session lifecycle: connect, initialize, main loop.
 
+use super::super::meshtastic::MeshtasticDevice;
 use super::super::serial::MeshcoreDevice;
 use super::super::types::*;
 use super::{
     frames, MeshCommand, MeshState, ADVERT_INTERVAL, MAX_CONSECUTIVE_WRITE_FAILURES, SYNC_INTERVAL,
 };
-use anyhow::Result;
+use anyhow::{Context, Result};
 use std::sync::Arc;
 use std::time::Duration;
 use tokio::sync::mpsc;
 use tracing::{debug, error, info, warn};
 
-/// Scan all candidate serial ports and open the first Meshcore device found.
-async fn auto_detect_and_open() -> Result<(String, MeshcoreDevice, DeviceInfo)> {
+enum MeshRadioDevice {
+    Meshcore(MeshcoreDevice),
+    Meshtastic(MeshtasticDevice),
+}
+
+impl MeshRadioDevice {
+    fn device_type(&self) -> DeviceType {
+        match self {
+            Self::Meshcore(_) => DeviceType::Meshcore,
+            Self::Meshtastic(_) => DeviceType::Meshtastic,
+        }
+    }
+
+    fn advert_name(&self) -> Option<String> {
+        match self {
+            Self::Meshcore(device) => device.advert_name.clone(),
+            Self::Meshtastic(device) => device.advert_name(),
+        }
+    }
+
+    async fn set_advert_name(&mut self, name: &str) -> Result<()> {
+        match self {
+            Self::Meshcore(device) => device.set_advert_name(name).await,
+            Self::Meshtastic(device) => device.set_advert_name(name).await,
+        }
+    }
+
+    async fn send_self_advert(&mut self) -> Result<()> {
+        match self {
+            Self::Meshcore(device) => device.send_self_advert().await,
+            Self::Meshtastic(device) => device.send_self_advert().await,
+        }
+    }
+
+    async fn send_channel_text(&mut self, channel: u8, payload: &[u8]) -> Result<()> {
+        match self {
+            Self::Meshcore(device) => device.send_channel_text(channel, payload).await,
+            Self::Meshtastic(device) => device.send_channel_text(channel, payload).await,
+        }
+    }
+
+    async fn get_contacts(&mut self) -> Result<Vec<super::super::protocol::ParsedContact>> {
+        match self {
+            Self::Meshcore(device) => device.get_contacts().await,
+            Self::Meshtastic(device) => device.get_contacts().await,
+        }
+    }
+
+    async fn reset_contact_path(&mut self, pubkey: &[u8; 32]) -> Result<()> {
+        match self {
+            Self::Meshcore(device) => device.reset_contact_path(pubkey).await,
+            Self::Meshtastic(device) => device.reset_contact_path(pubkey).await,
+        }
+    }
+
+    async fn sync_messages(&mut self) -> Result<Vec<super::super::protocol::InboundFrame>> {
+        match self {
+            Self::Meshcore(device) => device.sync_messages().await,
+            Self::Meshtastic(device) => device.sync_messages().await,
+        }
+    }
+
+    async fn try_recv_frame(&mut self) -> Result<Option<super::super::protocol::InboundFrame>> {
+        match self {
+            Self::Meshcore(device) => device.try_recv_frame().await,
+            Self::Meshtastic(device) => device.try_recv_frame().await,
+        }
+    }
+}
+
+/// Scan all candidate serial ports and open the first supported mesh device found.
+async fn auto_detect_and_open() -> Result<(String, MeshRadioDevice, DeviceInfo)> {
     let paths = super::super::serial::detect_serial_devices().await;
     if paths.is_empty() {
         anyhow::bail!("No serial devices found in /dev");
     }
     for path in &paths {
-        debug!(path = %path, "Probing for Meshcore device");
+        debug!(path = %path, "Probing for mesh radio device");
         match MeshcoreDevice::open(path).await {
             Ok(mut dev) => match dev.initialize().await {
                 Ok(info) => {
                     info!(path = %path, firmware = %info.firmware_version, "Found Meshcore device via auto-detect");
-                    return Ok((path.clone(), dev, info));
+                    return Ok((path.clone(), MeshRadioDevice::Meshcore(dev), info));
                 }
                 Err(e) => debug!(path = %path, error = %e, "Not a Meshcore device"),
             },
             Err(e) => debug!(path = %path, error = %e, "Could not open serial port"),
         }
+        match MeshtasticDevice::open(path).await {
+            Ok(mut dev) => match dev.initialize().await {
+                Ok(info) => {
+                    info!(path = %path, firmware = %info.firmware_version, "Found Meshtastic device via auto-detect");
+                    return Ok((path.clone(), MeshRadioDevice::Meshtastic(dev), info));
+                }
+                Err(e) => debug!(path = %path, error = %e, "Not a Meshtastic device"),
+            },
+            Err(e) => debug!(path = %path, error = %e, "Could not open serial port for Meshtastic"),
+        }
     }
     anyhow::bail!(
-        "No Meshcore device found on {} candidate ports: {:?}",
+        "No supported mesh radio found on {} candidate ports: {:?}",
         paths.len(),
         paths
     )
 }
 
+async fn open_preferred_path(path: &str) -> Result<(MeshRadioDevice, DeviceInfo)> {
+    match MeshcoreDevice::open(path).await {
+        Ok(mut dev) => match dev.initialize().await {
+            Ok(info) => return Ok((MeshRadioDevice::Meshcore(dev), info)),
+            Err(e) => debug!(path = %path, error = %e, "Preferred path is not Meshcore"),
+        },
+        Err(e) => debug!(path = %path, error = %e, "Could not open preferred path as Meshcore"),
+    }
+    match MeshtasticDevice::open(path).await {
+        Ok(mut dev) => match dev.initialize().await {
+            Ok(info) => Ok((MeshRadioDevice::Meshtastic(dev), info)),
+            Err(e) => Err(e).context("Preferred path is not Meshtastic"),
+        },
+        Err(e) => Err(e).context("Could not open preferred path as Meshtastic"),
+    }
+}
+
 /// ASCII marker for the original DM-via-channel format:
 /// `@DM:` + base64(`[dest_prefix(6)][inner…]`). No sender info on the wire,
 /// so the receiver has to guess the sender from its contact table — which
@@ -90,7 +188,7 @@ fn our_sender_prefix(state: &Arc<MeshState>) -> [u8; 6] {
 /// with both the recipient and sender prefixes so attribution works on
 /// the receiver side.
 async fn send_dm_via_channel(
-    device: &mut MeshcoreDevice,
+    device: &mut MeshRadioDevice,
     state: &Arc<MeshState>,
     dest_pubkey_prefix: &[u8; 6],
     payload: &[u8],
@@ -166,7 +264,7 @@ async fn send_dm_via_channel(
 }
 
 /// Fetch the contacts list from the device and update the peer cache.
-async fn refresh_contacts(device: &mut MeshcoreDevice, state: &Arc<MeshState>) {
+async fn refresh_contacts(device: &mut MeshRadioDevice, state: &Arc<MeshState>) {
     match device.get_contacts().await {
         Ok(contacts) => {
             // Skip firmware contacts the user has explicitly wiped via
@@ -239,7 +337,7 @@ async fn refresh_contacts(device: &mut MeshcoreDevice, state: &Arc<MeshState>) {
 /// Drain any queued messages from the device.
 /// Returns `true` if a write/communication error occurred (for failure tracking).
 async fn sync_queued_messages(
-    device: &mut MeshcoreDevice,
+    device: &mut MeshRadioDevice,
     state: &Arc<MeshState>,
     our_x25519_secret: &[u8; 32],
 ) -> bool {
@@ -274,20 +372,11 @@ pub(super) async fn run_mesh_session(
 ) -> Result<()> {
     // Detect device — try preferred path first, fall back to auto-detect
     let (device_path, mut device, device_info) = if let Some(path) = preferred_path {
-        match MeshcoreDevice::open(path).await {
-            Ok(mut dev) => match dev.initialize().await {
-                Ok(info) => (path.to_string(), dev, info),
-                Err(e) => {
-                    warn!(
-                        "Preferred path {} handshake failed: {} — trying auto-detect",
-                        path, e
-                    );
-                    auto_detect_and_open().await?
-                }
-            },
+        match open_preferred_path(path).await {
+            Ok((dev, info)) => (path.to_string(), dev, info),
             Err(e) => {
                 warn!(
-                    "Preferred path {} open failed: {} — trying auto-detect",
+                    "Preferred path {} probe failed: {} — trying auto-detect",
                     path, e
                 );
                 auto_detect_and_open().await?
@@ -301,11 +390,11 @@ pub(super) async fn run_mesh_session(
     {
         let mut status = state.status.write().await;
         status.device_connected = true;
-        status.device_type = DeviceType::Meshcore;
+        status.device_type = device.device_type();
         status.device_path = Some(device_path.clone());
         status.firmware_version = Some(device_info.firmware_version.clone());
         status.self_node_id = Some(device_info.node_id);
-        status.self_advert_name = device.advert_name.clone();
+        status.self_advert_name = device.advert_name();
     }
 
     let _ = state.event_tx.send(MeshEvent::DeviceConnected(device_info));
@@ -434,7 +523,7 @@ pub(super) async fn run_mesh_session(
 /// Process a single outbound command from MeshService.
 async fn handle_send_command(
     cmd: MeshCommand,
-    device: &mut MeshcoreDevice,
+    device: &mut MeshRadioDevice,
     state: &Arc<MeshState>,
     consecutive_write_failures: &mut u32,
 ) {

core/archipelago/src/mesh/meshtastic.rs

@@ -0,0 +1,577 @@
+//! Async serial driver for Meshtastic devices.
+//!
+//! Meshtastic uses protobuf payloads over a SLIP-like serial stream. This
+//! module implements only the small subset Archipelago needs: connect,
+//! discover the local node, send/receive text packets, and provide synthetic
+//! contacts to the existing mesh listener.
+
+use super::protocol::{InboundFrame, ParsedContact};
+use super::types::{DeviceInfo, DeviceType};
+use anyhow::{Context, Result};
+use std::collections::HashMap;
+use std::time::Duration;
+use tracing::{debug, info, warn};
+
+const BAUD_RATE: u32 = 115200;
+const READ_TIMEOUT: Duration = Duration::from_secs(5);
+const WRITE_TIMEOUT: Duration = Duration::from_secs(2);
+const READ_BUF_SIZE: usize = 512;
+
+const START1: u8 = 0x94;
+const START2: u8 = 0xc3;
+const TO_RADIO_MAX: usize = 512;
+const BROADCAST_NUM: u32 = 0xffff_ffff;
+const TEXT_MESSAGE_APP: u32 = 1;
+
+const TO_RADIO_PACKET: u64 = 1;
+const TO_RADIO_WANT_CONFIG_ID: u64 = 3;
+const TO_RADIO_HEARTBEAT: u64 = 7;
+
+const FROM_RADIO_PACKET: u64 = 2;
+const FROM_RADIO_MY_INFO: u64 = 3;
+const FROM_RADIO_NODE_INFO: u64 = 4;
+const FROM_RADIO_CONFIG_COMPLETE_ID: u64 = 7;
+const FROM_RADIO_REBOOTED: u64 = 8;
+
+/// Async Meshtastic device handle.
+pub struct MeshtasticDevice {
+    port: serial2_tokio::SerialPort,
+    read_buf: Vec<u8>,
+    node_num: Option<u32>,
+    user_id: Option<String>,
+    long_name: Option<String>,
+    short_name: Option<String>,
+    contacts: HashMap<u32, ParsedContact>,
+    device_path: String,
+}
+
+impl MeshtasticDevice {
+    pub async fn open(path: &str) -> Result<Self> {
+        match tokio::fs::metadata(path).await {
+            Ok(meta) => debug!(path = %path, permissions = ?meta.permissions(), "Device node exists"),
+            Err(e) => anyhow::bail!("Serial device {} not accessible: {}", path, e),
+        }
+
+        let port = serial2_tokio::SerialPort::open(path, BAUD_RATE).context(format!(
+            "Failed to open serial port {} (permission denied? device busy?)",
+            path
+        ))?;
+        info!(path = %path, baud = BAUD_RATE, "Opened Meshtastic serial port");
+
+        Ok(Self {
+            port,
+            read_buf: Vec::with_capacity(READ_BUF_SIZE),
+            node_num: None,
+            user_id: None,
+            long_name: None,
+            short_name: None,
+            contacts: HashMap::new(),
+            device_path: path.to_string(),
+        })
+    }
+
+    pub async fn initialize(&mut self) -> Result<DeviceInfo> {
+        info!(path = %self.device_path, "Starting Meshtastic handshake");
+        self.send_to_radio(&encode_want_config()).await?;
+
+        let deadline = tokio::time::Instant::now() + READ_TIMEOUT;
+        let mut saw_meshtastic_frame = false;
+
+        loop {
+            let remaining = deadline.saturating_duration_since(tokio::time::Instant::now());
+            if remaining.is_zero() {
+                break;
+            }
+            match tokio::time::timeout(remaining.min(Duration::from_millis(250)), self.read_from_radio()).await {
+                Ok(Ok(Some(frame))) => {
+                    saw_meshtastic_frame = true;
+                    self.handle_from_radio(&frame);
+                    if self.node_num.is_some() && self.user_id.is_some() {
+                        break;
+                    }
+                }
+                Ok(Ok(None)) | Err(_) => {}
+                Ok(Err(e)) => return Err(e),
+            }
+        }
+
+        if !saw_meshtastic_frame {
+            anyhow::bail!("No Meshtastic serial API response");
+        }
+
+        let node_id = self.node_num.unwrap_or(0);
+        let firmware_version = self
+            .long_name
+            .clone()
+            .or_else(|| self.user_id.clone())
+            .unwrap_or_else(|| "Meshtastic".to_string());
+
+        info!(node_id, name = %firmware_version, "Meshtastic identity");
+        Ok(DeviceInfo {
+            firmware_version,
+            node_id,
+            max_contacts: 200,
+            device_type: DeviceType::Meshtastic,
+        })
+    }
+
+    pub async fn set_advert_name(&mut self, name: &str) -> Result<()> {
+        self.long_name = Some(name.to_string());
+        Ok(())
+    }
+
+    pub async fn send_self_advert(&mut self) -> Result<()> {
+        self.send_to_radio(&encode_heartbeat()).await
+    }
+
+    pub async fn send_channel_text(&mut self, _channel: u8, msg: &[u8]) -> Result<()> {
+        let text = String::from_utf8_lossy(msg);
+        let packet = encode_mesh_packet(BROADCAST_NUM, TEXT_MESSAGE_APP, text.as_bytes());
+        self.send_to_radio(&encode_to_radio_variant(TO_RADIO_PACKET, &packet))
+            .await
+    }
+
+    pub async fn get_contacts(&mut self) -> Result<Vec<ParsedContact>> {
+        Ok(self.contacts.values().cloned().collect())
+    }
+
+    pub async fn reset_contact_path(&mut self, _pubkey: &[u8; 32]) -> Result<()> {
+        Ok(())
+    }
+
+    pub async fn sync_messages(&mut self) -> Result<Vec<InboundFrame>> {
+        Ok(Vec::new())
+    }
+
+    pub async fn try_recv_frame(&mut self) -> Result<Option<InboundFrame>> {
+        let Some(frame) = self.read_from_radio().await? else {
+            return Ok(None);
+        };
+        Ok(self.handle_from_radio(&frame))
+    }
+
+    pub fn advert_name(&self) -> Option<String> {
+        self.long_name
+            .clone()
+            .or_else(|| self.short_name.clone())
+            .or_else(|| self.user_id.clone())
+    }
+
+    async fn send_to_radio(&mut self, payload: &[u8]) -> Result<()> {
+        if payload.len() > TO_RADIO_MAX {
+            anyhow::bail!("Meshtastic payload too large: {} bytes", payload.len());
+        }
+        let mut frame = Vec::with_capacity(4 + payload.len());
+        frame.push(START1);
+        frame.push(START2);
+        frame.extend_from_slice(&(payload.len() as u16).to_be_bytes());
+        frame.extend_from_slice(payload);
+        tokio::time::timeout(WRITE_TIMEOUT, self.port.write_all(&frame))
+            .await
+            .context("Meshtastic serial write timed out")?
+            .context("Meshtastic serial write failed")?;
+        Ok(())
+    }
+
+    async fn read_from_radio(&mut self) -> Result<Option<Vec<u8>>> {
+        if let Some(frame) = decode_serial_frame(&mut self.read_buf) {
+            return Ok(Some(frame));
+        }
+
+        let mut tmp = [0u8; READ_BUF_SIZE];
+        match tokio::time::timeout(Duration::from_millis(50), self.port.read(&mut tmp)).await {
+            Ok(Ok(0)) => anyhow::bail!("Meshtastic serial port closed"),
+            Ok(Ok(n)) => self.read_buf.extend_from_slice(&tmp[..n]),
+            Ok(Err(e)) => return Err(e).context("Meshtastic serial read error"),
+            Err(_) => return Ok(None),
+        }
+
+        Ok(decode_serial_frame(&mut self.read_buf))
+    }
+
+    fn handle_from_radio(&mut self, frame: &[u8]) -> Option<InboundFrame> {
+        let Some((field, value)) = decode_top_level_variant(frame) else {
+            return None;
+        };
+        match field {
+            FROM_RADIO_MY_INFO => {
+                if let Some((node_num, user_id)) = parse_my_info(value) {
+                    self.node_num = Some(node_num);
+                    if let Some(user_id) = user_id {
+                        self.user_id = Some(user_id);
+                    }
+                }
+                None
+            }
+            FROM_RADIO_NODE_INFO => {
+                self.update_node_info(value);
+                None
+            }
+            FROM_RADIO_PACKET => self.packet_to_inbound_frame(value),
+            FROM_RADIO_CONFIG_COMPLETE_ID | FROM_RADIO_REBOOTED => None,
+            other => {
+                debug!(field = other, len = value.len(), "Unhandled Meshtastic FromRadio field");
+                None
+            }
+        }
+    }
+
+    fn update_node_info(&mut self, data: &[u8]) {
+        if let Some(node) = parse_node_info(data) {
+            let key = synthetic_pubkey(node.num);
+            let name = node
+                .long_name
+                .or(node.short_name)
+                .or(node.id)
+                .unwrap_or_else(|| format!("Meshtastic !{:08x}", node.num));
+            if Some(node.num) == self.node_num {
+                self.long_name = Some(name.clone());
+            }
+            self.contacts.insert(
+                node.num,
+                ParsedContact {
+                    public_key_hex: hex::encode(key),
+                    advert_name: name,
+                    last_advert: node.last_heard.unwrap_or_default(),
+                    contact_type: 1,
+                    path_len: 0xff,
+                    flags: 0,
+                },
+            );
+        }
+    }
+
+    fn packet_to_inbound_frame(&mut self, data: &[u8]) -> Option<InboundFrame> {
+        let packet = parse_mesh_packet(data)?;
+        if packet.portnum != TEXT_MESSAGE_APP || packet.payload.is_empty() {
+            return None;
+        }
+        let from = packet.from.unwrap_or(0);
+        if Some(from) == self.node_num {
+            return None;
+        }
+        let from_key = synthetic_pubkey(from);
+        self.contacts.entry(from).or_insert_with(|| ParsedContact {
+            public_key_hex: hex::encode(synthetic_pubkey(from)),
+            advert_name: format!("Meshtastic !{:08x}", from),
+            last_advert: 0,
+            contact_type: 1,
+            path_len: 0xff,
+            flags: 0,
+        });
+
+        let mut payload = Vec::with_capacity(15 + packet.payload.len());
+        payload.push(0); // SNR unknown
+        payload.extend_from_slice(&[0, 0]); // reserved
+        payload.extend_from_slice(&from_key[..6]);
+        payload.push(0xff); // unknown/flood path
+        payload.push(0); // text type
+        payload.extend_from_slice(&0u32.to_le_bytes());
+        payload.extend_from_slice(&packet.payload);
+        Some(InboundFrame {
+            code: super::protocol::RESP_CONTACT_MSG_V3,
+            data: payload,
+            bytes_consumed: 0,
+        })
+    }
+}
+
+fn decode_serial_frame(buf: &mut Vec<u8>) -> Option<Vec<u8>> {
+    let start = buf.windows(2).position(|w| w == [START1, START2])?;
+    if start > 0 {
+        buf.drain(..start);
+    }
+    if buf.len() < 4 {
+        return None;
+    }
+    let len = u16::from_be_bytes([buf[2], buf[3]]) as usize;
+    if buf.len() < 4 + len {
+        return None;
+    }
+    let payload = buf[4..4 + len].to_vec();
+    buf.drain(..4 + len);
+    Some(payload)
+}
+
+fn encode_want_config() -> Vec<u8> {
+    encode_to_radio_variant(TO_RADIO_WANT_CONFIG_ID, &encode_varint_field(1, 1))
+}
+
+fn encode_heartbeat() -> Vec<u8> {
+    encode_to_radio_variant(TO_RADIO_HEARTBEAT, &[])
+}
+
+fn encode_to_radio_variant(field: u64, bytes: &[u8]) -> Vec<u8> {
+    let mut out = Vec::new();
+    encode_len_field(field, bytes, &mut out);
+    out
+}
+
+fn encode_mesh_packet(to: u32, portnum: u32, payload: &[u8]) -> Vec<u8> {
+    let mut decoded = Vec::new();
+    encode_varint_field_into(1, portnum as u64, &mut decoded);
+    encode_len_field(2, payload, &mut decoded);
+
+    let mut packet = Vec::new();
+    encode_fixed32_field(2, to, &mut packet);
+    encode_len_field(4, &decoded, &mut packet);
+    packet
+}
+
+fn decode_top_level_variant(buf: &[u8]) -> Option<(u64, &[u8])> {
+    let mut idx = 0;
+    while idx < buf.len() {
+        let (key, n) = read_varint(&buf[idx..])?;
+        idx += n;
+        let field = key >> 3;
+        match key & 0x07 {
+            0 => {
+                let (_, n) = read_varint(&buf[idx..])?;
+                idx += n;
+            }
+            2 => {
+                let (len, n) = read_varint(&buf[idx..])?;
+                idx += n;
+                let end = idx.checked_add(len as usize)?;
+                if end > buf.len() {
+                    return None;
+                }
+                if matches!(field, FROM_RADIO_PACKET | FROM_RADIO_MY_INFO | FROM_RADIO_NODE_INFO) {
+                    return Some((field, &buf[idx..end]));
+                }
+                idx = end;
+            }
+            _ => return None,
+        }
+    }
+    None
+}
+
+fn parse_my_info(data: &[u8]) -> Option<(u32, Option<String>)> {
+    let mut idx = 0;
+    let mut node_num = None;
+    let mut user_id = None;
+    while idx < data.len() {
+        let (field, value, next) = next_field(data, idx)?;
+        idx = next;
+        match (field, value) {
+            (1, FieldValue::Varint(v)) => node_num = Some(v as u32),
+            (1, FieldValue::Fixed32(v)) => node_num = Some(v),
+            (3, FieldValue::Bytes(b)) => user_id = parse_user(b).and_then(|u| u.id),
+            _ => {}
+        }
+    }
+    node_num.map(|n| (n, user_id))
+}
+
+struct ParsedNode {
+    num: u32,
+    id: Option<String>,
+    long_name: Option<String>,
+    short_name: Option<String>,
+    last_heard: Option<u32>,
+}
+
+fn parse_node_info(data: &[u8]) -> Option<ParsedNode> {
+    let mut idx = 0;
+    let mut node = ParsedNode {
+        num: 0,
+        id: None,
+        long_name: None,
+        short_name: None,
+        last_heard: None,
+    };
+    while idx < data.len() {
+        let (field, value, next) = next_field(data, idx)?;
+        idx = next;
+        match (field, value) {
+            (1, FieldValue::Varint(v)) => node.num = v as u32,
+            (1, FieldValue::Fixed32(v)) => node.num = v,
+            (2, FieldValue::Bytes(b)) => {
+                if let Some(user) = parse_user(b) {
+                    node.id = user.id;
+                    node.long_name = user.long_name;
+                    node.short_name = user.short_name;
+                }
+            }
+            (5, FieldValue::Fixed32(v)) => node.last_heard = Some(v),
+            _ => {}
+        }
+    }
+    if node.num == 0 {
+        None
+    } else {
+        Some(node)
+    }
+}
+
+struct ParsedUser {
+    id: Option<String>,
+    long_name: Option<String>,
+    short_name: Option<String>,
+}
+
+fn parse_user(data: &[u8]) -> Option<ParsedUser> {
+    let mut idx = 0;
+    let mut user = ParsedUser {
+        id: None,
+        long_name: None,
+        short_name: None,
+    };
+    while idx < data.len() {
+        let (field, value, next) = next_field(data, idx)?;
+        idx = next;
+        match (field, value) {
+            (1, FieldValue::Bytes(b)) => user.id = string_field(b),
+            (2, FieldValue::Bytes(b)) => user.long_name = string_field(b),
+            (3, FieldValue::Bytes(b)) => user.short_name = string_field(b),
+            _ => {}
+        }
+    }
+    Some(user)
+}
+
+struct ParsedPacket {
+    from: Option<u32>,
+    portnum: u32,
+    payload: Vec<u8>,
+}
+
+fn parse_mesh_packet(data: &[u8]) -> Option<ParsedPacket> {
+    let mut idx = 0;
+    let mut from = None;
+    let mut decoded = None;
+    while idx < data.len() {
+        let (field, value, next) = next_field(data, idx)?;
+        idx = next;
+        match (field, value) {
+            (1, FieldValue::Fixed32(v)) => from = Some(v),
+            (4, FieldValue::Bytes(b)) => decoded = Some(b),
+            _ => {}
+        }
+    }
+    let decoded = decoded?;
+    let mut didx = 0;
+    let mut portnum = 0;
+    let mut payload = Vec::new();
+    while didx < decoded.len() {
+        let (field, value, next) = next_field(decoded, didx)?;
+        didx = next;
+        match (field, value) {
+            (1, FieldValue::Varint(v)) => portnum = v as u32,
+            (2, FieldValue::Bytes(b)) => payload = b.to_vec(),
+            _ => {}
+        }
+    }
+    Some(ParsedPacket {
+        from,
+        portnum,
+        payload,
+    })
+}
+
+enum FieldValue<'a> {
+    Varint(u64),
+    Fixed32(u32),
+    Bytes(&'a [u8]),
+}
+
+fn next_field(buf: &[u8], idx: usize) -> Option<(u64, FieldValue<'_>, usize)> {
+    let (key, n) = read_varint(&buf[idx..])?;
+    let field = key >> 3;
+    let mut pos = idx + n;
+    match key & 0x07 {
+        0 => {
+            let (v, n) = read_varint(&buf[pos..])?;
+            pos += n;
+            Some((field, FieldValue::Varint(v), pos))
+        }
+        2 => {
+            let (len, n) = read_varint(&buf[pos..])?;
+            pos += n;
+            let end = pos.checked_add(len as usize)?;
+            if end > buf.len() {
+                return None;
+            }
+            Some((field, FieldValue::Bytes(&buf[pos..end]), end))
+        }
+        5 => {
+            let end = pos.checked_add(4)?;
+            if end > buf.len() {
+                None
+            } else {
+                let value = u32::from_le_bytes([
+                    buf[pos],
+                    buf[pos + 1],
+                    buf[pos + 2],
+                    buf[pos + 3],
+                ]);
+                Some((field, FieldValue::Fixed32(value), end))
+            }
+        }
+        1 => {
+            let end = pos.checked_add(8)?;
+            if end > buf.len() {
+                None
+            } else {
+                Some((field, FieldValue::Bytes(&buf[pos..end]), end))
+            }
+        }
+        wire => {
+            warn!(wire, "Unsupported Meshtastic protobuf wire type");
+            None
+        }
+    }
+}
+
+fn read_varint(buf: &[u8]) -> Option<(u64, usize)> {
+    let mut out = 0u64;
+    for (i, b) in buf.iter().copied().enumerate().take(10) {
+        out |= ((b & 0x7f) as u64) << (7 * i);
+        if b & 0x80 == 0 {
+            return Some((out, i + 1));
+        }
+    }
+    None
+}
+
+fn encode_varint_field(field: u64, value: u64) -> Vec<u8> {
+    let mut out = Vec::new();
+    encode_varint_field_into(field, value, &mut out);
+    out
+}
+
+fn encode_varint_field_into(field: u64, value: u64, out: &mut Vec<u8>) {
+    write_varint((field << 3) | 0, out);
+    write_varint(value, out);
+}
+
+fn encode_len_field(field: u64, bytes: &[u8], out: &mut Vec<u8>) {
+    write_varint((field << 3) | 2, out);
+    write_varint(bytes.len() as u64, out);
+    out.extend_from_slice(bytes);
+}
+
+fn encode_fixed32_field(field: u64, value: u32, out: &mut Vec<u8>) {
+    write_varint((field << 3) | 5, out);
+    out.extend_from_slice(&value.to_le_bytes());
+}
+
+fn write_varint(mut value: u64, out: &mut Vec<u8>) {
+    while value >= 0x80 {
+        out.push((value as u8 & 0x7f) | 0x80);
+        value >>= 7;
+    }
+    out.push(value as u8);
+}
+
+fn string_field(bytes: &[u8]) -> Option<String> {
+    std::str::from_utf8(bytes).ok().map(|s| s.to_string())
+}
+
+fn synthetic_pubkey(node_num: u32) -> [u8; 32] {
+    let mut out = [0u8; 32];
+    out[..4].copy_from_slice(&node_num.to_le_bytes());
+    out[4..15].copy_from_slice(b"meshtastic:");
+    out
+}

core/archipelago/src/mesh/mod.rs

@@ -1,13 +1,15 @@
-//! Mesh networking: Meshcore LoRa radio integration for offline peer discovery
+//! Mesh networking: LoRa radio integration for offline peer discovery
 //! and encrypted messaging between Archipelago nodes.
 //!
-//! Supports Meshcore firmware on Heltec V3, T-Beam, RAK WisBlock, Station G2,
-//! and other ESP32/nRF52-based LoRa boards via USB serial (Companion USB mode).
+//! Supports Meshcore firmware via Companion USB and Meshtastic firmware via
+//! the Meshtastic serial API on Heltec, T-Beam, RAK WisBlock, Station G2,
+//! and other ESP32/nRF52-based LoRa boards.
 
 pub mod alerts;
 pub mod bitcoin_relay;
 pub mod crypto;
 pub mod listener;
+pub mod meshtastic;
 pub mod message_types;
 pub mod outbox;
 pub mod protocol;

core/archipelago/src/mesh/protocol.rs

@@ -323,6 +323,7 @@ pub fn parse_self_info(data: &[u8]) -> Result<(u32, String)> {
 }
 
 /// Parsed contact from RESP_CONTACT (0x03).
+#[derive(Clone)]
 pub struct ParsedContact {
     pub public_key_hex: String,
     pub advert_name: String,

core/archipelago/src/port_allocator.rs

@@ -28,7 +28,6 @@ const RESERVED_PORTS: &[u16] = &[
     8888, // SearXNG
     8096, 2342, 2283, // Jellyfin, Photoprism, Immich
     8443, // FIPS TCP fallback
-    8444, 8084, // NPM
 ];
 
 /// Start of range for allocating web app ports when preferred is taken.
@@ -94,8 +93,12 @@ impl PortAllocator {
             .any(|m| m.host_port == port)
     }
 
+    fn can_bind(port: u16) -> bool {
+        std::net::TcpListener::bind(("0.0.0.0", port)).is_ok()
+    }
+
     fn is_available(&self, port: u16) -> bool {
-        !self.is_reserved(port) && !self.is_allocated(port)
+        !self.is_reserved(port) && !self.is_allocated(port) && Self::can_bind(port)
     }
 
     /// Allocate a host port for an app. Uses preferred_port if available, else finds next free.

core/container/src/podman_client.rs

@@ -127,7 +127,7 @@ impl PodmanClient {
             "photoprism" => "http://localhost:2342",
             "immich_server" | "immich" => "http://localhost:2283",
             "filebrowser" => "http://localhost:8083",
-            "nginx-proxy-manager" => "http://localhost:81",
+            "nginx-proxy-manager" => "http://localhost:8081",
             "portainer" => "http://localhost:9000",
             "uptime-kuma" => "http://localhost:3002",
             "fedimint" | "fedimintd" => "http://localhost:8175",

image-recipe/_archived/build-auto-installer-iso.sh

@@ -316,9 +316,15 @@ RUN apt-get update && apt-get -y full-upgrade && apt-get install -y --no-install
     dbus \
     sudo \
     network-manager \
+    wpasupplicant \
+    wireless-regdb \
+    iw \
+    rfkill \
+    polkitd \
     openssh-server \
     nginx \
     podman \
+    catatonit \
     uidmap \
     slirp4netns \
     passt \
@@ -455,8 +461,21 @@ RUN mkdir -p /etc/systemd/system/user@.service.d && \
 # Allow unprivileged ping inside rootless containers
 RUN printf 'net.ipv4.ping_group_range=0 2147483647\n' > /etc/sysctl.d/90-podman-ping.conf
 
+# Archipelago's web UI manages Wi-Fi through the backend service, not a local
+# desktop seat. Allow the dedicated system user to control NetworkManager.
+RUN mkdir -p /etc/polkit-1/rules.d && \
+    printf '%s\n' \
+      'polkit.addRule(function(action, subject) {' \
+      '    if (subject.user == "archipelago" && action.id.indexOf("org.freedesktop.NetworkManager.") == 0) {' \
+      '        return polkit.Result.YES;' \
+      '    }' \
+      '});' \
+      > /etc/polkit-1/rules.d/49-archipelago-networkmanager.rules && \
+    chmod 644 /etc/polkit-1/rules.d/49-archipelago-networkmanager.rules
+
 # Enable services
 RUN systemctl enable NetworkManager || true && \
+    systemctl enable polkit || systemctl enable polkit.service || true && \
     systemctl enable ssh || true && \
     systemctl enable nginx || true && \
     systemctl enable archipelago || true && \
@@ -696,6 +715,7 @@ kmod,procps,iproute2,ca-certificates,gdisk,\
 cryptsetup,cryptsetup-initramfs,parted,dosfstools,e2fsprogs,\
 linux-image-${DEB_ARCH},grub-efi-${DEB_ARCH},grub-pc-bin,\
 ifupdown,isc-dhcp-client,\
+wpasupplicant,wireless-regdb,iw,rfkill,\
 pciutils,usbutils,less,nano \
     trixie /installer http://deb.debian.org/debian
 
@@ -1100,12 +1120,15 @@ if [ "$BACKEND_CAPTURED" = "0" ]; then
 FROM rust:1.93-trixie as builder
 WORKDIR /build
 COPY core ./core
+COPY scripts ./scripts
+COPY image-recipe/configs ./image-recipe/configs
 RUN cd core && cargo build --release --bin archipelago
 BACKENDFILE
 
-    if $CONTAINER_CMD build --platform $CONTAINER_PLATFORM -t archipelago-backend -f "$BACKEND_DOCKERFILE" "$SCRIPT_DIR/.." 2>&1 | tail -20; then
+    BACKEND_IMAGE="localhost/archipelago-backend:iso"
+    if $CONTAINER_CMD build --platform $CONTAINER_PLATFORM -t "$BACKEND_IMAGE" -f "$BACKEND_DOCKERFILE" "$SCRIPT_DIR/.."; then
         echo "   Extracting backend binary..."
-        BACKEND_CONTAINER=$($CONTAINER_CMD create --platform $CONTAINER_PLATFORM archipelago-backend)
+        BACKEND_CONTAINER=$($CONTAINER_CMD create --platform $CONTAINER_PLATFORM "$BACKEND_IMAGE")
         $CONTAINER_CMD cp "$BACKEND_CONTAINER:/build/core/target/release/archipelago" "$ARCH_DIR/bin/" && \
             echo "   ✅ Backend binary built ($(du -h "$ARCH_DIR/bin/archipelago" | cut -f1))"
         $CONTAINER_CMD rm "$BACKEND_CONTAINER"

image-recipe/archipelago-scripts/install-to-disk.sh

@@ -166,7 +166,14 @@ chroot /mnt/archipelago apt-get install -y linux-image-amd64 grub-efi-amd64 grub
 echo "📦 Installing essential packages..."
 chroot /mnt/archipelago apt-get install -y \
     sudo \
-    networkmanager \
+    network-manager \
+    wpasupplicant \
+    wireless-regdb \
+    iw \
+    rfkill \
+    pciutils \
+    usbutils \
+    polkitd \
     openssh-server \
     curl \
     wget \
@@ -176,7 +183,7 @@ chroot /mnt/archipelago apt-get install -y \
     chrony
 
 echo "📦 Installing container tools..."
-chroot /mnt/archipelago apt-get install -y podman || echo "⚠️  Podman not available in base repos, will use containers.io later"
+chroot /mnt/archipelago apt-get install -y podman catatonit || echo "⚠️  Podman/catatonit not available in base repos, will use containers.io later"
 
 echo "🔧 Installing GRUB bootloader..."
 # Need to run grub-install inside chroot with proper environment
@@ -198,9 +205,20 @@ echo "archipelago:archipelago" | chroot /mnt/archipelago chpasswd
 
 echo "⚙️  Enabling services..."
 chroot /mnt/archipelago systemctl enable NetworkManager || true
+chroot /mnt/archipelago systemctl enable polkit || chroot /mnt/archipelago systemctl enable polkit.service || true
 chroot /mnt/archipelago systemctl enable ssh || chroot /mnt/archipelago systemctl enable sshd || true
 chroot /mnt/archipelago systemctl enable chrony || true
 
+mkdir -p /mnt/archipelago/etc/polkit-1/rules.d
+cat > /mnt/archipelago/etc/polkit-1/rules.d/49-archipelago-networkmanager.rules <<'EOF'
+polkit.addRule(function(action, subject) {
+    if (subject.user == "archipelago" && action.id.indexOf("org.freedesktop.NetworkManager.") == 0) {
+        return polkit.Result.YES;
+    }
+});
+EOF
+chmod 644 /mnt/archipelago/etc/polkit-1/rules.d/49-archipelago-networkmanager.rules
+
 # Remove policy-rc.d so services can start on first boot
 rm -f /mnt/archipelago/usr/sbin/policy-rc.d
 

image-recipe/configs/99-mesh-radio.rules

@@ -1,6 +1,8 @@
 # Stable symlink for USB serial adapters used as mesh radios.
 # Creates /dev/mesh-radio pointing to the underlying ttyUSB device.
-# Supports: CP2102 (Heltec V3), CH340 (T-Beam), FTDI (RAK WisBlock).
+# Supports MeshCore and Meshtastic radios using CP2102 (Heltec V3),
+# CH340 (T-Beam), FTDI (RAK WisBlock), and USB CDC ACM devices.
 SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", SYMLINK+="mesh-radio", MODE="0660", GROUP="dialout"
 SUBSYSTEM=="tty", ATTRS{idVendor}=="1a86", ATTRS{idProduct}=="7523", SYMLINK+="mesh-radio", MODE="0660", GROUP="dialout"
 SUBSYSTEM=="tty", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6001", SYMLINK+="mesh-radio", MODE="0660", GROUP="dialout"
+SUBSYSTEM=="tty", KERNEL=="ttyACM[0-9]*", SYMLINK+="mesh-radio", MODE="0660", GROUP="dialout"

image-recipe/configs/nginx-archipelago.conf

@@ -105,9 +105,25 @@ server {
         try_files $uri =404;
     }
 
+    # Versioned Vite assets must never fall through to index.html. During OTA
+    # a browser can keep an old HTML shell that references now-removed hashed
+    # chunks; returning HTML for /assets/*.js triggers strict MIME failures.
+    # A real 404 plus immutable/no-cache split lets the app/browser recover on
+    # refresh without caching the wrong content type.
+    location /assets/ {
+        try_files $uri =404;
+        add_header Cache-Control "public, max-age=31536000, immutable" always;
+    }
+
+    location ~* ^/(registerSW\.js|sw\.js|workbox-[^/]+\.js)$ {
+        try_files $uri =404;
+        add_header Cache-Control "no-cache, must-revalidate" always;
+    }
+
     # Serve static files (Vue.js SPA)
     location / {
         try_files $uri $uri/ /index.html;
+        add_header Cache-Control "no-cache, must-revalidate";
     }
 
     # Peer-to-peer node messaging (receives from other nodes over Tor)
@@ -741,7 +757,7 @@ server {
         sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
     }
     location /app/nginx-proxy-manager/ {
-        proxy_pass http://127.0.0.1:81/;
+        proxy_pass http://127.0.0.1:8081/;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -873,6 +889,23 @@ server {
     }
 }
 
+# Compatibility proxy for cached PWA bundles that still launch Nginx Proxy
+# Manager on :81. Rootless Podman cannot bind host ports below 1024, so the
+# container admin UI runs on :8081 and host nginx owns the old :81 entrypoint.
+server {
+    listen 81;
+    server_name _;
+
+    location / {
+        proxy_pass http://127.0.0.1:8081/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
 # HTTPS - required for PWA install (Add to Home Screen) from dev servers
 server {
     listen 443 ssl;

image-recipe/configs/snippets/archipelago-https-app-proxies.conf

@@ -358,7 +358,7 @@ location /app/indeedhub/ {
     sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
 }
 location /app/nginx-proxy-manager/ {
-    proxy_pass http://127.0.0.1:81/;
+    proxy_pass http://127.0.0.1:8081/;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;

neode-ui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "neode-ui",
-  "version": "1.7.55-alpha",
+  "version": "1.7.58-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.7.55-alpha",
+      "version": "1.7.58-alpha",
       "dependencies": {
         "@types/dompurify": "^3.0.5",
         "@vue-leaflet/vue-leaflet": "^0.10.1",

neode-ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "neode-ui",
   "private": true,
-  "version": "1.7.55-alpha",
+  "version": "1.7.58-alpha",
   "type": "module",
   "scripts": {
     "start": "./start-dev.sh",

neode-ui/src/App.vue

@@ -161,7 +161,7 @@ function onKeyDown(e: KeyboardEvent) {
   }
   // 's' key activates screensaver when authenticated (skip if typing in input)
   if (e.key === 's' || e.key === 'S') {
-    if (!isInput && appStore.isAuthenticated && !screensaverStore.isActive) {
+    if (!isInput && appStore.isAuthenticated && !screensaverStore.isActive && !screensaverStore.isSuppressed) {
       e.preventDefault()
       screensaverStore.activate()
     }

neode-ui/src/stores/__tests__/appLauncher.test.ts

@@ -98,7 +98,7 @@ describe('useAppLauncherStore', () => {
     expect(store.panelAppId).toBe('btcpay-server')
   })
 
-  it('opens Nginx Proxy Manager in new tab even when URL resolves', () => {
+  it('normalizes old Nginx Proxy Manager port 81 to 8081', () => {
     const store = useAppLauncherStore()
 
     store.open({ url: 'http://192.168.1.228:81', title: 'Nginx Proxy Manager' })
@@ -106,7 +106,7 @@ describe('useAppLauncherStore', () => {
     expect(store.isOpen).toBe(false)
     expect(store.panelAppId).toBe(null)
     expect(mockWindowOpen).toHaveBeenCalledWith(
-      'http://192.168.1.228:81',
+      'http://192.168.1.228:8081',
       '_blank',
       'noopener,noreferrer',
     )
@@ -125,13 +125,13 @@ describe('useAppLauncherStore', () => {
     expect(store.panelAppId).toBe(null)
   })
 
-  it('normalizes legacy Nginx Proxy Manager port 8181 to 81', () => {
+  it('normalizes legacy Nginx Proxy Manager ports to 8081', () => {
     const store = useAppLauncherStore()
 
     store.open({ url: 'http://192.168.1.228:8181', title: 'Nginx Proxy Manager' })
 
     expect(mockWindowOpen).toHaveBeenCalledWith(
-      'http://192.168.1.228:81',
+      'http://192.168.1.228:8081',
       '_blank',
       'noopener,noreferrer',
     )

neode-ui/src/stores/__tests__/screensaver.test.ts

@@ -68,6 +68,24 @@ describe('useScreensaverStore', () => {
     expect(store.isActive).toBe(false)
   })
 
+  it('suppression prevents automatic and manual activation until resumed', () => {
+    const store = useScreensaverStore()
+    store.suppress('video')
+    expect(store.isSuppressed).toBe(true)
+
+    store.resetInactivityTimer()
+    vi.advanceTimersByTime(5 * 60 * 1000)
+    expect(store.isActive).toBe(false)
+
+    store.activate()
+    expect(store.isActive).toBe(false)
+
+    store.resume('video')
+    expect(store.isSuppressed).toBe(false)
+    vi.advanceTimersByTime(3 * 60 * 1000)
+    expect(store.isActive).toBe(true)
+  })
+
   it('activate clears any pending timer', () => {
     const store = useScreensaverStore()
     store.deactivate()

neode-ui/src/stores/appLauncher.ts

@@ -61,8 +61,8 @@ function normalizeLaunchUrl(urlStr: string, appIdHint?: string | null): string {
       return rebuilt('3002')
     }
 
-    if (sameHost && appIdHint === 'nginx-proxy-manager' && u.port === '8181') {
-      return rebuilt('81')
+    if (sameHost && appIdHint === 'nginx-proxy-manager' && (u.port === '81' || u.port === '8181')) {
+      return rebuilt('8081')
     }
 
     return rewrittenLocalhost ? u.toString() : urlStr
@@ -74,6 +74,7 @@ function normalizeLaunchUrl(urlStr: string, appIdHint?: string | null): string {
 /** Port → app ID for resolving URLs to AppSession routes */
 const PORT_TO_APP_ID: Record<string, string> = {
   '81': 'nginx-proxy-manager',
+  '8081': 'nginx-proxy-manager',
   '8181': 'nginx-proxy-manager',
   '3000': 'grafana',
   '3002': 'uptime-kuma',

neode-ui/src/stores/screensaver.ts

@@ -6,12 +6,15 @@ const INACTIVITY_MS = 3 * 60 * 1000 // 3 minutes
 export const useScreensaverStore = defineStore('screensaver', () => {
   const isActive = ref(false)
   const activationCount = ref(0)
+  const suppressionReasons = ref<Set<string>>(new Set())
   let inactivityTimer: ReturnType<typeof setTimeout> | null = null
 
   /** True when the current activation is the ASCII variant (every 3rd time) */
   const isAsciiMode = computed(() => activationCount.value > 0 && activationCount.value % 3 === 0)
+  const isSuppressed = computed(() => suppressionReasons.value.size > 0)
 
   function activate() {
+    if (isSuppressed.value) return
     activationCount.value++
     isActive.value = true
     clearInactivityTimer()
@@ -24,8 +27,10 @@ export const useScreensaverStore = defineStore('screensaver', () => {
 
   function resetInactivityTimer() {
     clearInactivityTimer()
+    if (isSuppressed.value) return
     inactivityTimer = setTimeout(() => {
       inactivityTimer = null
+      if (isSuppressed.value) return
       isActive.value = true
     }, INACTIVITY_MS)
   }
@@ -37,13 +42,30 @@ export const useScreensaverStore = defineStore('screensaver', () => {
     }
   }
 
+  function suppress(reason: string) {
+    suppressionReasons.value = new Set(suppressionReasons.value).add(reason)
+    clearInactivityTimer()
+    isActive.value = false
+  }
+
+  function resume(reason: string) {
+    if (!suppressionReasons.value.has(reason)) return
+    const next = new Set(suppressionReasons.value)
+    next.delete(reason)
+    suppressionReasons.value = next
+    if (next.size === 0) resetInactivityTimer()
+  }
+
   return {
     isActive,
     isAsciiMode,
+    isSuppressed,
     activationCount,
     activate,
     deactivate,
     resetInactivityTimer,
     clearInactivityTimer,
+    suppress,
+    resume,
   }
 })

neode-ui/src/views/AppDetails.vue

@@ -140,6 +140,8 @@ import { rpcClient } from '@/api/rpc-client'
 import AppHeroSection from './appDetails/AppHeroSection.vue'
 import AppContentSection from './appDetails/AppContentSection.vue'
 import AppSidebar from './appDetails/AppSidebar.vue'
+import { resolveAppUrl } from './appSession/appSessionConfig'
+import { isWebsitePackage, resolveRuntimeLaunchUrl } from './apps/appsConfig'
 import {
   WEB_ONLY_APP_URLS,
   PACKAGE_ALIASES,
@@ -266,7 +268,9 @@ const backButtonText = computed(() => {
 const canLaunch = computed(() => {
   if (!pkg.value) return false
   if (isWebOnly.value) return true
-  const hasUI = !!(pkg.value.manifest.interfaces?.main?.ui || pkg.value.installed?.['interface-addresses']?.main)
+  const hasRuntimeAddress = !!pkg.value.installed?.['interface-addresses']?.main?.['lan-address']
+  const hasKnownLaunchUrl = typeof window !== 'undefined' && !!resolveAppUrl(pkg.value.manifest.id)
+  const hasUI = !!(pkg.value.manifest.interfaces?.main?.ui || hasRuntimeAddress || hasKnownLaunchUrl)
   return hasUI && pkg.value.state === 'running' && pkg.value.health !== 'starting' && pkg.value.health !== 'unhealthy'
 })
 
@@ -291,6 +295,18 @@ function launchApp() {
     return
   }
 
+  if (isWebsitePackage(id, pkg.value)) {
+    const url = resolveRuntimeLaunchUrl(pkg.value)
+    if (url) window.open(url, '_blank', 'noopener,noreferrer')
+    return
+  }
+
+  const runtimeUrl = resolveRuntimeLaunchUrl(pkg.value)
+  if (runtimeUrl) {
+    useAppLauncherStore().open({ url: runtimeUrl, title: pkg.value.manifest.title })
+    return
+  }
+
   // Container apps should launch through session routing so protocol/path
   // handling stays centralized in appSessionConfig.
   useAppLauncherStore().openSession(id)

neode-ui/src/views/AppSession.vue

@@ -91,6 +91,7 @@
 import { ref, computed, onMounted, onBeforeUnmount, watch } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 import { useAppLauncherStore } from '@/stores/appLauncher'
+import { useScreensaverStore } from '@/stores/screensaver'
 import NostrIdentityPicker from '@/components/NostrIdentityPicker.vue'
 import AppSessionHeader from './appSession/AppSessionHeader.vue'
 import AppSessionFrame from './appSession/AppSessionFrame.vue'
@@ -115,6 +116,7 @@ const isInlinePanel = computed(() => !!props.appIdProp)
 
 const route = useRoute()
 const router = useRouter()
+const screensaverStore = useScreensaverStore()
 
 const sessionRef = ref<HTMLElement | null>(null)
 const frameRef = ref<InstanceType<typeof AppSessionFrame> | null>(null)
@@ -145,6 +147,14 @@ const appId = computed(() => {
 const appTitle = computed(() => resolveAppTitle(appId.value))
 const isMobile = typeof window !== 'undefined' && window.innerWidth < 768
 const mustOpenNewTab = computed(() => NEW_TAB_APPS.has(appId.value))
+const screensaverReason = computed(() => `app-session:${appId.value}`)
+const screensaverSuppressedApps = new Set([
+  'indeedhub',
+  'jellyfin',
+  'immich',
+  'photoprism',
+  'filebrowser',
+])
 
 const appUrl = computed(() => {
   return resolveAppUrl(appId.value, route.query.path as string | undefined)
@@ -306,6 +316,8 @@ function onFullscreenChange() {
 function onMessage(e: MessageEvent) {
   if (e.data?.type === 'nostr-request') nostrBridge.handleNostrRequest(e)
   if (e.data?.type === 'archipelago:identity:request') identity.handleIdentityRequest()
+  if (e.data?.type === 'archipelago:media:playing') screensaverStore.suppress(screensaverReason.value)
+  if (e.data?.type === 'archipelago:media:idle') screensaverStore.resume(screensaverReason.value)
 }
 
 // Enter fullscreen on mount if mode is fullscreen
@@ -338,6 +350,9 @@ onMounted(() => {
       sessionRef.value?.requestFullscreen().catch(() => {})
     })
   }
+  if (screensaverSuppressedApps.has(appId.value)) {
+    screensaverStore.suppress(screensaverReason.value)
+  }
 })
 
 onBeforeUnmount(() => {
@@ -347,6 +362,7 @@ onBeforeUnmount(() => {
   window.removeEventListener('keydown', onKeyDown, true)
   window.removeEventListener('message', onMessage)
   document.removeEventListener('fullscreenchange', onFullscreenChange)
+  screensaverStore.resume(screensaverReason.value)
   if (document.fullscreenElement) document.exitFullscreen().catch(() => {})
 })
 </script>

neode-ui/src/views/Apps.vue

@@ -7,7 +7,7 @@
         <div class="mode-switcher flex-shrink-0">
           <button class="mode-switcher-btn" :class="{ 'mode-switcher-btn-active': activeTab === 'apps' }" @click="activeTab = 'apps'; router.replace({ query: {} })">My Apps</button>
           <RouterLink to="/dashboard/discover" class="mode-switcher-btn">App Store</RouterLink>
-          <button class="mode-switcher-btn" :class="{ 'mode-switcher-btn-active': activeTab === 'services' }" @click="activeTab = 'services'; router.replace({ query: { tab: 'services' } })">Services</button>
+          <button class="mode-switcher-btn" :class="{ 'mode-switcher-btn-active': activeTab === 'websites' }" @click="activeTab = 'websites'; router.replace({ query: { tab: 'websites' } })">Websites</button>
         </div>
         <div v-if="activeTab === 'apps' && categoriesWithApps.length > 1" class="mode-switcher flex-shrink-0">
           <button
@@ -155,7 +155,7 @@ import AppIconGrid from './apps/AppIconGrid.vue'
 import AppsUninstallModal from './apps/AppsUninstallModal.vue'
 import { useAppsActions } from './apps/useAppsActions'
 import {
-  filterEntriesForTab, isWebOnlyApp,
+  type AppsTab, filterEntriesForTab, isWebOnlyApp, isWebsitePackage, opensInTab, resolveRuntimeLaunchUrl,
   WEB_ONLY_APPS, buildAllCategories, useCategoriesWithApps,
 } from './apps/appsConfig'
 
@@ -170,8 +170,8 @@ const actions = useAppsActions()
 const showStagger = !appsAnimationDone
 
 // Tabs
-const activeTab = ref<'apps' | 'services'>(
-  route.query.tab === 'services' ? 'services' : 'apps'
+const activeTab = ref<AppsTab>(
+  route.query.tab === 'websites' || route.query.tab === 'services' ? 'websites' : 'apps'
 )
 
 // Search (debounced)
@@ -285,6 +285,19 @@ function goToApp(id: string) {
 }
 
 function launchApp(id: string) {
+  const pkg = packages.value[id]
+  if (pkg && isWebsitePackage(id, pkg)) {
+    const url = resolveRuntimeLaunchUrl(pkg)
+    if (url) window.open(url, '_blank', 'noopener,noreferrer')
+    return
+  }
+  if (pkg && opensInTab(id)) {
+    const url = resolveRuntimeLaunchUrl(pkg)
+    if (url) {
+      window.open(url, '_blank', 'noopener,noreferrer')
+      return
+    }
+  }
   useAppLauncherStore().openSession(id)
 }
 

neode-ui/src/views/Discover.vue

@@ -7,7 +7,7 @@
         <div class="mode-switcher flex-shrink-0">
           <RouterLink to="/dashboard/apps" class="mode-switcher-btn">My Apps</RouterLink>
           <RouterLink to="/dashboard/discover" class="mode-switcher-btn mode-switcher-btn-active">App Store</RouterLink>
-          <RouterLink to="/dashboard/apps?tab=services" class="mode-switcher-btn">Services</RouterLink>
+          <RouterLink to="/dashboard/apps?tab=websites" class="mode-switcher-btn">Websites</RouterLink>
         </div>
         <div class="mode-switcher flex-shrink-0">
           <RouterLink

neode-ui/src/views/Marketplace.vue

@@ -7,7 +7,7 @@
         <div class="mode-switcher flex-shrink-0">
           <RouterLink to="/dashboard/apps" class="mode-switcher-btn">My Apps</RouterLink>
           <RouterLink to="/dashboard/discover" class="mode-switcher-btn mode-switcher-btn-active">App Store</RouterLink>
-          <RouterLink to="/dashboard/apps?tab=services" class="mode-switcher-btn">Services</RouterLink>
+          <RouterLink to="/dashboard/apps?tab=websites" class="mode-switcher-btn">Websites</RouterLink>
         </div>
         <div class="mode-switcher flex-shrink-0">
           <RouterLink

neode-ui/src/views/appDetails/appDetailsData.ts

@@ -83,7 +83,7 @@ export const APP_URLS: Record<string, { dev: string; prod: string }> = {
   'photoprism': { dev: 'http://localhost:2342', prod: 'http://localhost:2342' },
   'immich': { dev: 'http://localhost:2283', prod: 'http://localhost:2283' },
   'filebrowser': { dev: 'http://localhost:8083', prod: 'http://localhost:8083' },
-  'nginx-proxy-manager': { dev: 'http://localhost:81', prod: 'http://localhost:81' },
+  'nginx-proxy-manager': { dev: 'http://localhost:8081', prod: 'http://localhost:8081' },
   'gitea': { dev: 'http://localhost:3001', prod: 'http://localhost:3001' },
   'portainer': { dev: 'http://localhost:9000', prod: 'http://localhost:9000' },
   'uptime-kuma': { dev: 'http://localhost:3002', prod: 'http://localhost:3002' },
@@ -160,7 +160,7 @@ export function getStatusLabel(state: PackageState, health?: string | null, exit
   if (state === PackageState.Running && health === 'unhealthy') return 'unhealthy'
   if (state === PackageState.Running && health === 'healthy') return 'healthy'
   if (state === PackageState.Exited) {
-    if (exitCode === 137) return 'killed (OOM)'
+    if (exitCode === 137) return 'killed (SIGKILL)'
     if (exitCode != null && exitCode !== 0) return 'crashed'
     return 'stopped'
   }

neode-ui/src/views/appSession/appSessionConfig.ts

@@ -31,7 +31,7 @@ export const APP_PORTS: Record<string, number> = {
   'immich':        2283,
   'immich_server': 2283,
   'filebrowser':   8083,
-  'nginx-proxy-manager': 81,
+  'nginx-proxy-manager': 8081,
   'gitea':         3001,
   'portainer':     9000,
   'tailscale':     8240,

neode-ui/src/views/apps/AppIconGrid.vue

@@ -79,7 +79,7 @@ import { useServerStore } from '@/stores/server'
 import { useAppLauncherStore } from '@/stores/appLauncher'
 import type { PackageDataEntry } from '@/types/api'
 import { resolveAppUrl } from '@/views/appSession/appSessionConfig'
-import { canLaunch, handleImageError, opensInTab, resolveAppIcon } from './appsConfig'
+import { canLaunch, handleImageError, isWebsitePackage, opensInTab, resolveAppIcon, resolveRuntimeLaunchUrl } from './appsConfig'
 import { getCuratedAppList } from '../discover/curatedApps'
 
 const ITEMS_PER_PAGE = 16 // 4 columns x 4 rows
@@ -120,8 +120,15 @@ function getIcon(id: string, pkg: PackageDataEntry): string {
 
 function handleTap(id: string, pkg: PackageDataEntry) {
   if (canLaunch(pkg)) {
+    if (isWebsitePackage(id, pkg)) {
+      const url = resolveRuntimeLaunchUrl(pkg)
+      if (url) {
+        window.open(url, '_blank', 'noopener,noreferrer')
+        return
+      }
+    }
     if (opensInTab(id)) {
-      const appUrl = resolveAppUrl(id)
+      const appUrl = resolveRuntimeLaunchUrl(pkg) || resolveAppUrl(id)
       if (appUrl) {
         window.open(appUrl, '_blank', 'noopener,noreferrer')
         return

neode-ui/src/views/apps/appsConfig.ts

@@ -3,6 +3,9 @@
 import type { Ref } from 'vue'
 import { computed } from 'vue'
 import { PackageState, type PackageDataEntry } from '@/types/api'
+import { resolveAppUrl } from '../appSession/appSessionConfig'
+
+export type AppsTab = 'apps' | 'websites' | 'services'
 
 // Service container name patterns (backend/infra, not user-facing)
 export const SERVICE_NAMES = new Set([
@@ -21,6 +24,15 @@ export const SERVICE_NAMES = new Set([
   'syntropy-institute', 't-zero', 'arch-presentation',
 ])
 
+const INTERNAL_TOOLING_NAMES = new Set([
+  'buildx_buildkit_default',
+])
+
+export function isInternalToolingPackage(id: string, pkg?: PackageDataEntry): boolean {
+  const manifestId = pkg?.manifest?.id || ''
+  return INTERNAL_TOOLING_NAMES.has(id) || INTERNAL_TOOLING_NAMES.has(manifestId) || id.startsWith('buildx_buildkit') || manifestId.startsWith('buildx_buildkit')
+}
+
 export function isServiceContainer(id: string): boolean {
   if (SERVICE_NAMES.has(id)) return true
   if (id.startsWith('indeedhub-build_')) return true
@@ -57,14 +69,32 @@ export function getAppCategory(id: string, pkg: PackageDataEntry): string {
   return cat || 'other'
 }
 
+export function runtimeLanAddress(pkg: PackageDataEntry): string {
+  return pkg.installed?.['interface-addresses']?.main?.['lan-address'] || ''
+}
+
+export function isKnownApp(id: string, pkg?: PackageDataEntry): boolean {
+  const manifestId = pkg?.manifest?.id
+  return !!(APP_CATEGORY_MAP[id] || (manifestId && APP_CATEGORY_MAP[manifestId]) || isWebOnlyApp(id))
+}
+
+export function isWebsitePackage(id: string, pkg?: PackageDataEntry): boolean {
+  if (isInternalToolingPackage(id, pkg)) return false
+  if (isServicePackage(id, pkg)) return true
+  if (isKnownApp(id, pkg)) return false
+  return !!pkg && !!runtimeLanAddress(pkg)
+}
+
 export function filterEntriesForTab(
   entries: Array<[string, PackageDataEntry]>,
-  activeTab: 'apps' | 'services',
+  activeTab: AppsTab,
   selectedCategory: string,
 ): Array<[string, PackageDataEntry]> {
   return entries.filter(([id, pkg]) => {
-    const isSvc = isServicePackage(id, pkg)
-    if (activeTab === 'services' ? !isSvc : isSvc) return false
+    if (isInternalToolingPackage(id, pkg)) return false
+    const wantsWebsites = activeTab === 'websites' || activeTab === 'services'
+    const isWebsite = isWebsitePackage(id, pkg)
+    if (wantsWebsites ? !isWebsite : isWebsite) return false
     if (activeTab === 'apps' && selectedCategory !== 'all') {
       return getAppCategory(id, pkg) === selectedCategory
     }
@@ -144,10 +174,18 @@ export function resolveAppIcon(id: string, pkg: PackageDataEntry, curatedIcon?:
 
 export function canLaunch(pkg: PackageDataEntry): boolean {
   if (isWebOnlyApp(pkg.manifest.id)) return true
-  const hasUI = pkg.manifest.interfaces?.main?.ui || pkg.installed?.['interface-addresses']?.main
+  const hasRuntimeAddress = !!pkg.installed?.['interface-addresses']?.main?.['lan-address']
+  const hasKnownLaunchUrl = typeof window !== 'undefined' && !!resolveAppUrl(pkg.manifest.id)
+  const hasUI = pkg.manifest.interfaces?.main?.ui || hasRuntimeAddress || hasKnownLaunchUrl
   return !!hasUI && pkg.state === 'running' && pkg.health !== 'starting' && pkg.health !== 'unhealthy'
 }
 
+export function resolveRuntimeLaunchUrl(pkg: PackageDataEntry): string {
+  const addr = runtimeLanAddress(pkg)
+  if (!addr || typeof window === 'undefined') return addr
+  return addr.replace(/^http:\/\/(localhost|127\.0\.0\.1)(?=[:/]|$)/, `http://${window.location.hostname}`)
+}
+
 export function getStatusClass(state: PackageState, health?: string | null, exitCode?: number | null): string {
   if (state === PackageState.Running && health === 'starting') return 'bg-yellow-500/20 text-yellow-200'
   if (state === PackageState.Running && health === 'unhealthy') return 'bg-orange-500/20 text-orange-200'
@@ -181,7 +219,7 @@ export function getStatusLabel(state: PackageState, health?: string | null, exit
   if (state === PackageState.Updating) return 'updating...'
   if (state === PackageState.Running) return 'running'
   if (state === PackageState.Exited || state === PackageState.Stopped) {
-    if (exitCode === 137) return 'killed (OOM)'
+    if (exitCode === 137) return 'killed (SIGKILL)'
     if (exitCode != null && exitCode !== 0) return 'crashed'
     return 'stopped'
   }
@@ -209,7 +247,7 @@ export function useCategoriesWithApps(
   allCategories: Ref<Array<{ id: string; name: string }>>,
 ) {
   return computed(() => {
-    const entries = Object.entries(packages.value).filter(([id, pkg]) => !isServicePackage(id, pkg))
+    const entries = Object.entries(packages.value).filter(([id, pkg]) => !isWebsitePackage(id, pkg) && !isInternalToolingPackage(id, pkg))
     return allCategories.value.filter(cat => {
       if (cat.id === 'all') return true
       return entries.some(([id, pkg]) => getAppCategory(id, pkg) === cat.id)

neode-ui/src/views/dashboard/DashboardMobileNav.vue

@@ -10,7 +10,7 @@
       <RouterLink
         to="/dashboard/apps"
         class="mode-switcher-btn"
-        :class="{ 'mode-switcher-btn-active': (route.path === '/dashboard/apps' || route.path.startsWith('/dashboard/apps/')) && route.query.tab !== 'services' }"
+        :class="{ 'mode-switcher-btn-active': (route.path === '/dashboard/apps' || route.path.startsWith('/dashboard/apps/')) && route.query.tab !== 'services' && route.query.tab !== 'websites' }"
         @click.prevent="router.push({ path: '/dashboard/apps', query: {} })"
       >My Apps</RouterLink>
       <RouterLink
@@ -19,10 +19,10 @@
         :class="{ 'mode-switcher-btn-active': route.path === '/dashboard/marketplace' || route.path.startsWith('/dashboard/marketplace/') || route.path === '/dashboard/discover' }"
       >App Store</RouterLink>
       <RouterLink
-        to="/dashboard/apps?tab=services"
+        to="/dashboard/apps?tab=websites"
         class="mode-switcher-btn"
-        :class="{ 'mode-switcher-btn-active': route.query.tab === 'services' }"
-      >Services</RouterLink>
+        :class="{ 'mode-switcher-btn-active': route.query.tab === 'services' || route.query.tab === 'websites' }"
+      >Websites</RouterLink>
     </div>
   </div>
 

neode-ui/src/views/dashboard/useRouteTransitions.ts

@@ -96,8 +96,8 @@ export function useRouteTransitions() {
 
     // Mobile: Horizontal slide transitions between sub-tabs
     if (typeof window !== 'undefined' && window.innerWidth < 768) {
-      const isServices = currentPath === '/dashboard/apps' && currentRoute.query.tab === 'services'
-      const wasServices = previousTab === 'services'
+      const isServices = currentPath === '/dashboard/apps' && (currentRoute.query.tab === 'services' || currentRoute.query.tab === 'websites')
+      const wasServices = previousTab === 'services' || previousTab === 'websites'
       const currentAppsIdx = isServices ? 2
         : currentPath === '/dashboard/marketplace' ? 1
         : currentPath === '/dashboard/apps' ? 0 : -1

neode-ui/vite.config.ts

@@ -38,6 +38,7 @@ export default defineConfig({
       },
       workbox: {
         navigateFallbackDenylist: [/^\/app\//, /^\/rpc\//, /^\/ws/, /^\/aiui\//],
+        cleanupOutdatedCaches: true,
         globPatterns: ['**/*.{js,css,html,ico,png,svg,jpg,jpeg,mp4,webp}'],
         globIgnores: [
           '**/*-backup-*.mp4',

release-manifest.json

@@ -1,27 +1,34 @@
 {
-  "version": "1.7.55-alpha",
-  "release_date": "2026-05-13",
+  "version": "1.7.58-alpha",
+  "release_date": "2026-05-17",
   "changelog": [
-    "Container reconcile now force-recreates Podman records stuck in `Stopping`, preserving bind-mounted app data while recovering wedged containers automatically.",
-    "`.198` is green after the container-layer hardening pass: focused and broad non-destructive lifecycle audits pass, raw Podman health/state sweep is clean, and direct app probes return healthy responses.",
-    "Release-candidate artifacts are staged separately from live update publishing while Gitea artifact hosting is repaired."
+    "Mesh networking now supports Meshtastic radios over the Meshtastic serial API in addition to existing MeshCore Companion USB radios.",
+    "The mesh listener now probes preferred and auto-detected serial paths for both MeshCore and Meshtastic firmware, preserving the existing reconnect loop so unplug/replug and firmware hot-swap behavior stays consistent.",
+    "Meshtastic text packets are translated into the existing Archipelago mesh frame pipeline, so current RPC handlers, transport routing, message storage, typed-message decoding, and UI state continue to work without a separate frontend path.",
+    "Meshtastic node information is surfaced as normal mesh contacts using stable synthetic public keys derived from Meshtastic node numbers, allowing peer refresh and message attribution to reuse existing MeshCore contact handling.",
+    "Outbound Archipelago mesh messages can now be sent through Meshtastic as channel text packets using the same command path used by MeshCore channel broadcasts.",
+    "Device status now reports the detected firmware family as `meshcore` or `meshtastic` from the shared listener abstraction.",
+    "Radio udev rules now include USB CDC ACM serial devices (`ttyACM*`) alongside CP2102, CH340, and FTDI adapters so Meshtastic boards are more likely to appear through the stable `/dev/mesh-radio` symlink.",
+    "Host nginx now serves `/assets/*` hashed frontend chunks as immutable static files with a hard 404 on misses instead of falling back to `index.html`, preventing strict MIME errors when a browser has a stale pre-update HTML shell.",
+    "The SPA HTML shell and service-worker files now revalidate on every load, reducing stale frontend references after OTA updates.",
+    "OTA runtime promotion now installs the bundled `nginx-archipelago.conf` into `/etc/nginx/sites-available/archipelago` and reloads nginx after a successful config test, so frontend cache/fallback fixes reach existing nodes without a manual deploy."
   ],
   "components": [
     {
       "name": "archipelago",
-      "current_version": "1.7.55-alpha",
-      "new_version": "1.7.55-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.55-alpha/archipelago",
-      "sha256": "f2caba778f63c7435431fb1b95cf6470bd43c4769ebe6adee2cbd2721707a663",
-      "size_bytes": 42580880
+      "current_version": "1.7.58-alpha",
+      "new_version": "1.7.58-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.58-alpha/archipelago",
+      "sha256": "2aa6e5f5b3d2cc74360ee2ce76098f9b0543d043cac23492062ece11c009c673",
+      "size_bytes": 42886144
     },
     {
-      "name": "archipelago-frontend-1.7.55-alpha.tar.gz",
-      "current_version": "1.7.55-alpha",
-      "new_version": "1.7.55-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.55-alpha/archipelago-frontend-1.7.55-alpha.tar.gz",
-      "sha256": "fe37425aad25724db49ec2be8d602342cfdc5fb99f08b4a3f04709751a3ed560",
-      "size_bytes": 166464949
+      "name": "archipelago-frontend-1.7.58-alpha.tar.gz",
+      "current_version": "1.7.58-alpha",
+      "new_version": "1.7.58-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.58-alpha/archipelago-frontend-1.7.58-alpha.tar.gz",
+      "sha256": "a800c9e88a0cf088559b3ae227b6d1ed2ebdbb8c1e562b7c95cb35def7623804",
+      "size_bytes": 166466572
     }
   ]
 }

releases/manifest.json

@@ -1,27 +1,34 @@
 {
-  "version": "1.7.55-alpha",
-  "release_date": "2026-05-13",
+  "version": "1.7.58-alpha",
+  "release_date": "2026-05-17",
   "changelog": [
-    "Container reconcile now force-recreates Podman records stuck in `Stopping`, preserving bind-mounted app data while recovering wedged containers automatically.",
-    "`.198` is green after the container-layer hardening pass: focused and broad non-destructive lifecycle audits pass, raw Podman health/state sweep is clean, and direct app probes return healthy responses.",
-    "Release-candidate artifacts are staged separately from live update publishing while Gitea artifact hosting is repaired."
+    "Mesh networking now supports Meshtastic radios over the Meshtastic serial API in addition to existing MeshCore Companion USB radios.",
+    "The mesh listener now probes preferred and auto-detected serial paths for both MeshCore and Meshtastic firmware, preserving the existing reconnect loop so unplug/replug and firmware hot-swap behavior stays consistent.",
+    "Meshtastic text packets are translated into the existing Archipelago mesh frame pipeline, so current RPC handlers, transport routing, message storage, typed-message decoding, and UI state continue to work without a separate frontend path.",
+    "Meshtastic node information is surfaced as normal mesh contacts using stable synthetic public keys derived from Meshtastic node numbers, allowing peer refresh and message attribution to reuse existing MeshCore contact handling.",
+    "Outbound Archipelago mesh messages can now be sent through Meshtastic as channel text packets using the same command path used by MeshCore channel broadcasts.",
+    "Device status now reports the detected firmware family as `meshcore` or `meshtastic` from the shared listener abstraction.",
+    "Radio udev rules now include USB CDC ACM serial devices (`ttyACM*`) alongside CP2102, CH340, and FTDI adapters so Meshtastic boards are more likely to appear through the stable `/dev/mesh-radio` symlink.",
+    "Host nginx now serves `/assets/*` hashed frontend chunks as immutable static files with a hard 404 on misses instead of falling back to `index.html`, preventing strict MIME errors when a browser has a stale pre-update HTML shell.",
+    "The SPA HTML shell and service-worker files now revalidate on every load, reducing stale frontend references after OTA updates.",
+    "OTA runtime promotion now installs the bundled `nginx-archipelago.conf` into `/etc/nginx/sites-available/archipelago` and reloads nginx after a successful config test, so frontend cache/fallback fixes reach existing nodes without a manual deploy."
   ],
   "components": [
     {
       "name": "archipelago",
-      "current_version": "1.7.55-alpha",
-      "new_version": "1.7.55-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.55-alpha/archipelago",
-      "sha256": "f2caba778f63c7435431fb1b95cf6470bd43c4769ebe6adee2cbd2721707a663",
-      "size_bytes": 42580880
+      "current_version": "1.7.58-alpha",
+      "new_version": "1.7.58-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.58-alpha/archipelago",
+      "sha256": "2aa6e5f5b3d2cc74360ee2ce76098f9b0543d043cac23492062ece11c009c673",
+      "size_bytes": 42886144
     },
     {
-      "name": "archipelago-frontend-1.7.55-alpha.tar.gz",
-      "current_version": "1.7.55-alpha",
-      "new_version": "1.7.55-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.55-alpha/archipelago-frontend-1.7.55-alpha.tar.gz",
-      "sha256": "fe37425aad25724db49ec2be8d602342cfdc5fb99f08b4a3f04709751a3ed560",
-      "size_bytes": 166464949
+      "name": "archipelago-frontend-1.7.58-alpha.tar.gz",
+      "current_version": "1.7.58-alpha",
+      "new_version": "1.7.58-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.58-alpha/archipelago-frontend-1.7.58-alpha.tar.gz",
+      "sha256": "a800c9e88a0cf088559b3ae227b6d1ed2ebdbb8c1e562b7c95cb35def7623804",
+      "size_bytes": 166466572
     }
   ]
 }

scripts/container-specs.sh

@@ -99,6 +99,10 @@ reset_spec() {
   SPEC_ENTRYPOINT=""
 }
 
+if ! declare -F alloc_port >/dev/null 2>&1; then
+  alloc_port() { printf '%s' "$2"; }
+fi
+
 # ── Tier 0: Databases ────────────────────────────────────────────────
 
 load_spec_archy-mempool-db() {
@@ -173,9 +177,9 @@ load_spec_bitcoin-knots() {
   SPEC_DATA_UID="100101:100101"
   # Dynamic: prune on small disk
   if [ "${DISK_GB:-0}" -lt 1000 ]; then
-    SPEC_CUSTOM_ARGS="-server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=512"
+    SPEC_CUSTOM_ARGS="-server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125"
   else
-    SPEC_CUSTOM_ARGS="-server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096"
+    SPEC_CUSTOM_ARGS="-server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125"
   fi
 }
 
@@ -493,13 +497,17 @@ load_spec_nginx-proxy-manager() {
   reset_spec
   SPEC_NAME="nginx-proxy-manager"
   SPEC_IMAGE="${NPM_IMAGE}"
-  SPEC_PORTS="81:81 8084:80 8444:443"
+  local admin_port http_port https_port
+  admin_port=$(alloc_port nginx-proxy-manager 8081 81)
+  http_port=$(alloc_port nginx-proxy-manager-http 8084 80)
+  https_port=$(alloc_port nginx-proxy-manager-https 8444 443)
+  SPEC_PORTS="$admin_port:81 $http_port:80 $https_port:443"
   SPEC_VOLUMES="/var/lib/archipelago/nginx-proxy-manager/data:/data /var/lib/archipelago/nginx-proxy-manager/letsencrypt:/etc/letsencrypt"
   SPEC_MEMORY="$(mem_limit nginx-proxy-manager)"
   SPEC_HEALTH_CMD="curl -sf http://localhost:81/ || exit 1"
   SPEC_TIER="3"
   SPEC_DATA_DIR="/var/lib/archipelago/nginx-proxy-manager"
-  SPEC_CAPS="CHOWN SETUID SETGID NET_BIND_SERVICE"
+  SPEC_CAPS="CHOWN FOWNER SETUID SETGID DAC_OVERRIDE NET_BIND_SERVICE"
   SPEC_OPTIONAL="true"
 }
 

scripts/deploy-tailscale.sh

@@ -914,7 +914,7 @@ LNDCONF
                         --health-cmd 'curl -sf http://localhost:81/'  --health-interval=30s --health-timeout=5s --health-retries=3 \
                         --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID --cap-add NET_BIND_SERVICE \
                         --security-opt no-new-privileges:true \
-                        -p 81:81 -p 8084:80 -p 8444:443 \
+                        -p 8081:81 -p 8084:80 -p 8444:443 \
                         -v /var/lib/archipelago/nginx-proxy-manager/data:/data \
                         -v /var/lib/archipelago/nginx-proxy-manager/letsencrypt:/etc/letsencrypt \
                         $NPM_IMAGE

scripts/first-boot-containers.sh

@@ -48,6 +48,37 @@ SCRIPT_DIR_FBC="$(cd "$(dirname "$0")" && pwd)"
 # as root (rootful podman), the backend can't see them at all.
 DOCKER="runuser -u archipelago -- env XDG_RUNTIME_DIR=/run/user/$(id -u archipelago) podman"
 
+PORT_ALLOC_FILE="/var/lib/archipelago/port-allocations.env"
+mkdir -p /var/lib/archipelago 2>/dev/null || true
+[ -f "$PORT_ALLOC_FILE" ] && . "$PORT_ALLOC_FILE"
+
+port_available() {
+  local port="$1"
+  ss -ltn 2>/dev/null | awk -v p=":$port" '$4 == p || $4 ~ p "$" { found=1 } END { exit found ? 1 : 0 }'
+}
+
+alloc_port() {
+  local key="$1" preferred="$2" var="PORT_${key//[^A-Za-z0-9]/_}" cur=""
+  eval "cur=\${$var:-}"
+  if [ -n "$cur" ] && port_available "$cur"; then
+    printf '%s' "$cur"
+    return
+  fi
+  if port_available "$preferred"; then
+    cur="$preferred"
+  else
+    cur=""
+    for p in $(seq 8085 9999); do
+      if port_available "$p"; then cur="$p"; break; fi
+    done
+  fi
+  [ -n "$cur" ] || cur="$preferred"
+  if ! grep -q "^$var=" "$PORT_ALLOC_FILE" 2>/dev/null; then
+    printf '%s=%s\n' "$var" "$cur" >> "$PORT_ALLOC_FILE"
+  fi
+  printf '%s' "$cur"
+}
+
 # UNBUNDLED mode: only create FileBrowser, skip all other containers.
 # Users install apps on-demand from the Marketplace.
 UNBUNDLED_MARKER="/opt/archipelago/.unbundled"
@@ -557,11 +588,11 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -qE 'bitcoin-knots|arch
   [ -z "$DISK_GB" ] && DISK_GB=$(df --output=size -BG / 2>/dev/null | tail -1 | tr -dc '0-9')
   if [ "${DISK_GB:-0}" -lt 1000 ]; then
     BTC_EXTRA_ARGS="-prune=550"
-    BTC_DBCACHE=512
+    BTC_DBCACHE=2048
     log "  Small disk (${DISK_GB}GB) — enabling pruning"
   else
     BTC_EXTRA_ARGS="-txindex=1"
-    BTC_DBCACHE=2048
+    BTC_DBCACHE=4096
     log "  Large disk (${DISK_GB}GB) — enabling txindex"
   fi
   if $DOCKER run -d --name bitcoin-knots --restart unless-stopped \
@@ -574,7 +605,7 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -qE 'bitcoin-knots|arch
     -v /var/lib/archipelago/bitcoin:/home/bitcoin/.bitcoin \
     "${BITCOIN_KNOTS_IMAGE}" \
     $BTC_EXTRA_ARGS \
-    -printtoconsole=1 -dbcache=$BTC_DBCACHE 2>>"$LOG"; then
+    -printtoconsole=1 -dbcache=$BTC_DBCACHE -par=0 -maxconnections=125 2>>"$LOG"; then
     log "Bitcoin Knots started"
   else
     log "Bitcoin Knots failed (may already exist)"
@@ -1146,12 +1177,15 @@ track_container "filebrowser"
 if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q nginx-proxy-manager; then
   log "Creating Nginx Proxy Manager..."
   mkdir -p /var/lib/archipelago/nginx-proxy-manager/data /var/lib/archipelago/nginx-proxy-manager/letsencrypt
+  NPM_ADMIN_PORT=$(alloc_port nginx-proxy-manager 8081)
+  NPM_HTTP_PORT=$(alloc_port nginx-proxy-manager-http 8084)
+  NPM_HTTPS_PORT=$(alloc_port nginx-proxy-manager-https 8444)
   $DOCKER run -d --name nginx-proxy-manager --restart unless-stopped \
     --health-cmd="curl -sf http://localhost:81/ || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
     --memory=$(mem_limit nginx-proxy-manager) \
-    --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID --cap-add NET_BIND_SERVICE \
+    --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE --cap-add NET_BIND_SERVICE \
     --security-opt no-new-privileges:true \
-    -p 81:81 -p 8084:80 -p 8444:443 \
+    -p ${NPM_ADMIN_PORT}:81 -p ${NPM_HTTP_PORT}:80 -p ${NPM_HTTPS_PORT}:443 \
     -v /var/lib/archipelago/nginx-proxy-manager/data:/data \
     -v /var/lib/archipelago/nginx-proxy-manager/letsencrypt:/etc/letsencrypt \
     "${NPM_IMAGE}" 2>>"$LOG" || true

scripts/nginx-https-app-proxies.conf

@@ -204,7 +204,7 @@ location /app/electrs-ui/ {
     proxy_hide_header Content-Security-Policy;
 }
 location /app/nginx-proxy-manager/ {
-    proxy_pass http://127.0.0.1:81/;
+    proxy_pass http://127.0.0.1:8081/;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;

scripts/reconcile-containers.sh

@@ -63,6 +63,37 @@ header(){ echo -e "\n${BOLD}$*${NC}"; }
 source "$SCRIPT_DIR/container-specs.sh" || { echo "Cannot source container-specs.sh"; exit 1; }
 detect_environment
 
+PORT_ALLOC_FILE="/var/lib/archipelago/port-allocations.env"
+[ -f "$PORT_ALLOC_FILE" ] && . "$PORT_ALLOC_FILE"
+
+port_available() {
+  local port="$1"
+  ss -ltn 2>/dev/null | awk -v p=":$port" '$4 == p || $4 ~ p "$" { found=1 } END { exit found ? 1 : 0 }'
+}
+
+alloc_port() {
+  local key="$1" preferred="$2" var="PORT_${key//[^A-Za-z0-9]/_}" cur=""
+  eval "cur=\${$var:-}"
+  if [ -n "$cur" ] && port_available "$cur"; then
+    printf '%s' "$cur"
+    return
+  fi
+  if port_available "$preferred"; then
+    cur="$preferred"
+  else
+    cur=""
+    for p in $(seq 8085 9999); do
+      if port_available "$p"; then cur="$p"; break; fi
+    done
+  fi
+  [ -n "$cur" ] || cur="$preferred"
+  sudo mkdir -p "$(dirname "$PORT_ALLOC_FILE")" 2>/dev/null || true
+  if ! grep -q "^$var=" "$PORT_ALLOC_FILE" 2>/dev/null; then
+    printf '%s=%s\n' "$var" "$cur" | sudo tee -a "$PORT_ALLOC_FILE" >/dev/null
+  fi
+  printf '%s' "$cur"
+}
+
 # ── Podman command ───────────────────────────────────────────────────
 # Run as archipelago user — podman sees rootless containers directly.
 # Use sudo only for chown/mkdir operations.
@@ -154,6 +185,39 @@ host_port_listening() {
   '
 }
 
+prepare_bind_source() {
+  local source="$1"
+  [ -n "$source" ] || return 0
+
+  case "$source" in
+    /run/user/*/podman/podman.sock)
+      if [ ! -S "$source" ]; then
+        local runtime_dir="${source%/podman/podman.sock}"
+        XDG_RUNTIME_DIR="$runtime_dir" systemctl --user start podman.socket 2>/dev/null || true
+        for _ in 1 2 3 4 5 6 7 8 9 10; do
+          [ -S "$source" ] && return 0
+          sleep 0.25
+        done
+      fi
+      ;;
+  esac
+
+  case "$source" in
+    /var/lib/archipelago/*)
+      sudo mkdir -p "$source" 2>/dev/null
+      ;;
+    *)
+      # Non-data bind mounts can be files/sockets/devices. Creating the full
+      # path would turn e.g. podman.sock into a directory and break Portainer.
+      if [ -e "$source" ]; then
+        return 0
+      fi
+      fail "bind source missing: $source"
+      return 1
+      ;;
+  esac
+}
+
 container_has_mount() {
   local name="$1" source="$2" target="$3"
   $PODMAN inspect "$name" --format '{{range .Mounts}}{{println .Source "|" .Destination}}{{end}}' 2>/dev/null \
@@ -536,7 +600,11 @@ reconcile() {
       else
         for v in $SPEC_VOLUMES; do
           local host_dir="${v%%:*}"
-          [ -n "$host_dir" ] && sudo mkdir -p "$host_dir" 2>/dev/null
+          prepare_bind_source "$host_dir" || {
+            COUNT_FAILED=$((COUNT_FAILED + 1))
+            FAILED_LIST+=" $name"
+            return
+          }
         done
         if eval "$(build_run_cmd)" >/dev/null 2>&1; then
           fixed "$name — created"

tests/lifecycle/remote-lifecycle.sh

@@ -178,7 +178,7 @@ launch_url_for() {
     ollama) echo "http://${ARCHY_HOST}:11434/" ;;
     immich|immich_server) echo "http://${ARCHY_HOST}:2283/" ;;
     portainer) echo "http://${ARCHY_HOST}:9000/" ;;
-    nginx-proxy-manager) echo "http://${ARCHY_HOST}:81/" ;;
+    nginx-proxy-manager) echo "http://${ARCHY_HOST}:8081/" ;;
     tailscale) echo "http://${ARCHY_HOST}:8240/" ;;
     uptime-kuma) echo "http://${ARCHY_HOST}:3002/" ;;
     homeassistant) echo "http://${ARCHY_HOST}:8123/" ;;