chore: release v1.7.75-alpha

CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## v1.7.75-alpha (2026-05-19)
+
+- Saleor is now published as a recommended commerce app with catalog metadata, icon, direct app-session launch on port `9000`, scanner metadata, image pins, and a full stack installer for dashboard, API, worker, PostgreSQL, Valkey, Mailpit, and Jaeger.
+- Existing NetBird installs are repaired more aggressively by rewriting unified-origin config, recreating the dashboard/proxy containers, restarting the server, preserving data, and handling exact `/api` and `/oauth2` routes plus dashboard logout redirects through the local proxy.
+- Desktop dashboard scrolling now hands focus back from the sidebar to the main content when the pointer or wheel moves over the main pane, preventing the sidebar scroll area from trapping wheel input on short screens.
+- Validation passed with catalog JSON checks, `npm run type-check`, `cargo fmt --all --check --manifest-path core/Cargo.toml`, and `cargo check -p archipelago --manifest-path core/Cargo.toml` before release.
+
+## v1.7.74-alpha (2026-05-19)
+
+- App-session right panels now re-focus the iframe after load and when the frame area is activated, so wheel/touch scrolling works immediately after switching tabs or selecting an app on shorter screens.
+- NetBird now launches through a unified local origin on port `8087` that proxies the dashboard plus `/oauth2`, `/api`, relay, WebSocket, and gRPC routes to `netbird-server`, fixing the embedded login flow that previously ended in `Unauthenticated` or `404 page not found` after logout.
+- Existing NetBird installs are repaired on adopt/start by rewriting `config.yaml`, `dashboard.env`, and the local nginx proxy config, then creating the missing `netbird-dashboard` and `netbird` proxy containers when needed while preserving NetBird data.
+- Saleor is still pending and is not included in this release; its registry/installer work remains local until it can be validated separately.
+- Validation passed with catalog JSON checks, `npm run type-check`, `cargo fmt --all --check --manifest-path core/Cargo.toml`, and `cargo check -p archipelago --manifest-path core/Cargo.toml`.
+
+## v1.7.73-alpha (2026-05-19)
+
+- Mobile app launches for iframe-blocked apps now open the direct app URL in a new browser tab immediately instead of landing in a broken in-shell webview that requires a second tap.
+- Mobile My Apps/Websites tabs now react to route query changes, App Store pages label the mobile view as Discover, mobile filters have safe bottom spacing, and App Store search ignores the current category so searches cover all available apps.
+- My Apps search now surfaces matching App Store entries when the app is not installed, making it possible to jump directly from a failed My Apps search to the installable app details.
+- NetBird self-host installs now prefer a `100.x` tailnet/CGNAT address for dashboard, management, relay, STUN, and auth redirect origins when one is present; live repair on `100.89.209.89` updated the existing stack from LAN origins to `100.89.209.89` and restored `netbird-server`.
+- App-session iframe frames now focus automatically and wrap the iframe in a scroll host so wheel/touch scrolling works in the active right frame without requiring an initial click.
+
+## v1.7.72-alpha (2026-05-19)
+
+- Settings What's New now includes the missing release notes for `v1.7.68-alpha` through `v1.7.71-alpha`, so the modal reflects the current OTA history instead of stopping at `v1.7.67-alpha`.
+- The follow-up release carries the NetBird install fix, Gitea icon polish, mobile app-session fallback updates, and rounder app icon masks from `v1.7.71-alpha` with the Settings modal notes included.
+- The local Cargo lockfile version metadata is kept in sync with the release bump after the previous release build updated it.
+
+## v1.7.71-alpha (2026-05-19)
+
+- NetBird stack installs now pre-create `/var/lib/archipelago/netbird/data` before binding it into `netbird-server`, fixing the failed install/start path seen on `100.70.96.88` where Podman rejected the missing host directory.
+- NetBird start/restart ordering now starts `netbird-server` before the dashboard container so lifecycle actions bring the control plane up before the UI.
+- App-session invalid IDs and panel-mode fallbacks now return to `/dashboard/apps`, avoiding the stale `/apps` route that could render a 404.
+- Mobile launches for apps that block iframes now stay inside the Archipelago app-session fallback instead of automatically opening an external browser tab.
+- Installed Gitea containers now report the packaged Gitea icon, and app icon masks use a rounder radius on mobile grids, app cards, and detail headers.
+- Validation passed with `npm run type-check`, focused Vitest app-session/app-grid tests, `cargo fmt --all --check --manifest-path core/Cargo.toml`, and `cargo check -p archipelago --manifest-path core/Cargo.toml`.
+
 ## v1.7.70-alpha (2026-05-19)
 
 - NetBird is being corrected from the peer/client daemon image to the self-hosted NetBird control-plane stack with a launchable dashboard on port `8087`, a combined management/signal/relay server on `8086`, and STUN on UDP `3478`.

app-catalog/catalog.json

@@ -64,6 +64,23 @@
         "bitcoin-knots"
       ]
     },
+    {
+      "id": "saleor",
+      "title": "Saleor",
+      "version": "3.23",
+      "description": "Composable commerce platform with GraphQL API, dashboard, worker, mail testing, and tracing.",
+      "icon": "/assets/img/app-icons/saleor.svg",
+      "author": "Saleor",
+      "category": "commerce",
+      "tier": "recommended",
+      "dockerImage": "ghcr.io/saleor/saleor:3.23",
+      "repoUrl": "https://github.com/saleor/saleor",
+      "containerConfig": {
+        "ports": ["9000:80", "8000:8000", "8025:8025", "16686:16686"],
+        "volumes": ["/var/lib/archipelago/saleor:/app/media", "/var/lib/archipelago/saleor-db:/var/lib/postgresql/data"],
+        "notes": "Installed as a Saleor stack: dashboard on 9000, API on 8000, Mailpit on 8025, and Jaeger on 16686. Supporting containers include PostgreSQL, Valkey, Celery worker, and services required by Saleor."
+      }
+    },
     {
       "id": "mempool",
       "title": "Mempool Explorer",

core/Cargo.lock

@@ -80,7 +80,7 @@ checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
 [[package]]
 name = "archipelago"
-version = "1.7.69-alpha"
+version = "1.7.74-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.70-alpha"
+version = "1.7.75-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]

core/archipelago/src/api/rpc/package/config.rs

@@ -31,6 +31,7 @@ fn is_platform_managed_app(app_id: &str) -> bool {
             | "fedimint"
             | "fedimint-gateway"
             | "indeedhub"
+            | "saleor"
             | "immich"
     )
 }
@@ -495,7 +496,20 @@ pub(super) fn all_container_names(package_id: &str) -> Vec<String> {
             "indeedhub-ffmpeg".into(),
             "indeedhub".into(),
         ],
-        "netbird" => vec!["netbird".into(), "netbird-server".into()],
+        "netbird" => vec![
+            "netbird".into(),
+            "netbird-dashboard".into(),
+            "netbird-server".into(),
+        ],
+        "saleor" => vec![
+            "saleor-db".into(),
+            "saleor-cache".into(),
+            "saleor-api".into(),
+            "saleor-worker".into(),
+            "saleor-jaeger".into(),
+            "saleor-mailpit".into(),
+            "saleor".into(),
+        ],
         "nostr-vpn" => vec![
             "nostr-vpn".into(),
             "archy-nostr-vpn".into(),
@@ -585,6 +599,7 @@ pub(super) fn get_data_dirs_for_app(package_id: &str) -> Vec<String> {
             format!("{}/penpot-postgres", base),
         ],
         "netbird" => vec![format!("{}/netbird", base)],
+        "saleor" => vec![format!("{}/saleor", base), format!("{}/saleor-db", base)],
         _ => vec![format!("{}/{}", base, package_id)],
     }
 }
@@ -1064,6 +1079,13 @@ pub(super) async fn get_app_config(
             None,
             None,
         ),
+        "saleor" => (
+            vec!["9000:80".to_string(), "8000:8000".to_string()],
+            vec!["/var/lib/archipelago/saleor:/app/media".to_string()],
+            vec![],
+            None,
+            None,
+        ),
         "nostr-rs-relay" => (
             vec!["18081:8080".to_string()],
             vec!["/var/lib/archipelago/nostr-rs-relay:/usr/src/app/db".to_string()],

core/archipelago/src/api/rpc/package/dependencies.rs

@@ -288,6 +288,16 @@ pub(super) fn startup_order(package_id: &str) -> &'static [&'static str] {
         "btcpay-server" | "btcpayserver" | "btcpay" => {
             &["archy-btcpay-db", "archy-nbxplorer", "btcpay-server"]
         }
+        "netbird" => &["netbird-server", "netbird-dashboard", "netbird"],
+        "saleor" => &[
+            "saleor-db",
+            "saleor-cache",
+            "saleor-jaeger",
+            "saleor-mailpit",
+            "saleor-api",
+            "saleor-worker",
+            "saleor",
+        ],
         "penpot" | "penpot-frontend" => &[
             "penpot-postgres",
             "penpot-valkey",
@@ -389,6 +399,14 @@ mod tests {
         );
     }
 
+    #[test]
+    fn netbird_start_order_starts_server_before_dashboard() {
+        assert_eq!(
+            startup_order("netbird"),
+            &["netbird-server", "netbird-dashboard", "netbird"]
+        );
+    }
+
     #[test]
     fn unpruned_bitcoin_required_for_electrum_indexers_and_mempool() {
         for package_id in [

core/archipelago/src/api/rpc/package/install.rs

@@ -244,6 +244,9 @@ impl RpcHandler {
         if package_id == "netbird" {
             return self.install_netbird_stack().await;
         }
+        if package_id == "saleor" {
+            return self.install_saleor_stack().await;
+        }
 
         // Dependency checks. Prefer the scanner's cached package state so a
         // congested Podman API does not turn an already-running dependency into

core/archipelago/src/api/rpc/package/stacks.rs

@@ -98,6 +98,8 @@ async fn repair_stack_before_adopt(stack_name: &str) {
             }
         }
         "indeedhub" => repair_indeedhub_network_aliases().await,
+        "netbird" => repair_netbird_unified_origin().await,
+        "saleor" => repair_saleor_network_aliases().await,
         _ => {}
     }
 }
@@ -144,6 +146,131 @@ pub(in crate::api::rpc::package) async fn repair_indeedhub_network_aliases() {
     }
 }
 
+async fn repair_netbird_unified_origin() {
+    let host_ip = detect_netbird_public_host_ip()
+        .await
+        .unwrap_or_else(|| "127.0.0.1".to_string());
+    let _ = write_netbird_config_files(&host_ip).await;
+
+    for container in ["netbird", "netbird-dashboard"] {
+        let _ = tokio::process::Command::new("podman")
+            .args(["rm", "-f", container])
+            .output()
+            .await;
+    }
+
+    let _ = tokio::process::Command::new("podman")
+        .args(["network", "create", "netbird-net"])
+        .output()
+        .await;
+
+    let _ = pull_image_with_retry(NETBIRD_DASHBOARD_IMAGE).await;
+    let _ = pull_image_with_retry(NETBIRD_PROXY_IMAGE).await;
+
+    let _ = tokio::process::Command::new("podman")
+        .args([
+            "run",
+            "-d",
+            "--name",
+            "netbird-dashboard",
+            "--network",
+            "netbird-net",
+            "--restart=unless-stopped",
+            "--env-file",
+            "/var/lib/archipelago/netbird/dashboard.env",
+            NETBIRD_DASHBOARD_IMAGE,
+        ])
+        .output()
+        .await;
+
+    let _ = tokio::process::Command::new("podman")
+        .args([
+            "run",
+            "-d",
+            "--name",
+            "netbird",
+            "--network",
+            "netbird-net",
+            "--restart=unless-stopped",
+            "-p",
+            "8087:80",
+            "-v",
+            "/var/lib/archipelago/netbird/nginx.conf:/etc/nginx/conf.d/default.conf:ro",
+            NETBIRD_PROXY_IMAGE,
+        ])
+        .output()
+        .await;
+
+    let _ = tokio::process::Command::new("podman")
+        .args([
+            "network",
+            "disconnect",
+            "-f",
+            "netbird-net",
+            "netbird-server",
+        ])
+        .output()
+        .await;
+    let _ = tokio::process::Command::new("podman")
+        .args([
+            "network",
+            "connect",
+            "--alias",
+            "netbird-server",
+            "netbird-net",
+            "netbird-server",
+        ])
+        .output()
+        .await;
+    let _ = tokio::process::Command::new("podman")
+        .args(["restart", "netbird-server"])
+        .output()
+        .await;
+}
+
+async fn repair_saleor_network_aliases() {
+    let _ = tokio::process::Command::new("podman")
+        .args(["network", "create", "saleor-net"])
+        .output()
+        .await;
+
+    for (container, alias) in [
+        ("saleor-db", "db"),
+        ("saleor-cache", "cache"),
+        ("saleor-jaeger", "jaeger"),
+        ("saleor-mailpit", "mailpit"),
+        ("saleor-api", "api"),
+        ("saleor-worker", "worker"),
+        ("saleor", "saleor"),
+    ] {
+        let exists = tokio::process::Command::new("podman")
+            .args(["container", "exists", container])
+            .status()
+            .await
+            .map(|s| s.success())
+            .unwrap_or(false);
+        if !exists {
+            continue;
+        }
+
+        let _ = tokio::process::Command::new("podman")
+            .args(["network", "disconnect", "-f", "saleor-net", container])
+            .output()
+            .await;
+        let _ = tokio::process::Command::new("podman")
+            .args([
+                "network",
+                "connect",
+                "--alias",
+                alias,
+                "saleor-net",
+                container,
+            ])
+            .output()
+            .await;
+    }
+}
+
 async fn run_required_stack_command(
     stack_name: &str,
     label: &str,
@@ -313,6 +440,13 @@ const REGISTRY: &str = "146.59.87.168:3000/lfg2025";
 
 const NETBIRD_DASHBOARD_IMAGE: &str = "docker.io/netbirdio/dashboard:v2.38.0";
 const NETBIRD_SERVER_IMAGE: &str = "docker.io/netbirdio/netbird-server:0.71.2";
+const NETBIRD_PROXY_IMAGE: &str = "docker.io/library/nginx:1.27-alpine";
+const SALEOR_API_IMAGE: &str = "ghcr.io/saleor/saleor:3.23";
+const SALEOR_DASHBOARD_IMAGE: &str = "ghcr.io/saleor/saleor-dashboard:3.23";
+const SALEOR_POSTGRES_IMAGE: &str = "docker.io/library/postgres:15-alpine";
+const SALEOR_VALKEY_IMAGE: &str = "docker.io/valkey/valkey:8.1-alpine";
+const SALEOR_JAEGER_IMAGE: &str = "docker.io/jaegertracing/jaeger:latest";
+const SALEOR_MAILPIT_IMAGE: &str = "docker.io/axllent/mailpit:latest";
 
 /// Pull an image with retry and exponential backoff (3 attempts).
 async fn pull_image_with_retry(image: &str) -> Result<()> {
@@ -1364,8 +1498,12 @@ impl RpcHandler {
 
     /// Install self-hosted NetBird (dashboard + combined management/signal/relay server).
     pub(super) async fn install_netbird_stack(&self) -> Result<serde_json::Value> {
-        if let Some(adopted) =
-            adopt_stack_if_exists("netbird", "netbird", &["netbird", "netbird-server"]).await?
+        if let Some(adopted) = adopt_stack_if_exists(
+            "netbird",
+            "netbird",
+            &["netbird-server", "netbird-dashboard", "netbird"],
+        )
+        .await?
         {
             return Ok(adopted);
         }
@@ -1375,18 +1513,22 @@ impl RpcHandler {
 
         self.set_install_phase("netbird", InstallPhase::PullingImage)
             .await;
-        for (i, image) in [NETBIRD_DASHBOARD_IMAGE, NETBIRD_SERVER_IMAGE]
-            .iter()
-            .enumerate()
+        for (i, image) in [
+            NETBIRD_DASHBOARD_IMAGE,
+            NETBIRD_SERVER_IMAGE,
+            NETBIRD_PROXY_IMAGE,
+        ]
+        .iter()
+        .enumerate()
         {
-            self.set_install_progress("netbird", i as u64, 2).await;
+            self.set_install_progress("netbird", i as u64, 3).await;
             pull_image_with_retry(image)
                 .await
                 .with_context(|| format!("Failed to pull NetBird image: {}", image))?;
         }
-        self.set_install_progress("netbird", 2, 2).await;
+        self.set_install_progress("netbird", 3, 3).await;
 
-        for name in ["netbird", "netbird-server"] {
+        for name in ["netbird", "netbird-dashboard", "netbird-server"] {
             let _ = tokio::process::Command::new("podman")
                 .args(["rm", "-f", name])
                 .status()
@@ -1400,63 +1542,14 @@ impl RpcHandler {
         self.set_install_phase("netbird", InstallPhase::CreatingContainer)
             .await;
 
-        tokio::fs::create_dir_all("/var/lib/archipelago/netbird")
+        tokio::fs::create_dir_all("/var/lib/archipelago/netbird/data")
             .await
             .context("Failed to create NetBird data directory")?;
 
-        let host_ip = self.config.host_ip.clone();
-        let dashboard_origin = format!("http://{}:8087", host_ip);
-        let mgmt_origin = format!("http://{}:8086", host_ip);
-        let relay_secret = read_or_generate_b64_secret("netbird-relay-auth-secret").await;
-        let encryption_key = read_or_generate_b64_secret("netbird-store-encryption-key").await;
-        let config = format!(
-            r#"server:
-  listenAddress: ":80"
-  exposedAddress: "{mgmt_origin}"
-  stunPorts:
-    - 3478
-  metricsPort: 9090
-  healthcheckAddress: ":9000"
-  logLevel: "info"
-  logFile: "console"
-  authSecret: "{relay_secret}"
-  dataDir: "/var/lib/netbird"
-  auth:
-    issuer: "{mgmt_origin}/oauth2"
-    localAuthDisabled: false
-    signKeyRefreshEnabled: true
-    dashboardRedirectURIs:
-      - "{dashboard_origin}/nb-auth"
-      - "{dashboard_origin}/nb-silent-auth"
-    cliRedirectURIs:
-      - "http://localhost:53000/"
-  store:
-    engine: "sqlite"
-    encryptionKey: "{encryption_key}"
-"#
-        );
-        tokio::fs::write("/var/lib/archipelago/netbird/config.yaml", config)
+        let host_ip = detect_netbird_public_host_ip()
             .await
-            .context("Failed to write NetBird config.yaml")?;
-
-        let dashboard_env = format!(
-            r#"NETBIRD_MGMT_API_ENDPOINT={mgmt_origin}
-NETBIRD_MGMT_GRPC_API_ENDPOINT={mgmt_origin}
-AUTH_AUDIENCE=netbird-dashboard
-AUTH_CLIENT_ID=netbird-dashboard
-AUTH_CLIENT_SECRET=
-AUTH_AUTHORITY={mgmt_origin}/oauth2
-USE_AUTH0=false
-AUTH_SUPPORTED_SCOPES=openid profile email groups
-AUTH_REDIRECT_URI=/nb-auth
-AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
-NGINX_SSL_PORT=443
-LETSENCRYPT_DOMAIN=none
-"#
-        );
-        tokio::fs::write("/var/lib/archipelago/netbird/dashboard.env", dashboard_env)
-            .await
-            .context("Failed to write NetBird dashboard.env")?;
+            .unwrap_or_else(|| self.config.host_ip.clone());
+        write_netbird_config_files(&host_ip).await?;
 
         let _ = tokio::process::Command::new("podman")
             .args(["network", "create", "netbird-net"])
@@ -1497,19 +1590,39 @@ LETSENCRYPT_DOMAIN=none
             "run",
             "-d",
             "--name",
-            "netbird",
+            "netbird-dashboard",
             "--network",
             "netbird-net",
             "--restart=unless-stopped",
-            "-p",
-            "8087:80",
             "--env-file",
             "/var/lib/archipelago/netbird/dashboard.env",
             NETBIRD_DASHBOARD_IMAGE,
         ]);
         run_required_stack_command("netbird", "create dashboard", &mut dashboard_cmd).await?;
 
-        wait_for_stack_containers("netbird", &["netbird-server", "netbird"], 60).await?;
+        let mut proxy_cmd = tokio::process::Command::new("podman");
+        proxy_cmd.args([
+            "run",
+            "-d",
+            "--name",
+            "netbird",
+            "--network",
+            "netbird-net",
+            "--restart=unless-stopped",
+            "-p",
+            "8087:80",
+            "-v",
+            "/var/lib/archipelago/netbird/nginx.conf:/etc/nginx/conf.d/default.conf:ro",
+            NETBIRD_PROXY_IMAGE,
+        ]);
+        run_required_stack_command("netbird", "create unified proxy", &mut proxy_cmd).await?;
+
+        wait_for_stack_containers(
+            "netbird",
+            &["netbird-server", "netbird-dashboard", "netbird"],
+            60,
+        )
+        .await?;
 
         self.set_install_phase("netbird", InstallPhase::WaitingHealthy)
             .await;
@@ -1526,6 +1639,415 @@ LETSENCRYPT_DOMAIN=none
             "message": "NetBird self-hosted stack installed",
         }))
     }
+
+    /// Install Saleor stack (PostgreSQL + Valkey + API + worker + dashboard + Jaeger + Mailpit).
+    pub(super) async fn install_saleor_stack(&self) -> Result<serde_json::Value> {
+        if let Some(adopted) = adopt_stack_if_exists(
+            "saleor",
+            "saleor",
+            &[
+                "saleor-db",
+                "saleor-cache",
+                "saleor-jaeger",
+                "saleor-mailpit",
+                "saleor-api",
+                "saleor-worker",
+                "saleor",
+            ],
+        )
+        .await?
+        {
+            return Ok(adopted);
+        }
+
+        install_log("INSTALL START: saleor stack (postgres + valkey + api + worker + dashboard)")
+            .await;
+        info!("Installing Saleor stack");
+
+        let images = [
+            SALEOR_POSTGRES_IMAGE,
+            SALEOR_VALKEY_IMAGE,
+            SALEOR_API_IMAGE,
+            SALEOR_DASHBOARD_IMAGE,
+            SALEOR_JAEGER_IMAGE,
+            SALEOR_MAILPIT_IMAGE,
+        ];
+        self.set_install_phase("saleor", InstallPhase::PullingImage)
+            .await;
+        let n_images = images.len() as u64;
+        for (i, image) in images.iter().enumerate() {
+            self.set_install_progress("saleor", i as u64, n_images)
+                .await;
+            pull_image_with_retry(image)
+                .await
+                .with_context(|| format!("Failed to pull Saleor image: {}", image))?;
+        }
+        self.set_install_progress("saleor", n_images, n_images)
+            .await;
+
+        for name in [
+            "saleor",
+            "saleor-api",
+            "saleor-worker",
+            "saleor-db",
+            "saleor-cache",
+            "saleor-jaeger",
+            "saleor-mailpit",
+        ] {
+            let _ = tokio::process::Command::new("podman")
+                .args(["rm", "-f", name])
+                .status()
+                .await;
+        }
+        let _ = tokio::process::Command::new("podman")
+            .args(["network", "rm", "-f", "saleor-net"])
+            .status()
+            .await;
+
+        self.set_install_phase("saleor", InstallPhase::CreatingContainer)
+            .await;
+
+        let _ = tokio::process::Command::new("sudo")
+            .args([
+                "mkdir",
+                "-p",
+                "/var/lib/archipelago/saleor",
+                "/var/lib/archipelago/saleor-db",
+                "/var/lib/archipelago/saleor-cache",
+            ])
+            .output()
+            .await;
+        let user = std::env::var("USER").unwrap_or_else(|_| "archipelago".to_string());
+        for dir in [
+            "/var/lib/archipelago/saleor",
+            "/var/lib/archipelago/saleor-db",
+            "/var/lib/archipelago/saleor-cache",
+        ] {
+            let _ = tokio::process::Command::new("sudo")
+                .args(["chown", "-R", &format!("{}:{}", user, user), dir])
+                .output()
+                .await;
+        }
+
+        let _ = tokio::process::Command::new("podman")
+            .args(["network", "create", "saleor-net"])
+            .status()
+            .await;
+
+        let db_pass = super::config::read_or_generate_secret("saleor-db-password").await;
+        let secret_key = super::config::read_or_generate_secret("saleor-secret-key").await;
+        let host_ip = &self.config.host_ip;
+        let dashboard_url = format!("http://{}:9000/", host_ip);
+        let api_url = format!("http://{}:8000/graphql/", host_ip);
+        let allowed_hosts = format!("localhost,127.0.0.1,api,saleor-api,{}", host_ip);
+        let database_url = format!("postgres://saleor:{}@db/saleor", db_pass);
+
+        let mut db_cmd = tokio::process::Command::new("podman");
+        db_cmd.args([
+            "run",
+            "-d",
+            "--name",
+            "saleor-db",
+            "--network",
+            "saleor-net",
+            "--network-alias",
+            "db",
+            "--restart=unless-stopped",
+            "--cap-drop=ALL",
+            "--cap-add=CHOWN",
+            "--cap-add=DAC_OVERRIDE",
+            "--cap-add=FOWNER",
+            "--cap-add=SETGID",
+            "--cap-add=SETUID",
+            "--security-opt=no-new-privileges:true",
+            "--memory=512m",
+            "--pids-limit=4096",
+            "--health-cmd=pg_isready -U saleor || exit 1",
+            "--health-interval=30s",
+            "--health-retries=3",
+            "-v",
+            "/var/lib/archipelago/saleor-db:/var/lib/postgresql/data",
+            "-e",
+            "POSTGRES_USER=saleor",
+            "-e",
+            &format!("POSTGRES_PASSWORD={}", db_pass),
+            "-e",
+            "POSTGRES_DB=saleor",
+            SALEOR_POSTGRES_IMAGE,
+        ]);
+        run_required_stack_command("saleor", "create postgres", &mut db_cmd).await?;
+
+        let mut cache_cmd = tokio::process::Command::new("podman");
+        cache_cmd.args([
+            "run",
+            "-d",
+            "--name",
+            "saleor-cache",
+            "--network",
+            "saleor-net",
+            "--network-alias",
+            "cache",
+            "--restart=unless-stopped",
+            "--cap-drop=ALL",
+            "--cap-add=SETGID",
+            "--cap-add=SETUID",
+            "--security-opt=no-new-privileges:true",
+            "--memory=128m",
+            "--pids-limit=2048",
+            "--health-cmd=valkey-cli ping || exit 1",
+            "--health-interval=30s",
+            "--health-retries=3",
+            "-v",
+            "/var/lib/archipelago/saleor-cache:/data",
+            SALEOR_VALKEY_IMAGE,
+        ]);
+        run_required_stack_command("saleor", "create cache", &mut cache_cmd).await?;
+
+        let mut jaeger_cmd = tokio::process::Command::new("podman");
+        jaeger_cmd.args([
+            "run",
+            "-d",
+            "--name",
+            "saleor-jaeger",
+            "--network",
+            "saleor-net",
+            "--network-alias",
+            "jaeger",
+            "--restart=unless-stopped",
+            "--cap-drop=ALL",
+            "--security-opt=no-new-privileges:true",
+            "--memory=512m",
+            "--pids-limit=4096",
+            "-p",
+            "16686:16686",
+            "-p",
+            "4317:4317",
+            "-p",
+            "4318:4318",
+            "--tmpfs",
+            "/tmp:rw,nosuid,nodev,size=128m",
+            SALEOR_JAEGER_IMAGE,
+        ]);
+        run_required_stack_command("saleor", "create jaeger", &mut jaeger_cmd).await?;
+
+        let mut mailpit_cmd = tokio::process::Command::new("podman");
+        mailpit_cmd.args([
+            "run",
+            "-d",
+            "--name",
+            "saleor-mailpit",
+            "--network",
+            "saleor-net",
+            "--network-alias",
+            "mailpit",
+            "--restart=unless-stopped",
+            "--cap-drop=ALL",
+            "--security-opt=no-new-privileges:true",
+            "--memory=128m",
+            "--pids-limit=2048",
+            "-p",
+            "1025:1025",
+            "-p",
+            "8025:8025",
+            SALEOR_MAILPIT_IMAGE,
+        ]);
+        run_required_stack_command("saleor", "create mailpit", &mut mailpit_cmd).await?;
+
+        tokio::time::sleep(std::time::Duration::from_secs(8)).await;
+
+        let saleor_env = vec![
+            "-e".to_string(),
+            "CACHE_URL=redis://cache:6379/0".to_string(),
+            "-e".to_string(),
+            "CELERY_BROKER_URL=redis://cache:6379/1".to_string(),
+            "-e".to_string(),
+            format!("DATABASE_URL={}", database_url),
+            "-e".to_string(),
+            "DEFAULT_CHANNEL_SLUG=default-channel".to_string(),
+            "-e".to_string(),
+            "DEFAULT_FROM_EMAIL=noreply@example.com".to_string(),
+            "-e".to_string(),
+            "EMAIL_URL=smtp://mailpit:1025".to_string(),
+            "-e".to_string(),
+            format!("SECRET_KEY={}", secret_key),
+            "-e".to_string(),
+            "OTEL_SERVICE_NAME=saleor".to_string(),
+            "-e".to_string(),
+            "OTEL_TRACES_EXPORTER=otlp".to_string(),
+            "-e".to_string(),
+            "OTEL_EXPORTER_OTLP_ENDPOINT=http://jaeger:4317".to_string(),
+            "-e".to_string(),
+            "HTTP_IP_FILTER_ALLOW_LOOPBACK_IPS=True".to_string(),
+            "-e".to_string(),
+            "HTTP_IP_FILTER_ENABLED=False".to_string(),
+            "-e".to_string(),
+            format!("DASHBOARD_URL={}", dashboard_url),
+            "-e".to_string(),
+            format!("ALLOWED_HOSTS={}", allowed_hosts),
+        ];
+
+        let mut migrate_cmd = tokio::process::Command::new("podman");
+        migrate_cmd.args([
+            "run",
+            "--rm",
+            "--network",
+            "saleor-net",
+            "-v",
+            "/var/lib/archipelago/saleor:/app/media",
+        ]);
+        migrate_cmd.args(&saleor_env);
+        migrate_cmd.args([SALEOR_API_IMAGE, "python3", "manage.py", "migrate"]);
+        run_required_stack_command("saleor", "run migrations", &mut migrate_cmd).await?;
+
+        let mut populate_cmd = tokio::process::Command::new("podman");
+        populate_cmd.args([
+            "run",
+            "--rm",
+            "--network",
+            "saleor-net",
+            "-v",
+            "/var/lib/archipelago/saleor:/app/media",
+        ]);
+        populate_cmd.args(&saleor_env);
+        populate_cmd.args([
+            SALEOR_API_IMAGE,
+            "python3",
+            "manage.py",
+            "populatedb",
+            "--createsuperuser",
+        ]);
+        let populate = populate_cmd.output().await;
+        if let Ok(output) = populate {
+            if !output.status.success() {
+                install_log(&format!(
+                    "INSTALL WARN: saleor - populate sample data skipped: {}{}",
+                    String::from_utf8_lossy(&output.stdout),
+                    String::from_utf8_lossy(&output.stderr)
+                ))
+                .await;
+            }
+        }
+
+        let mut api_cmd = tokio::process::Command::new("podman");
+        api_cmd.args([
+            "run",
+            "-d",
+            "--name",
+            "saleor-api",
+            "--network",
+            "saleor-net",
+            "--network-alias",
+            "api",
+            "--restart=unless-stopped",
+            "--cap-drop=ALL",
+            "--cap-add=CHOWN",
+            "--cap-add=DAC_OVERRIDE",
+            "--cap-add=FOWNER",
+            "--cap-add=SETGID",
+            "--cap-add=SETUID",
+            "--security-opt=no-new-privileges:true",
+            "--memory=1g",
+            "--pids-limit=4096",
+            "-p",
+            "8000:8000",
+            "-v",
+            "/var/lib/archipelago/saleor:/app/media",
+        ]);
+        api_cmd.args(&saleor_env);
+        api_cmd.arg(SALEOR_API_IMAGE);
+        run_required_stack_command("saleor", "create api", &mut api_cmd).await?;
+
+        let mut worker_cmd = tokio::process::Command::new("podman");
+        worker_cmd.args([
+            "run",
+            "-d",
+            "--name",
+            "saleor-worker",
+            "--network",
+            "saleor-net",
+            "--restart=unless-stopped",
+            "--cap-drop=ALL",
+            "--cap-add=CHOWN",
+            "--cap-add=DAC_OVERRIDE",
+            "--cap-add=FOWNER",
+            "--cap-add=SETGID",
+            "--cap-add=SETUID",
+            "--security-opt=no-new-privileges:true",
+            "--memory=1g",
+            "--pids-limit=4096",
+            "-v",
+            "/var/lib/archipelago/saleor:/app/media",
+        ]);
+        worker_cmd.args(&saleor_env);
+        worker_cmd.args([
+            SALEOR_API_IMAGE,
+            "celery",
+            "-A",
+            "saleor",
+            "--app=saleor.celeryconf:app",
+            "worker",
+            "--loglevel=info",
+            "-B",
+        ]);
+        run_required_stack_command("saleor", "create worker", &mut worker_cmd).await?;
+
+        self.set_install_phase("saleor", InstallPhase::StartingContainer)
+            .await;
+        tokio::time::sleep(std::time::Duration::from_secs(5)).await;
+
+        let mut dashboard_cmd = tokio::process::Command::new("podman");
+        dashboard_cmd.args([
+            "run",
+            "-d",
+            "--name",
+            "saleor",
+            "--network",
+            "saleor-net",
+            "--restart=unless-stopped",
+            "--cap-drop=ALL",
+            "--security-opt=no-new-privileges:true",
+            "--memory=256m",
+            "--pids-limit=2048",
+            "-p",
+            "9000:80",
+            "-e",
+            &format!("API_URL={}", api_url),
+            "-e",
+            &format!("APP_MOUNT_URI={}", dashboard_url),
+            SALEOR_DASHBOARD_IMAGE,
+        ]);
+        run_required_stack_command("saleor", "create dashboard", &mut dashboard_cmd).await?;
+
+        wait_for_stack_containers(
+            "saleor",
+            &[
+                "saleor-db",
+                "saleor-cache",
+                "saleor-jaeger",
+                "saleor-mailpit",
+                "saleor-api",
+                "saleor-worker",
+                "saleor",
+            ],
+            120,
+        )
+        .await?;
+
+        self.set_install_phase("saleor", InstallPhase::WaitingHealthy)
+            .await;
+        self.set_install_phase("saleor", InstallPhase::PostInstall)
+            .await;
+        self.set_install_phase("saleor", InstallPhase::Done).await;
+        self.clear_install_progress("saleor").await;
+
+        install_log("INSTALL OK: saleor stack").await;
+        info!("Saleor stack installed");
+        Ok(serde_json::json!({
+            "success": true,
+            "package_id": "saleor",
+            "message": "Saleor stack installed (7 containers)",
+        }))
+    }
 }
 
 async fn read_or_generate_b64_secret(name: &str) -> String {
@@ -1544,6 +2066,119 @@ async fn read_or_generate_b64_secret(name: &str) -> String {
     secret
 }
 
+async fn write_netbird_config_files(host_ip: &str) -> Result<()> {
+    let public_origin = format!("http://{}:8087", host_ip);
+    let server_origin = format!("http://{}:8086", host_ip);
+    let relay_secret = read_or_generate_b64_secret("netbird-relay-auth-secret").await;
+    let encryption_key = read_or_generate_b64_secret("netbird-store-encryption-key").await;
+    let config = format!(
+        r#"server:
+  listenAddress: ":80"
+  exposedAddress: "{public_origin}"
+  stunPorts:
+    - 3478
+  metricsPort: 9090
+  healthcheckAddress: ":9000"
+  logLevel: "info"
+  logFile: "console"
+  authSecret: "{relay_secret}"
+  dataDir: "/var/lib/netbird"
+  auth:
+    issuer: "{public_origin}/oauth2"
+    localAuthDisabled: false
+    signKeyRefreshEnabled: true
+    dashboardRedirectURIs:
+      - "{public_origin}/nb-auth"
+      - "{public_origin}/nb-silent-auth"
+    dashboardPostLogoutRedirectURIs:
+      - "{public_origin}/"
+    cliRedirectURIs:
+      - "http://localhost:53000/"
+  store:
+    engine: "sqlite"
+    encryptionKey: "{encryption_key}"
+"#
+    );
+    tokio::fs::write("/var/lib/archipelago/netbird/config.yaml", config)
+        .await
+        .context("Failed to write NetBird config.yaml")?;
+
+    let dashboard_env = format!(
+        r#"NETBIRD_MGMT_API_ENDPOINT={public_origin}
+NETBIRD_MGMT_GRPC_API_ENDPOINT={public_origin}
+AUTH_AUDIENCE=netbird-dashboard
+AUTH_CLIENT_ID=netbird-dashboard
+AUTH_CLIENT_SECRET=
+AUTH_AUTHORITY={public_origin}/oauth2
+USE_AUTH0=false
+AUTH_SUPPORTED_SCOPES=openid profile email groups
+AUTH_REDIRECT_URI=/nb-auth
+AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
+NETBIRD_TOKEN_SOURCE=accessToken
+NGINX_SSL_PORT=443
+LETSENCRYPT_DOMAIN=none
+"#
+    );
+    tokio::fs::write("/var/lib/archipelago/netbird/dashboard.env", dashboard_env)
+        .await
+        .context("Failed to write NetBird dashboard.env")?;
+
+    let nginx_conf = format!(
+        r#"server {{
+    listen 80;
+    server_name _;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_http_version 1.1;
+
+    location ~ ^/(relay|ws-proxy/) {{
+        proxy_pass http://netbird-server:80;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 1d;
+    }}
+
+    location ~ ^/(api|oauth2)(/|$) {{
+        proxy_pass http://netbird-server:80;
+    }}
+
+    location ~ ^/(signalexchange\.SignalExchange|management\.ManagementService)/ {{
+        grpc_pass grpc://netbird-server:80;
+        grpc_read_timeout 1d;
+        grpc_send_timeout 1d;
+    }}
+
+    location / {{
+        proxy_pass http://netbird-dashboard:80;
+    }}
+}}
+
+# Direct server remains available for diagnostics at {server_origin}.
+"#
+    );
+    tokio::fs::write("/var/lib/archipelago/netbird/nginx.conf", nginx_conf)
+        .await
+        .context("Failed to write NetBird nginx.conf")?;
+
+    Ok(())
+}
+
+async fn detect_netbird_public_host_ip() -> Option<String> {
+    let output = tokio::process::Command::new("hostname")
+        .args(["-I"])
+        .output()
+        .await
+        .ok()?;
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    stdout
+        .split_whitespace()
+        .find(|ip| ip.starts_with("100.") && ip.contains('.'))
+        .map(str::to_string)
+}
+
 #[cfg(test)]
 mod tests {
     use super::{btcpay_stack_app_ids, mempool_stack_app_ids};

core/archipelago/src/container/docker_packages.rs

@@ -62,6 +62,13 @@ impl DockerPackageScanner {
             "indeedhub-build_relay_1",
             "indeedhub-build_ffmpeg-worker_1",
             "netbird-server",
+            "netbird-dashboard",
+            "saleor-api",
+            "saleor-worker",
+            "saleor-db",
+            "saleor-cache",
+            "saleor-jaeger",
+            "saleor-mailpit",
             "buildx_buildkit_default",
         ];
 
@@ -282,6 +289,7 @@ fn get_app_tier(app_id: &str) -> &'static str {
         "uptime-kuma" => "recommended",
         "grafana" => "recommended",
         "searxng" => "recommended",
+        "saleor" => "recommended",
         "tailscale" | "netbird" => "recommended",
         "portainer" => "recommended",
         // Optional: everything else
@@ -487,6 +495,20 @@ fn get_app_metadata(app_id: &str) -> AppMetadata {
             repo: "https://github.com/netbirdio/netbird".to_string(),
             tier: "",
         },
+        "saleor" => AppMetadata {
+            title: "Saleor".to_string(),
+            description: "Composable commerce platform with GraphQL API and dashboard".to_string(),
+            icon: "/assets/img/app-icons/saleor.svg".to_string(),
+            repo: "https://github.com/saleor/saleor".to_string(),
+            tier: "",
+        },
+        "gitea" => AppMetadata {
+            title: "Gitea".to_string(),
+            description: "Self-hosted Git service with repository and package hosting".to_string(),
+            icon: "/assets/img/app-icons/gitea.svg".to_string(),
+            repo: "https://gitea.com".to_string(),
+            tier: "",
+        },
         "indeedhub" | "indeehub" => AppMetadata {
             title: "IndeedHub".to_string(),
             description: "Decentralized media streaming platform".to_string(),
@@ -708,6 +730,7 @@ fn requires_reachable_launch(app_id: &str) -> bool {
             | "tailscale"
             | "immich"
             | "searxng"
+            | "saleor"
     )
 }
 

core/archipelago/src/container/image_versions.rs

@@ -169,7 +169,14 @@ fn image_var_for_app(app_id: &str) -> Option<&'static str> {
         "portainer" => Some("PORTAINER_IMAGE"),
         "tailscale" => Some("TAILSCALE_IMAGE"),
         "netbird" => Some("NETBIRD_DASHBOARD_IMAGE"),
+        "netbird-dashboard" => Some("NETBIRD_DASHBOARD_IMAGE"),
         "netbird-server" => Some("NETBIRD_SERVER_IMAGE"),
+        "saleor" => Some("SALEOR_DASHBOARD_IMAGE"),
+        "saleor-api" | "saleor-worker" => Some("SALEOR_API_IMAGE"),
+        "saleor-db" => Some("SALEOR_POSTGRES_IMAGE"),
+        "saleor-cache" => Some("SALEOR_VALKEY_IMAGE"),
+        "saleor-jaeger" => Some("SALEOR_JAEGER_IMAGE"),
+        "saleor-mailpit" => Some("SALEOR_MAILPIT_IMAGE"),
 
         // Fedimint
         "fedimint" | "fedimintd" => Some("FEDIMINT_IMAGE"),
@@ -302,9 +309,19 @@ pub fn containers_for_stack(app_id: &str) -> Vec<(&'static str, &'static str)> {
             ("penpot-frontend", "PENPOT_FRONTEND_IMAGE"),
         ],
         "netbird" => vec![
-            ("netbird", "NETBIRD_DASHBOARD_IMAGE"),
+            ("netbird", "NETBIRD_PROXY_IMAGE"),
+            ("netbird-dashboard", "NETBIRD_DASHBOARD_IMAGE"),
             ("netbird-server", "NETBIRD_SERVER_IMAGE"),
         ],
+        "saleor" => vec![
+            ("saleor-db", "SALEOR_POSTGRES_IMAGE"),
+            ("saleor-cache", "SALEOR_VALKEY_IMAGE"),
+            ("saleor-api", "SALEOR_API_IMAGE"),
+            ("saleor-worker", "SALEOR_API_IMAGE"),
+            ("saleor-jaeger", "SALEOR_JAEGER_IMAGE"),
+            ("saleor-mailpit", "SALEOR_MAILPIT_IMAGE"),
+            ("saleor", "SALEOR_DASHBOARD_IMAGE"),
+        ],
         _ => vec![],
     }
 }

neode-ui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "neode-ui",
-  "version": "1.7.70-alpha",
+  "version": "1.7.75-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.7.70-alpha",
+      "version": "1.7.75-alpha",
       "dependencies": {
         "@types/dompurify": "^3.0.5",
         "@vue-leaflet/vue-leaflet": "^0.10.1",

neode-ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "neode-ui",
   "private": true,
-  "version": "1.7.70-alpha",
+  "version": "1.7.75-alpha",
   "type": "module",
   "scripts": {
     "start": "./start-dev.sh",

neode-ui/public/assets/img/app-icons/saleor.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" role="img" aria-label="Saleor">
+  <rect width="128" height="128" rx="30" fill="#111827"/>
+  <path d="M34 42c0-10 9-18 22-18h38v16H56c-5 0-8 2-8 5 0 4 4 5 13 7l15 3c15 3 24 11 24 24 0 15-12 25-31 25H31V88h39c8 0 13-3 13-8 0-4-4-6-12-8l-16-3C41 66 34 57 34 42Z" fill="#fff"/>
+  <path d="M29 103h70v8H29z" fill="#7C3AED"/>
+</svg>

neode-ui/public/catalog.json

@@ -64,6 +64,23 @@
         "bitcoin-knots"
       ]
     },
+    {
+      "id": "saleor",
+      "title": "Saleor",
+      "version": "3.23",
+      "description": "Composable commerce platform with GraphQL API, dashboard, worker, mail testing, and tracing.",
+      "icon": "/assets/img/app-icons/saleor.svg",
+      "author": "Saleor",
+      "category": "commerce",
+      "tier": "recommended",
+      "dockerImage": "ghcr.io/saleor/saleor:3.23",
+      "repoUrl": "https://github.com/saleor/saleor",
+      "containerConfig": {
+        "ports": ["9000:80", "8000:8000", "8025:8025", "16686:16686"],
+        "volumes": ["/var/lib/archipelago/saleor:/app/media", "/var/lib/archipelago/saleor-db:/var/lib/postgresql/data"],
+        "notes": "Installed as a Saleor stack: dashboard on 9000, API on 8000, Mailpit on 8025, and Jaeger on 16686. Supporting containers include PostgreSQL, Valkey, Celery worker, and services required by Saleor."
+      }
+    },
     {
       "id": "mempool",
       "title": "Mempool Explorer",

neode-ui/src/style.css

@@ -1659,6 +1659,15 @@ html:has(body.video-background-active)::before {
   filter: drop-shadow(0 10px 25px rgba(0, 0, 0, 0.5));
 }
 
+.mobile-filter-btn {
+  bottom: calc(var(--mobile-tab-bar-height, 72px) + var(--safe-area-bottom, env(safe-area-inset-bottom, 0px)) + 12px);
+  filter: drop-shadow(0 10px 25px rgba(0, 0, 0, 0.5));
+}
+
+.mobile-filter-sheet {
+  padding-bottom: calc(var(--safe-area-bottom, env(safe-area-inset-bottom, 0px)) + 1.5rem);
+}
+
 /* ── Cloud Audio Player (mini bar) ──── */
 
 .cloud-audio-player {
@@ -2098,7 +2107,7 @@ html:has(body.video-background-active)::before {
   position: relative;
   width: 60px;
   height: 60px;
-  border-radius: 14px;
+  border-radius: 18px;
   overflow: visible;
   background: rgba(255, 255, 255, 0.08);
   box-shadow: 0 1px 3px rgba(0, 0, 0, 0.3);
@@ -2108,7 +2117,16 @@ html:has(body.video-background-active)::before {
   width: 100%;
   height: 100%;
   object-fit: cover;
-  border-radius: 14px;
+  border-radius: 18px;
+}
+
+.app-card-icon {
+  border-radius: 16px;
+}
+
+.app-detail-icon {
+  border-radius: 22px;
+  object-fit: cover;
 }
 
 /* Status dot — top-right of icon */
@@ -2140,7 +2158,7 @@ html:has(body.video-background-active)::before {
   align-items: center;
   justify-content: center;
   background: rgba(0, 0, 0, 0.6);
-  border-radius: 14px;
+  border-radius: 18px;
 }
 
 .app-icon-label {

neode-ui/src/views/AppDetails.vue

@@ -158,7 +158,7 @@ const { t } = useI18n()
 const appId = computed(() => {
   const id = route.params.id
   if (typeof id !== 'string' || !/^[a-z0-9][a-z0-9._-]*$/.test(id) || id.length > 64) {
-    router.replace('/apps')
+    router.replace('/dashboard/apps')
     return ''
   }
   return id

neode-ui/src/views/AppSession.vue

@@ -138,7 +138,7 @@ const displayMode = ref<DisplayMode>(
 const appId = computed(() => {
   const id = props.appIdProp || (route.params.appId as string)
   if (typeof id !== 'string' || !/^[a-z0-9][a-z0-9._-]*$/.test(id) || id.length > 64) {
-    router.replace('/apps')
+    router.replace('/dashboard/apps')
     return ''
   }
   return id
@@ -146,7 +146,7 @@ const appId = computed(() => {
 
 const appTitle = computed(() => resolveAppTitle(appId.value))
 const isMobile = typeof window !== 'undefined' && window.innerWidth < 768
-const mustOpenNewTab = computed(() => !isMobile && NEW_TAB_APPS.has(appId.value))
+const mustOpenNewTab = computed(() => NEW_TAB_APPS.has(appId.value))
 const screensaverReason = computed(() => `app-session:${appId.value}`)
 const screensaverSuppressedApps = new Set([
   'indeedhub',
@@ -197,7 +197,11 @@ function setMode(mode: DisplayMode) {
   if (!isInlinePanel.value && mode === 'panel') {
     const id = appId.value
     const launcher = useAppLauncherStore()
-    router.push({ name: 'apps' }).then(() => {
+    const fallback = route.query.returnTo
+    const fallbackPath = typeof fallback === 'string' && fallback.startsWith('/dashboard')
+      ? fallback
+      : '/dashboard/apps'
+    router.push(fallbackPath).then(() => {
       launcher.panelAppId = id
     })
     return
@@ -337,7 +341,7 @@ watch(displayMode, (mode) => {
 })
 
 onMounted(() => {
-  // Apps that block iframes (X-Frame-Options) -- open in new tab, close session
+  // Apps that block iframes open externally instead of landing in a broken webview.
   if (mustOpenNewTab.value && appUrl.value) {
     window.open(appUrl.value, '_blank', 'noopener,noreferrer')
     if (isInlinePanel.value) emit('close')
@@ -527,6 +531,12 @@ onBeforeUnmount(() => {
   opacity: 0;
 }
 
+.app-session-frame-scroll-host {
+  overflow: auto;
+  overscroll-behavior: contain;
+  -webkit-overflow-scrolling: touch;
+}
+
 /* Mobile: full-bleed app sessions — no border, no radius, no shadow */
 @media (max-width: 767px) {
   .app-session-root {

neode-ui/src/views/Apps.vue

@@ -106,10 +106,34 @@
     </div>
 
     <!-- No Results -->
-    <div v-if="filteredPackageEntries.length === 0 && searchQuery" class="text-center py-12">
+    <div v-if="filteredPackageEntries.length === 0 && marketplaceMatches.length === 0 && searchQuery" class="text-center py-12">
       <p class="text-white/70">{{ t('apps.noResults', { query: searchQuery }) }}</p>
     </div>
 
+    <div v-if="marketplaceMatches.length > 0" class="mb-5">
+      <div class="flex items-center gap-3 mb-3">
+        <span class="discover-terminal-tag">app store</span>
+        <h2 class="text-lg font-bold text-white">Available in Discover</h2>
+        <div class="flex-1 h-px bg-white/10"></div>
+      </div>
+      <div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4">
+        <button
+          v-for="app in marketplaceMatches"
+          :key="app.id"
+          type="button"
+          class="glass-card p-4 text-left flex items-center gap-3 hover:bg-orange-500/5 hover:border-orange-500/15 transition-colors"
+          @click="openMarketplaceResult(app)"
+        >
+          <img v-if="app.icon" :src="app.icon" :alt="app.title" class="w-12 h-12 rounded-xl object-cover bg-white/10" />
+          <div v-else class="w-12 h-12 rounded-xl bg-white/10 flex-shrink-0"></div>
+          <div class="min-w-0 flex-1">
+            <p class="font-semibold text-white truncate">{{ app.title }}</p>
+            <p class="text-xs text-white/50 truncate">Available in App Store</p>
+          </div>
+        </button>
+      </div>
+    </div>
+
     <!-- Mobile: iPhone-style icon grid -->
     <div class="md:hidden">
       <AppIconGrid
@@ -236,10 +260,12 @@ import AppCard from './apps/AppCard.vue'
 import AppIconGrid from './apps/AppIconGrid.vue'
 import AppsUninstallModal from './apps/AppsUninstallModal.vue'
 import { useAppsActions } from './apps/useAppsActions'
+import { useMarketplaceApp } from '@/composables/useMarketplaceApp'
 import {
   type AppsTab, filterEntriesForTab, isWebOnlyApp, isWebsitePackage, opensInTab, resolveRuntimeLaunchUrl,
   WEB_ONLY_APPS, WEB_ONLY_APP_URLS, buildAllCategories, useCategoriesWithApps,
 } from './apps/appsConfig'
+import { getCuratedAppList, INSTALLED_ALIASES, type MarketplaceApp } from './marketplace/marketplaceData'
 
 const { t } = useI18n()
 const router = useRouter()
@@ -247,6 +273,7 @@ const route = useRoute()
 const store = useAppStore()
 const serverStore = useServerStore()
 const actions = useAppsActions()
+const { setCurrentApp } = useMarketplaceApp()
 const showSideload = ref(false)
 const sideloading = ref(false)
 const sideloadError = ref('')
@@ -266,6 +293,10 @@ const activeTab = ref<AppsTab>(
   route.query.tab === 'websites' || route.query.tab === 'services' ? 'websites' : 'apps'
 )
 
+watch(() => route.query.tab, (tab) => {
+  activeTab.value = tab === 'websites' || tab === 'services' ? 'websites' : 'apps'
+})
+
 // Search (debounced)
 const searchQuery = ref('')
 const debouncedSearchQuery = ref('')
@@ -309,6 +340,19 @@ const packages = computed(() => {
 
 const categoriesWithApps = useCategoriesWithApps(packages, ALL_CATEGORIES)
 
+const curatedApps = getCuratedAppList()
+const marketplaceMatches = computed(() => {
+  const q = debouncedSearchQuery.value.trim().toLowerCase()
+  if (!q || activeTab.value !== 'apps') return [] as MarketplaceApp[]
+  return curatedApps.filter(app => {
+    if (isInstalledInMyApps(app.id)) return false
+    return app.title?.toLowerCase().includes(q) ||
+      app.id.toLowerCase().includes(q) ||
+      app.author?.toLowerCase().includes(q) ||
+      (typeof app.description === 'string' && app.description.toLowerCase().includes(q))
+  }).slice(0, 6)
+})
+
 const isLoadingApps = computed(() => !store.hasLoadedInitialData && !connectionError.value)
 
 // Connection error state
@@ -352,6 +396,17 @@ const filteredPackageEntries = computed(() => {
   )
 })
 
+function isInstalledInMyApps(appId: string): boolean {
+  if (appId in packages.value) return true
+  const aliases = INSTALLED_ALIASES[appId]
+  return aliases ? aliases.some(alias => alias in packages.value) : false
+}
+
+function openMarketplaceResult(app: MarketplaceApp) {
+  setCurrentApp(app)
+  router.push({ name: 'marketplace-app-detail', params: { id: app.id }, query: { from: 'apps' } }).catch(() => {})
+}
+
 // Uninstall modal
 const uninstallModal = ref({ show: false, appId: '', appTitle: '' })
 

neode-ui/src/views/Dashboard.vue

@@ -67,6 +67,9 @@
       data-controller-zone="main"
       class="flex-1 overflow-hidden relative pb-0 glass-piece z-10"
       :class="{ 'glass-throw-main': showZoomIn }"
+      tabindex="-1"
+      @pointerenter="activateMainScroll"
+      @wheel.capture="activateMainScroll"
     >
       <div data-controller-main-entry class="absolute top-4 right-4 md:top-6 md:right-8 z-20">
         <!-- Controller zone entry point - no switcher -->
@@ -234,6 +237,14 @@ function restoreScroll(path: string) {
   })
 }
 
+function activateMainScroll() {
+  const active = document.activeElement as HTMLElement | null
+  if (active?.closest?.('[data-controller-zone="sidebar"]')) {
+    active.blur()
+    document.getElementById('main-content')?.focus({ preventScroll: true })
+  }
+}
+
 watch(() => route.path, (newPath) => {
   const isAppDetails = isDetailRoute(newPath)
   const wasAppDetails = showAltBackground.value

neode-ui/src/views/Discover.vue

@@ -35,6 +35,10 @@
 
       <!-- Mobile: search -->
       <div class="md:hidden mb-4">
+        <div class="flex items-center gap-2 mb-3">
+          <span class="discover-terminal-tag">discover</span>
+          <h1 class="text-lg font-bold text-white">App Store</h1>
+        </div>
         <input
           v-model="searchQuery"
           type="text"
@@ -312,6 +316,9 @@ const categoriesWithApps = computed(() => {
 
 const filteredApps = computed(() => {
   let apps = allApps.value
+  if (selectedCategory.value && selectedCategory.value !== 'all' && !searchQuery.value) {
+    apps = apps.filter(app => app.category === selectedCategory.value)
+  }
   if (searchQuery.value) {
     const query = searchQuery.value.toLowerCase()
     apps = apps.filter(app =>

neode-ui/src/views/Marketplace.vue

@@ -37,6 +37,10 @@
 
       <!-- Mobile: search (tabs handled by Dashboard.vue header) -->
       <div class="md:hidden mb-4">
+        <div class="flex items-center gap-2 mb-3">
+          <span class="discover-terminal-tag">discover</span>
+          <h1 class="text-lg font-bold text-white">App Store</h1>
+        </div>
         <input
           v-model="searchQuery"
           type="text"
@@ -258,7 +262,7 @@ const categoriesWithApps = computed(() => {
 const filteredApps = computed(() => {
   let apps = allApps.value
 
-  if (selectedCategory.value && selectedCategory.value !== 'all') {
+  if (selectedCategory.value && selectedCategory.value !== 'all' && !searchQuery.value) {
     apps = apps.filter(app => app.category === selectedCategory.value)
   }
 

neode-ui/src/views/appDetails/AppHeroSection.vue

@@ -5,7 +5,7 @@
       <img
         :src="icon"
         :alt="pkg.manifest.title"
-        class="w-20 h-20 rounded-xl shadow-xl flex-shrink-0"
+        class="app-detail-icon w-20 h-20 shadow-xl flex-shrink-0"
         @error="handleImageError"
       />
 
@@ -119,7 +119,7 @@
         <img
           :src="icon"
           :alt="pkg.manifest.title"
-          class="w-20 h-20 rounded-xl shadow-xl flex-shrink-0"
+          class="app-detail-icon w-20 h-20 shadow-xl flex-shrink-0"
           @error="handleImageError"
         />
 

neode-ui/src/views/appSession/AppSessionFrame.vue

@@ -9,16 +9,24 @@
       </div>
     </Transition>
 
-    <iframe
+    <div
       v-if="appUrl && !iframeBlocked"
-      ref="iframeRef"
-      :key="refreshKey"
-      :src="appUrl"
-      class="absolute inset-0 w-full h-full border-0 iframe-scrollbar-hide"
-      title="App content"
-      @load="$emit('iframeLoad')"
-      @error="$emit('iframeError')"
-    />
+      class="absolute inset-0 app-session-frame-scroll-host"
+      tabindex="-1"
+      @pointerdown="focusIframe"
+      @focusin="focusIframe"
+    >
+      <iframe
+        ref="iframeRef"
+        :key="refreshKey"
+        :src="appUrl"
+        class="w-full h-full border-0 iframe-scrollbar-hide"
+        title="App content"
+        tabindex="0"
+        @load="handleIframeLoad"
+        @error="$emit('iframeError')"
+      />
+    </div>
 
     <!-- Iframe blocked fallback -->
     <Transition name="content-fade">
@@ -69,9 +77,9 @@
 </template>
 
 <script setup lang="ts">
-import { ref } from 'vue'
+import { nextTick, ref, watch } from 'vue'
 
-defineProps<{
+const props = defineProps<{
   appUrl: string
   appId: string
   appTitle: string
@@ -82,7 +90,7 @@ defineProps<{
   refreshKey: number
 }>()
 
-defineEmits<{
+const emit = defineEmits<{
   iframeLoad: []
   iframeError: []
   refresh: []
@@ -91,5 +99,21 @@ defineEmits<{
 
 const iframeRef = ref<HTMLIFrameElement | null>(null)
 
+function focusIframe() {
+  iframeRef.value?.focus({ preventScroll: true })
+}
+
+async function handleIframeLoad() {
+  emit('iframeLoad')
+  await nextTick()
+  requestAnimationFrame(focusIframe)
+}
+
+watch(() => [props.appUrl, props.refreshKey, props.iframeBlocked], async () => {
+  if (!props.appUrl || props.iframeBlocked) return
+  await nextTick()
+  requestAnimationFrame(focusIframe)
+}, { immediate: true })
+
 defineExpose({ iframeRef })
 </script>

neode-ui/src/views/appSession/appSessionConfig.ts

@@ -14,6 +14,7 @@ export const APP_PORTS: Record<string, number> = {
   'archy-electrs-ui': 50002,
   'mempool-electrs': 50002,
   'btcpay-server': 23000,
+  'saleor':        9000,
   'lnd':           18083,
   'archy-lnd-ui':  18083,
   'mempool':       4080,
@@ -71,7 +72,7 @@ export const EXTERNAL_URLS: Record<string, string> = {
 
 export const APP_TITLES: Record<string, string> = {
   'bitcoin-knots': 'Bitcoin Knots', 'bitcoin-core': 'Bitcoin Core',
-  'btcpay-server': 'BTCPay Server', 'indeedhub': 'Indeehub',
+  'btcpay-server': 'BTCPay Server', 'saleor': 'Saleor', 'indeedhub': 'Indeehub',
   'botfights': 'BotFights', 'gitea': 'Gitea', '484-kitchen': '484 Kitchen', 'arch-presentation': 'Presentation',
   'homeassistant': 'Home Assistant', 'uptime-kuma': 'Uptime Kuma',
   'nginx-proxy-manager': 'Nginx Proxy Manager',

neode-ui/src/views/apps/AppCard.vue

@@ -31,7 +31,7 @@
       <img
         :src="icon"
         :alt="title"
-        class="w-14 h-14 rounded-lg object-cover bg-white/10"
+        class="app-card-icon w-14 h-14 object-cover bg-white/10"
         @error="handleImageError"
       />
       <div class="flex-1 min-w-0 overflow-hidden">

neode-ui/src/views/apps/__tests__/AppIconGrid.test.ts

@@ -35,6 +35,11 @@ describe('AppIconGrid', () => {
     setActivePinia(createPinia())
     vi.clearAllMocks()
     localStorage.clear()
+    Object.defineProperty(window, 'innerWidth', {
+      value: 1024,
+      writable: true,
+      configurable: true,
+    })
     Object.defineProperty(window, 'location', {
       value: { hostname: '192.168.1.198' },
       writable: true,
@@ -55,4 +60,24 @@ describe('AppIconGrid', () => {
     expect(mockWindowOpen).not.toHaveBeenCalled()
     expect(useAppLauncherStore().panelAppId).toBe('lnd')
   })
+
+  it('routes desktop new-tab apps through app session on mobile', async () => {
+    Object.defineProperty(window, 'innerWidth', {
+      value: 390,
+      writable: true,
+      configurable: true,
+    })
+
+    const wrapper = mount(AppIconGrid, {
+      props: { apps: [['gitea', makePkg('gitea')]] },
+      global: {
+        plugins: [createPinia()],
+      },
+    })
+
+    await wrapper.get('.app-icon-item').trigger('click')
+
+    expect(mockWindowOpen).not.toHaveBeenCalled()
+    expect(useAppLauncherStore().panelAppId).toBeNull()
+  })
 })

neode-ui/src/views/apps/appsConfig.ts

@@ -166,7 +166,8 @@ const APP_ICON_FALLBACKS: Record<string, string> = {
 }
 
 export function resolveAppIcon(id: string, pkg: PackageDataEntry, curatedIcon?: string): string {
-  const icon = (pkg["static-files"]?.icon || "").trim()
+  const rawIcon = (pkg["static-files"]?.icon || "").trim()
+  const icon = rawIcon === '/assets/img/favico.png' ? '' : rawIcon
   if (
     icon.startsWith("/") ||
     icon.startsWith("http://") ||

neode-ui/src/views/dashboard/DashboardMobileNav.vue

@@ -22,6 +22,7 @@
         to="/dashboard/apps?tab=websites"
         class="mode-switcher-btn"
         :class="{ 'mode-switcher-btn-active': route.query.tab === 'services' || route.query.tab === 'websites' }"
+        @click.prevent="router.push({ path: '/dashboard/apps', query: { tab: 'websites' } })"
       >Websites</RouterLink>
     </div>
   </div>

neode-ui/src/views/discover/FilterModal.vue

@@ -4,8 +4,7 @@
     <Teleport to="body">
       <button
         @click="showFilter = true"
-        class="md:hidden fixed right-4 z-40 w-14 h-14 rounded-full glass-button flex items-center justify-center shadow-2xl mobile-back-btn"
-        style="left: auto;"
+        class="md:hidden fixed right-4 z-[2400] w-14 h-14 rounded-full glass-button flex items-center justify-center shadow-2xl mobile-filter-btn"
       >
         <svg class="w-6 h-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">
           <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 4a1 1 0 011-1h16a1 1 0 011 1v2.586a1 1 0 01-.293.707l-6.414 6.414a1 1 0 00-.293.707V17l-4 4v-6.586a1 1 0 00-.293-.707L3.293 7.293A1 1 0 013 6.586V4z" />
@@ -17,10 +16,10 @@
     <Transition name="modal">
       <div
         v-if="showFilter"
-        class="fixed inset-0 z-50 flex items-end justify-center md:hidden bg-black/10 backdrop-blur-md"
+        class="fixed inset-0 z-[3000] flex items-end justify-center md:hidden bg-black/10 backdrop-blur-md"
         @click.self="closeFilter"
       >
-        <div ref="filterModalRef" class="glass-card p-6 w-full rounded-t-3xl max-h-[80vh] overflow-y-auto">
+        <div ref="filterModalRef" class="glass-card p-6 w-full rounded-t-3xl max-h-[80vh] overflow-y-auto mobile-filter-sheet">
           <div class="flex items-center justify-between mb-6">
             <h2 class="text-2xl font-bold text-white">Filter</h2>
             <button @click="closeFilter" class="text-white/60 hover:text-white transition-colors">

neode-ui/src/views/discover/curatedApps.ts

@@ -79,6 +79,7 @@ export function getCuratedAppList(): MarketplaceApp[] {
     { id: 'bitcoin-knots', title: 'Bitcoin Knots', version: '28.1.0', description: 'Run a full Bitcoin node. Validate and relay blocks and transactions on the Bitcoin network.', icon: '/assets/img/app-icons/bitcoin-knots.webp', author: 'Bitcoin Knots', dockerImage: `${R}/bitcoin-knots:latest`, repoUrl: 'https://github.com/bitcoinknots/bitcoin' },
     { id: 'bitcoin-core', title: 'Bitcoin Core', version: '28.4', description: 'Reference implementation of the Bitcoin protocol. Run a full node validating and relaying blocks on the Bitcoin network.', icon: '/assets/img/app-icons/bitcoin-core.svg', author: 'Bitcoin Core contributors', dockerImage: 'docker.io/bitcoin/bitcoin:28.4', repoUrl: 'https://github.com/bitcoin/bitcoin' },
     { id: 'btcpay-server', title: 'BTCPay Server', version: '2.3.9', description: 'Self-hosted Bitcoin payment processor. Accept Bitcoin payments without intermediaries or fees.', icon: '/assets/img/app-icons/btcpay-server.png', author: 'BTCPay Server Foundation', dockerImage: 'docker.io/btcpayserver/btcpayserver:2.3.9', repoUrl: 'https://github.com/btcpayserver/btcpayserver' },
+    { id: 'saleor', title: 'Saleor', version: '3.23', category: 'commerce', description: 'Composable commerce platform with GraphQL API, dashboard, worker, mail testing, and tracing.', icon: '/assets/img/app-icons/saleor.svg', author: 'Saleor', dockerImage: 'ghcr.io/saleor/saleor:3.23', repoUrl: 'https://github.com/saleor/saleor' },
     { id: 'lnd', title: 'LND', version: '0.18.4', description: 'Lightning Network Daemon. Fast and cheap Bitcoin payments through the Lightning Network.', icon: '/assets/img/app-icons/lnd.svg', author: 'Lightning Labs', dockerImage: `${R}/lnd:v0.18.4-beta`, repoUrl: 'https://github.com/lightningnetwork/lnd' },
     { id: 'mempool', title: 'Mempool Explorer', version: '3.0.0', description: 'Self-hosted Bitcoin blockchain and mempool visualizer. Monitor transactions without revealing your addresses to third parties.', icon: '/assets/img/app-icons/mempool.webp', author: 'Mempool', dockerImage: `${R}/mempool-frontend:v3.0.0`, repoUrl: 'https://github.com/mempool/mempool' },
     { id: 'homeassistant', title: 'Home Assistant', version: '2024.1', description: 'Open-source home automation. Control smart home devices privately, on your own hardware.', icon: '/assets/img/app-icons/homeassistant.png', author: 'Home Assistant', dockerImage: `${R}/home-assistant:2024.1`, repoUrl: 'https://github.com/home-assistant/core' },
@@ -120,6 +121,7 @@ export const INSTALLED_ALIASES: Record<string, string[]> = {
   mempool: ['mempool', 'mempool-web', 'archy-mempool-web'],
   bitcoin: ['bitcoin-knots'],
   btcpay: ['btcpay-server'],
+  saleor: ['saleor'],
   immich: ['immich-server', 'immich-app', 'immich_server'],
   nextcloud: ['nextcloud-aio', 'nextcloud-server'],
   fedimint: ['fedimint-gateway'],
@@ -189,7 +191,7 @@ export function categorizeCommunityApp(app: MarketplaceApp): string {
   const combined = `${id} ${title} ${description}`
 
   if (id.includes('bitcoin') || id.includes('btc') || id.includes('lightning') || id.includes('lnd') || id.includes('electr') || id.includes('fedimint') || id.includes('cashu') || combined.includes('wallet')) return 'money'
-  if (id.includes('btcpay') || id.includes('commerce') || id.includes('shop') || id.includes('pos') || combined.includes('merchant')) return 'commerce'
+  if (id.includes('btcpay') || id.includes('saleor') || id.includes('commerce') || id.includes('shop') || id.includes('pos') || combined.includes('merchant')) return 'commerce'
   if (id.includes('cloud') || id.includes('nextcloud') || id.includes('storage') || id.includes('file') || id.includes('photo') || id.includes('immich') || id.includes('jellyfin') || id.includes('media') || id.includes('vault') || combined.includes('password manager')) return 'data'
   if (id.includes('home-assistant') || id.includes('homeassistant') || combined.includes('home automation')) return 'home'
   if (id.includes('nostr') || combined.includes('nostr relay')) return 'nostr'

neode-ui/src/views/marketplace/MarketplaceFilterModal.vue

@@ -3,8 +3,7 @@
   <Teleport to="body">
     <button
       @click="showModal = true"
-      class="md:hidden fixed right-4 z-40 w-14 h-14 rounded-full glass-button flex items-center justify-center shadow-2xl mobile-back-btn"
-      style="left: auto;"
+      class="md:hidden fixed right-4 z-[2400] w-14 h-14 rounded-full glass-button flex items-center justify-center shadow-2xl mobile-filter-btn"
     >
       <svg class="w-6 h-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">
         <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 4a1 1 0 011-1h16a1 1 0 011 1v2.586a1 1 0 01-.293.707l-6.414 6.414a1 1 0 00-.293.707V17l-4 4v-6.586a1 1 0 00-.293-.707L3.293 7.293A1 1 0 013 6.586V4z" />
@@ -16,10 +15,10 @@
   <Transition name="modal">
     <div
       v-if="showModal"
-      class="fixed inset-0 z-50 flex items-end justify-center md:hidden bg-black/10 backdrop-blur-md"
+      class="fixed inset-0 z-[3000] flex items-end justify-center md:hidden bg-black/10 backdrop-blur-md"
       @click.self="close()"
     >
-      <div ref="modalRef" class="glass-card p-6 w-full rounded-t-3xl max-h-[80vh] overflow-y-auto">
+      <div ref="modalRef" class="glass-card p-6 w-full rounded-t-3xl max-h-[80vh] overflow-y-auto mobile-filter-sheet">
         <!-- Header -->
         <div class="flex items-center justify-between mb-6">
           <h2 class="text-2xl font-bold text-white">{{ t('marketplace.filterByCategory') }}</h2>

neode-ui/src/views/marketplace/marketplaceData.ts

@@ -47,6 +47,7 @@ export const INSTALLED_ALIASES: Record<string, string[]> = {
   mempool: ['mempool-web', 'mempool-api', 'archy-mempool-web', 'archy-mempool-db'],
   bitcoin: ['bitcoin-knots'],
   btcpay: ['btcpay-server', 'archy-btcpay-db', 'archy-nbxplorer'],
+  saleor: ['saleor'],
   immich: ['immich-server', 'immich-app', 'immich_server', 'immich_postgres', 'immich_redis'],
   nextcloud: ['nextcloud-aio', 'nextcloud-server'],
   fedimint: ['fedimint-gateway'],
@@ -67,7 +68,7 @@ export const INSTALLED_ALIASES: Record<string, string[]> = {
 /** Get app tier classification (matches backend get_app_tier) */
 export function getAppTier(appId: string): string {
   const core = ['bitcoin-knots', 'bitcoin', 'lnd', 'mempool', 'btcpay-server', 'dwn', 'filebrowser']
-  const recommended = ['fedimint', 'thunderhub', 'vaultwarden', 'uptime-kuma', 'grafana', 'searxng', 'tailscale', 'netbird', 'portainer']
+  const recommended = ['fedimint', 'thunderhub', 'vaultwarden', 'uptime-kuma', 'grafana', 'searxng', 'tailscale', 'netbird', 'portainer', 'saleor']
   if (core.includes(appId)) return 'core'
   if (recommended.includes(appId)) return 'recommended'
   return 'optional'
@@ -89,7 +90,7 @@ export function categorizeCommunityApp(app: MarketplaceApp): string {
     return 'money'
   }
 
-  if (id.includes('btcpay') || id.includes('commerce') || id.includes('shop') ||
+  if (id.includes('btcpay') || id.includes('saleor') || id.includes('commerce') || id.includes('shop') ||
       id.includes('store') || id.includes('pos') || id.includes('payment') ||
       combined.includes('merchant') || combined.includes('invoice')) {
     return 'commerce'
@@ -157,6 +158,18 @@ export function getCuratedAppList(): MarketplaceApp[] {
       manifestUrl: undefined,
       repoUrl: 'https://github.com/btcpayserver/btcpayserver'
     },
+    {
+      id: 'saleor',
+      title: 'Saleor',
+      version: '3.23',
+      category: 'commerce',
+      description: 'Composable commerce platform with GraphQL API, dashboard, worker, mail testing, and tracing.',
+      icon: '/assets/img/app-icons/saleor.svg',
+      author: 'Saleor',
+      dockerImage: 'ghcr.io/saleor/saleor:3.23',
+      manifestUrl: undefined,
+      repoUrl: 'https://github.com/saleor/saleor'
+    },
     {
       id: 'lnd',
       title: 'LND',

neode-ui/src/views/settings/AccountInfoSection.vue

@@ -180,6 +180,90 @@ init()
               </button>
             </div>
             <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+              <!-- v1.7.74-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.74-alpha</span>
+                  <span class="text-xs text-white/40">May 19, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>App-session right panels now re-focus the iframe after load and when the frame area is activated, so scrolling works immediately after selecting an app or switching tabs on shorter screens.</p>
+                  <p>NetBird now uses a unified local launch origin on port 8087 that serves the dashboard and proxies auth/API routes to the server, fixing the Unauthenticated and 404 logout/login loop.</p>
+                  <p>Existing NetBird installs are repaired during adopt/start by rewriting the config files and creating the missing dashboard/proxy containers while preserving data.</p>
+                  <p>Saleor is not in this release yet; it remains pending for separate validation.</p>
+                </div>
+              </div>
+              <!-- v1.7.73-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.73-alpha</span>
+                  <span class="text-xs text-white/40">May 19, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Mobile apps that block iframe embedding now open directly in a browser tab instead of first landing in a broken in-shell webview.</p>
+                  <p>App Store search covers all apps while searching, My Apps search can surface matching installable App Store entries, and mobile My Apps/Websites tab switching updates the view reliably.</p>
+                  <p>NetBird installs prefer a 100.x tailnet address when available, and app sessions gained iframe auto-focus plus a scroll host for right-frame scrolling.</p>
+                </div>
+              </div>
+              <!-- v1.7.72-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.72-alpha</span>
+                  <span class="text-xs text-white/40">May 19, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Settings What's New is caught up again. The modal now includes the missing entries for v1.7.68-alpha through v1.7.71-alpha instead of stopping at v1.7.67-alpha.</p>
+                  <p>The release lockfile metadata is also kept in sync with the previous release bump.</p>
+                </div>
+              </div>
+              <!-- v1.7.71-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.71-alpha</span>
+                  <span class="text-xs text-white/40">May 19, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>NetBird stack installs now create the exact persistent data directory before binding it into the server container, fixing the failed install path seen on the test node.</p>
+                  <p>NetBird start and restart actions bring up the control-plane server before the dashboard, so lifecycle actions use the correct dependency order.</p>
+                  <p>App-session fallbacks now return to My Apps under /dashboard, mobile iframe-blocked apps stay inside Archipelago with an explicit fallback, and installed Gitea containers show the packaged Gitea icon with rounder app icon masks.</p>
+                </div>
+              </div>
+              <!-- v1.7.70-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.70-alpha</span>
+                  <span class="text-xs text-white/40">May 19, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>NetBird was corrected from the peer/client daemon image to the self-hosted control-plane stack, with a launchable dashboard on port 8087, management/signal/relay server on 8086, and STUN on UDP 3478.</p>
+                  <p>Local app launches use direct host ports and carry an explicit dashboard return target, so closing an app session goes back to the launching dashboard screen instead of falling through to browser history or a 404.</p>
+                  <p>Mobile launches ignore stale desktop panel state and route into the full app-session webview. The desktop sidebar also keeps top and bottom regions pinned while only the middle navigation scrolls on short screens.</p>
+                </div>
+              </div>
+              <!-- v1.7.69-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.69-alpha</span>
+                  <span class="text-xs text-white/40">May 19, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>App installs now allow up to 10 minutes for slow initial install RPCs, matching large container pulls and preventing apps from disappearing from My Apps while the backend is still pulling or retrying mirrors.</p>
+                  <p>Gitea is now categorized as a known Data app and stays visible during slow registry pulls. Live diagnostics confirmed the Gitea container came up healthy on port 3001 after the frontend had previously timed out too early.</p>
+                  <p>NetBird was added to the catalog as a recommended networking app, and the Archipelago terminal includes nano on new installs and existing-node self-update fallback.</p>
+                </div>
+              </div>
+              <!-- v1.7.68-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.68-alpha</span>
+                  <span class="text-xs text-white/40">May 19, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>BTCPay Server now ships on the official btcpayserver image, fixing the plugin catalog crash caused by newer plugin dependency metadata while preserving existing data and Postgres databases.</p>
+                  <p>BTCPay health checks no longer require curl inside the container, and Nginx Proxy Manager certificate challenge handling now avoids hijacking local API traffic while syncing issued public proxy hosts into host nginx.</p>
+                  <p>System Update confirmation and mirror modals now cover the whole app, app-session close returns to the previous dashboard screen, and mobile app launches stay inside Archipelago's app-session webview.</p>
+                </div>
+              </div>
               <!-- v1.7.67-alpha -->
               <div>
                 <div class="flex items-center gap-2 mb-3">

release-manifest.json

@@ -1,29 +1,28 @@
 {
-  "version": "1.7.70-alpha",
+  "version": "1.7.75-alpha",
   "release_date": "2026-05-19",
   "changelog": [
-    "NetBird is being corrected from the peer/client daemon image to the self-hosted NetBird control-plane stack with a launchable dashboard on port `8087`, a combined management/signal/relay server on `8086`, and STUN on UDP `3478`.",
-    "App sessions now always launch local apps through direct host ports and carry an explicit dashboard return target, so closing an iframe returns to the launching dashboard screen instead of falling through to browser history or a 404.",
-    "Mobile app launches ignore stale desktop panel state and route into the full app-session webview consistently.",
-    "The desktop sidebar now pins the logo/version at the top and controller/online/mode controls at the bottom, with only the navigation section scrolling on shorter screens.",
-    "Validation passed with catalog JSON checks, `scripts/image-versions.sh` syntax check, `npm run type-check`, `cargo fmt --all --check --manifest-path core/Cargo.toml`, and `cargo check -p archipelago --manifest-path core/Cargo.toml`."
+    "Saleor is now published as a recommended commerce app with catalog metadata, icon, direct app-session launch on port `9000`, scanner metadata, image pins, and a full stack installer for dashboard, API, worker, PostgreSQL, Valkey, Mailpit, and Jaeger.",
+    "Existing NetBird installs are repaired more aggressively by rewriting unified-origin config, recreating the dashboard/proxy containers, restarting the server, preserving data, and handling exact `/api` and `/oauth2` routes plus dashboard logout redirects through the local proxy.",
+    "Desktop dashboard scrolling now hands focus back from the sidebar to the main content when the pointer or wheel moves over the main pane, preventing the sidebar scroll area from trapping wheel input on short screens.",
+    "Validation passed with catalog JSON checks, `npm run type-check`, `cargo fmt --all --check --manifest-path core/Cargo.toml`, and `cargo check -p archipelago --manifest-path core/Cargo.toml` before release."
   ],
   "components": [
     {
       "name": "archipelago",
-      "current_version": "1.7.70-alpha",
-      "new_version": "1.7.70-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.70-alpha/archipelago",
-      "sha256": "894b9e20c2af444b46b136cc7ad85edb68ced3b4beade664d5275a9f5226e0ca",
-      "size_bytes": 42976896
+      "current_version": "1.7.75-alpha",
+      "new_version": "1.7.75-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.75-alpha/archipelago",
+      "sha256": "d83c88e21df52b59fbdcadb15b7e968c6ac17f5cbab94a9dd734ccc6637c9f7f",
+      "size_bytes": 43061552
     },
     {
-      "name": "archipelago-frontend-1.7.70-alpha.tar.gz",
-      "current_version": "1.7.70-alpha",
-      "new_version": "1.7.70-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.70-alpha/archipelago-frontend-1.7.70-alpha.tar.gz",
-      "sha256": "4c14cfb53f00b1649f4916403e8114d0599fa3b30cd290facd6fc951760e9fa2",
-      "size_bytes": 166478441
+      "name": "archipelago-frontend-1.7.75-alpha.tar.gz",
+      "current_version": "1.7.75-alpha",
+      "new_version": "1.7.75-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.75-alpha/archipelago-frontend-1.7.75-alpha.tar.gz",
+      "sha256": "1aa564b99c64219005693cebf9be6cc148e73585b81a27675dd27b9d09bc6ab8",
+      "size_bytes": 166484762
     }
   ]
 }

releases/manifest.json

@@ -1,29 +1,28 @@
 {
-  "version": "1.7.70-alpha",
+  "version": "1.7.75-alpha",
   "release_date": "2026-05-19",
   "changelog": [
-    "NetBird is being corrected from the peer/client daemon image to the self-hosted NetBird control-plane stack with a launchable dashboard on port `8087`, a combined management/signal/relay server on `8086`, and STUN on UDP `3478`.",
-    "App sessions now always launch local apps through direct host ports and carry an explicit dashboard return target, so closing an iframe returns to the launching dashboard screen instead of falling through to browser history or a 404.",
-    "Mobile app launches ignore stale desktop panel state and route into the full app-session webview consistently.",
-    "The desktop sidebar now pins the logo/version at the top and controller/online/mode controls at the bottom, with only the navigation section scrolling on shorter screens.",
-    "Validation passed with catalog JSON checks, `scripts/image-versions.sh` syntax check, `npm run type-check`, `cargo fmt --all --check --manifest-path core/Cargo.toml`, and `cargo check -p archipelago --manifest-path core/Cargo.toml`."
+    "Saleor is now published as a recommended commerce app with catalog metadata, icon, direct app-session launch on port `9000`, scanner metadata, image pins, and a full stack installer for dashboard, API, worker, PostgreSQL, Valkey, Mailpit, and Jaeger.",
+    "Existing NetBird installs are repaired more aggressively by rewriting unified-origin config, recreating the dashboard/proxy containers, restarting the server, preserving data, and handling exact `/api` and `/oauth2` routes plus dashboard logout redirects through the local proxy.",
+    "Desktop dashboard scrolling now hands focus back from the sidebar to the main content when the pointer or wheel moves over the main pane, preventing the sidebar scroll area from trapping wheel input on short screens.",
+    "Validation passed with catalog JSON checks, `npm run type-check`, `cargo fmt --all --check --manifest-path core/Cargo.toml`, and `cargo check -p archipelago --manifest-path core/Cargo.toml` before release."
   ],
   "components": [
     {
       "name": "archipelago",
-      "current_version": "1.7.70-alpha",
-      "new_version": "1.7.70-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.70-alpha/archipelago",
-      "sha256": "894b9e20c2af444b46b136cc7ad85edb68ced3b4beade664d5275a9f5226e0ca",
-      "size_bytes": 42976896
+      "current_version": "1.7.75-alpha",
+      "new_version": "1.7.75-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.75-alpha/archipelago",
+      "sha256": "d83c88e21df52b59fbdcadb15b7e968c6ac17f5cbab94a9dd734ccc6637c9f7f",
+      "size_bytes": 43061552
     },
     {
-      "name": "archipelago-frontend-1.7.70-alpha.tar.gz",
-      "current_version": "1.7.70-alpha",
-      "new_version": "1.7.70-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.70-alpha/archipelago-frontend-1.7.70-alpha.tar.gz",
-      "sha256": "4c14cfb53f00b1649f4916403e8114d0599fa3b30cd290facd6fc951760e9fa2",
-      "size_bytes": 166478441
+      "name": "archipelago-frontend-1.7.75-alpha.tar.gz",
+      "current_version": "1.7.75-alpha",
+      "new_version": "1.7.75-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.75-alpha/archipelago-frontend-1.7.75-alpha.tar.gz",
+      "sha256": "1aa564b99c64219005693cebf9be6cc148e73585b81a27675dd27b9d09bc6ab8",
+      "size_bytes": 166484762
     }
   ]
 }

scripts/image-versions.sh

@@ -50,9 +50,18 @@ PORTAINER_IMAGE="$ARCHY_REGISTRY/portainer:latest"
 TAILSCALE_IMAGE="$ARCHY_REGISTRY/tailscale:stable"
 NETBIRD_DASHBOARD_IMAGE="docker.io/netbirdio/dashboard:v2.38.0"
 NETBIRD_SERVER_IMAGE="docker.io/netbirdio/netbird-server:0.71.2"
+NETBIRD_PROXY_IMAGE="docker.io/library/nginx:1.27-alpine"
 ALPINE_TOR_IMAGE="$ARCHY_REGISTRY/alpine-tor:0.4.8.13"
 ADGUARDHOME_IMAGE="$ARCHY_REGISTRY/adguardhome:v0.107.55"
 
+# Saleor stack
+SALEOR_API_IMAGE="ghcr.io/saleor/saleor:3.23"
+SALEOR_DASHBOARD_IMAGE="ghcr.io/saleor/saleor-dashboard:3.23"
+SALEOR_POSTGRES_IMAGE="docker.io/library/postgres:15-alpine"
+SALEOR_VALKEY_IMAGE="docker.io/valkey/valkey:8.1-alpine"
+SALEOR_JAEGER_IMAGE="docker.io/jaegertracing/jaeger:latest"
+SALEOR_MAILPIT_IMAGE="docker.io/axllent/mailpit:latest"
+
 # Fedimint
 FEDIMINT_IMAGE="$ARCHY_REGISTRY/fedimintd:v0.10.0"
 FEDIMINT_GATEWAY_IMAGE="$ARCHY_REGISTRY/gatewayd:v0.10.0"