archipelagoandClaude Opus 5
3086f5addb
BTCPay 2.4.2 fixes a critical vulnerability that upstream reports as actively exploited: a TOTP two-factor bypass via Greenfield Basic authentication (btcpayserver/btcpayserver#7491). Checked the 2.3.9 -> 2.4.2 breaking changes against how Archipelago actually configures BTCPay; both are inert here: - 2.4.0 removed the LNBank and Lightning Charge backends. Ours is a direct LND connection built by container::lnd::ensure_btcpay_lnd_connection_secret. - 2.4.2 disables Greenfield Basic auth five minutes after account creation. Nothing in the daemon or frontend consumes BTCPay's API. The manifest bump alone does NOT reach nodes: catalog_image_override makes the signed catalog authoritative whenever the image repo matches, so a node would be forced back to 2.3.9. The catalog edit is held locally until the signing ceremony runs, because an unsigned catalog published to main would be accepted by nodes (absent signatures are allowed) and would quietly drop authenticity. check-app-catalog-drift.py only understood app-catalog/catalog.json, where `apps` is a list. releases/app-catalog.json — the SIGNED catalog nodes actually resolve apps through — keys `apps` by id and wraps each app's full manifest under manifest.app. So the checker parsed the file that governs nothing and raised ValueError on the file that governs everything. It now reads both shapes. Running it against the release catalog shows the repo and the catalog agree on content: of 34 image differences, all 34 are the registry host alone and every tag is identical. The remaining version-string drift (v1.18.0 vs 1.18.0, 1.30.0-alpine vs 1.30.0) is cosmetic metadata, not image drift. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
98 lines
2.5 KiB
YAML
98 lines
2.5 KiB
YAML
app:
|
|
id: btcpay-server
|
|
name: BTCPay Server
|
|
version: 2.4.2
|
|
description: Self-hosted Bitcoin payment processor. Accept Bitcoin payments without intermediaries.
|
|
|
|
container:
|
|
image: docker.io/btcpayserver/btcpayserver:2.4.2
|
|
pull_policy: if-not-present
|
|
network: archy-net
|
|
secret_env:
|
|
- key: BTCPAY_BTCRPCPASSWORD
|
|
secret_file: bitcoin-rpc-password
|
|
- key: BTCPAY_DB_PASS
|
|
secret_file: btcpay-db-password
|
|
# Internal LND node. Generated by the daemon (lnd macaroon as hex +
|
|
# tls.cert thumbprint) — see container::lnd::ensure_btcpay_lnd_connection_secret.
|
|
# Optional: nodes without LND run btcpay without an internal node.
|
|
- key: BTCPAY_BTCLIGHTNING
|
|
secret_file: btcpay-lnd-connection
|
|
optional: true
|
|
derived_env:
|
|
- key: BTCPAY_HOST
|
|
template: "{{HOST_IP}}:23000"
|
|
|
|
dependencies:
|
|
- app_id: bitcoin-core
|
|
version: ">=26.0"
|
|
- app_id: archy-btcpay-db
|
|
version: ">=15.17"
|
|
- app_id: archy-nbxplorer
|
|
version: ">=2.6.0"
|
|
|
|
resources:
|
|
cpu_limit: 2
|
|
memory_limit: 2Gi
|
|
disk_limit: 20Gi
|
|
|
|
security:
|
|
capabilities: []
|
|
readonly_root: false
|
|
network_policy: isolated
|
|
|
|
ports:
|
|
- host: 23000
|
|
container: 49392
|
|
protocol: tcp
|
|
bind: 127.0.0.1
|
|
auth: gated
|
|
|
|
volumes:
|
|
- type: bind
|
|
source: /var/lib/archipelago/btcpay
|
|
target: /datadir
|
|
options: [rw]
|
|
|
|
environment:
|
|
- ASPNETCORE_URLS=http://0.0.0.0:49392
|
|
- BTCPAY_PROTOCOL=http
|
|
- BTCPAY_CHAINS=btc
|
|
# Plugins must live on the persistent volume: the image default
|
|
# (/root/.btcpayserver/Plugins) is container-local, so every recreate
|
|
# silently wiped installed plugins.
|
|
- BTCPAY_PLUGINDIR=/datadir/Plugins
|
|
- BTCPAY_BTCEXPLORERURL=http://archy-nbxplorer:32838
|
|
- BTCPAY_BTCRPCURL=http://bitcoin-knots:8332
|
|
- BTCPAY_BTCRPCUSER=archipelago
|
|
- BTCPAY_POSTGRES=Username=btcpay;Password=${BTCPAY_DB_PASS};Host=archy-btcpay-db;Port=5432;Database=btcpay
|
|
|
|
health_check:
|
|
type: http
|
|
endpoint: http://localhost:49392
|
|
path: /
|
|
interval: 30s
|
|
timeout: 30s
|
|
retries: 5
|
|
|
|
bitcoin_integration:
|
|
rpc_access: read-only
|
|
sync_required: true
|
|
|
|
lightning_integration:
|
|
payment_processing: false
|
|
invoice_management: true
|
|
|
|
interfaces:
|
|
main:
|
|
name: Web UI
|
|
description: BTCPay Server dashboard
|
|
type: ui
|
|
port: 23000
|
|
protocol: http
|
|
path: /
|
|
|
|
metadata:
|
|
launch:
|
|
open_in_new_tab: true
|