archipelagoandClaude Opus 5
6542f7f736
Open-source readiness plan, Phase 1 items 3 and 5. Item 3 turned out to be far narrower than the plan's "93 files" once each hit was classified rather than bulk-replaced. Sanitized only genuine operator identifiers: - FIPS test fixtures and a pine_ha comment carried real node LAN addresses -> RFC 5737 TEST-NET-1, the convention already used elsewhere in this repo. - Real tailnet addresses in fips/endpoints.rs, mock-backend.js and the mesh test runner -> the base of the CGNAT range, obviously synthetic. - Incident comments in appgate/mod.rs and apps/fedimint/manifest.yml named a specific node; the role is what carries the meaning, so the address is gone. - CHANGELOG.md held five real addresses in published release notes — the most exposed of the lot. Deliberately NOT touched, because the plan's item-3 list is over-broad and following it literally would break working code: - 192.168.1.1 / .254, 192.168.0.0/16 and 100.64.0.0/10 are generic router defaults, RFC1918 classification in backup_rpc, and CGNAT range logic in pine_ha / CompanionIntroOverlay. Not leaked infra. - `tx1138` is listed as a hostname to scrub but is two live things: the user-facing default block explorer (`DEFAULT_TX_EXPLORER`) and `RETIRED_TX1138_HOST`, the migration constant whose entire job is stripping that retired registry from existing nodes' saved mirror lists. Scrubbing either breaks a feature. The plan needs this correction. - Android's `192.168.1.100` strings are UI placeholder text. Item 5: added *.key, *.pem, id_rsa*, *.sqlite, *.db to .gitignore, with a negation for core/archipelago/src/appgate/testdata/*.key. Checked those first — they are documented throwaway TLS fixtures compiled in via include_bytes!, not node identity — and the negation stops the new rule silently dropping them if they are ever regenerated. Verified both directions: fixtures not ignored, a stray key elsewhere caught. Verified: residual grep for real infra addresses is clean; audit-secrets.sh still 5/5; app-catalog drift 0 (the fedimint edit is a YAML comment, which does not survive parsing into the signed catalog); 44/44 fips tests pass with the rewritten assertion fixtures. Note: these test runs shared the working tree with another agent's in-flight LND work, which was present but unstaged and is not part of this commit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
115 lines
3.6 KiB
YAML
115 lines
3.6 KiB
YAML
app:
|
|
id: fedimint
|
|
name: Fedimint Guardian
|
|
version: 0.10.0
|
|
description: Federated Bitcoin minting service with built-in Guardian UI. Privacy-preserving Bitcoin custody.
|
|
|
|
container:
|
|
image: source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0
|
|
pull_policy: if-not-present
|
|
network: archy-net
|
|
entrypoint: ["sh", "-lc"]
|
|
custom_args:
|
|
- |-
|
|
until state="$(curl -sS --connect-timeout 5 -m 45 -u "$FM_BITCOIND_USERNAME:$FM_BITCOIND_PASSWORD" -H "Content-Type: application/json" --data-binary '{"jsonrpc":"1.0","id":"fedimint-wait","method":"getblockchaininfo","params":[]}' "$FM_BITCOIND_URL/")" && echo "$state" | grep -q '"initialblockdownload":false'; do
|
|
echo "Waiting for Bitcoin RPC sync at $FM_BITCOIND_URL...";
|
|
sleep 30;
|
|
done;
|
|
exec fedimintd
|
|
derived_env:
|
|
- key: FM_P2P_URL
|
|
template: fedimint://{{HOST_MDNS}}:8173
|
|
- key: FM_API_URL
|
|
template: ws://{{HOST_MDNS}}:8174
|
|
# Resolves to whichever bitcoin container is running (Knots/Core/future
|
|
# distro) instead of a hardcoded name — the guardian works on any node
|
|
# regardless of which Bitcoin software it runs.
|
|
- key: FM_BITCOIND_URL
|
|
template: "http://{{BITCOIN_HOST}}:8332"
|
|
secret_env:
|
|
- key: FM_BITCOIND_PASSWORD
|
|
secret_file: bitcoin-rpc-password
|
|
data_uid: "1000:1000"
|
|
|
|
dependencies:
|
|
- app_id: bitcoin-core
|
|
version: ">=26.0"
|
|
- storage: 20Gi
|
|
|
|
resources:
|
|
cpu_limit: 4
|
|
memory_limit: 4Gi
|
|
disk_limit: 20Gi
|
|
|
|
security:
|
|
capabilities: []
|
|
readonly_root: true
|
|
network_policy: isolated
|
|
|
|
ports:
|
|
- host: 8173
|
|
container: 8173
|
|
protocol: tcp
|
|
auth: none
|
|
auth_rationale: >-
|
|
Fedimint guardian consensus. Other guardians speak the federation's own
|
|
authenticated protocol here; a login page would break consensus.
|
|
- host: 8174
|
|
container: 8174
|
|
protocol: tcp
|
|
auth: none
|
|
auth_rationale: >-
|
|
Fedimint guardian API for federation clients, which authenticate to the
|
|
federation itself and cannot hold a browser session.
|
|
# Public launch port 8175 is owned by archy-fedimint-ui, which serves a
|
|
# wait page while Bitcoin syncs and proxies here after fedimintd starts.
|
|
# 8175 is NOT declared here. It is served by the archy-fedimint-ui
|
|
# companion, a different container, and declaring it on this app made the
|
|
# orchestrator try to publish 8175 from fedimintd — colliding with the
|
|
# companion that already holds it, so start_container failed forever and
|
|
# fedimint crash-looped (a fleet node, 2026-08-05). The companion's nginx
|
|
# is pinned to 127.0.0.1, which is what actually closes that port; the
|
|
# gate reports it rather than fronting it.
|
|
- host: 8177
|
|
container: 8175
|
|
protocol: tcp
|
|
bind: 127.0.0.1
|
|
auth: local
|
|
|
|
volumes:
|
|
- type: bind
|
|
source: /var/lib/archipelago/fedimint
|
|
target: /data
|
|
options: [rw]
|
|
|
|
environment:
|
|
- FM_DATA_DIR=/data
|
|
# FM_BITCOIND_URL comes from derived_env ({{BITCOIN_HOST}}) above, not a
|
|
# hardcoded name — do not re-add it here.
|
|
- FM_BITCOIND_USERNAME=archipelago
|
|
- FM_BITCOIN_NETWORK=bitcoin
|
|
- FM_BIND_P2P=0.0.0.0:8173
|
|
- FM_BIND_API=0.0.0.0:8174
|
|
- FM_BIND_UI=0.0.0.0:8175
|
|
|
|
health_check:
|
|
type: http
|
|
endpoint: http://localhost:8175
|
|
path: /
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
interfaces:
|
|
main:
|
|
name: Guardian UI
|
|
description: Fedimint Guardian wait/proxy UI
|
|
type: ui
|
|
port: 8175
|
|
protocol: http
|
|
path: /
|
|
|
|
bitcoin_integration:
|
|
rpc_access: admin
|
|
sync_required: true
|