lfg2025/archy

Fork 0

Files

T

History

archipelagoandClaude Fable 5 58cdea5e79

Demo images / Build & push demo images (push) Successful in 3m33s

Details

feat(appgate): apps with their own login can skip the node login

Some apps carry a complete account system and are broken by an upstream
challenge: git clients speak basic-auth (not browser cookies), and a
BTCPay checkout link handed to a customer must open for that customer.
Both were behind the gate's login page — the "non-browser clients need an
access token" gap disclosed in five consecutive releases.

- New manifest port policy `auth: open`: the daemon still fronts the port
  exactly like `gated` (loopback pin, external binds, frame-header fixes,
  app-down retry page, Tor upstream) but serves it without the login
  challenge. Requires auth_rationale, same burden of proof as `none`.
  Gitea 3001 and BTCPay 23000 declare it.
- Runtime operator override per app (security.set-app-gate → app-configs/
  <id>.json "gateEnabled"), surfaced as Settings → app → Access control.
  Wins over the manifest in both directions and applies on the next
  request — no restart, and it works today on catalog-covered apps whose
  signed manifest still says `gated`.
- The gate resolves policy per-request from the live port map, so a
  toggle takes effect without waiting for the 60s rebind sweep. "Off"
  never releases the port: gated apps are loopback-pinned, so releasing
  would strand them, not open them.
- security.app-gate-status now reports gate_enabled + any override.
- New guard test pins the `auth: open` set (both entries reviewed); the
  `auth: none` count moves 25 → 26, absorbing pre-existing drift from the
  phoenixd onboarding (loopback JSON API with its own generated password).
- Docs: the manifest spec's ports row documented only host/container/
  protocol — bind, auth, auth_rationale and session_passthrough were
  undocumented. Added a full "Ports & the app gate" section plus a
  developer-guide entry telling app authors to enforce their own auth
  regardless, since the operator can flip the gate either way.

Verified live on archi-dev-box from an external address: gated → 401 gate
page; override off → Gitea 200 own page, BTCPay 302 to its own login,
git-over-HTTP info/refs 200; override on → 401 again; clear → default.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-16 11:40:07 -04:00

adr

Archipelago — open-source initial import

2026-08-12 10:55:50 +00:00

README.md

Archipelago documentation

Start here. This index groups the docs by what you're trying to do. The authoritative behaviour is always the code in core/; where a doc and the code disagree, the code wins and the doc is a bug.

Getting started

User Walkthrough — setting up and using a node, from hardware to daily use
Talking to your node — the conversational command surface
Seed Verification — independently verify your 24-word backup
Troubleshooting — common problems and how to resolve them
Gamepad / Controller Navigation — driving the UI from a controller
Pine voice commands — the voice-satellite phrase surface

Architecture

Architecture — the system at a glance
Multi-Node Architecture — how nodes relate across a fleet
API Reference — the JSON-RPC surface

Contributing to Archipelago itself

Developer Guide — building the workspace, the frontend, and an ISO
Contributor guide (CLAUDE.md) — invariants, build/verify, the production test gate
Bulletproof containers — why the reconciler is level-triggered
Release signing runbook — the ceremony and key handling
1.8.0 Release Hardening Plan — the release-blocking checklist
Third-party license audit — dependency licensing posture
Demo build info — operating the public demo sandbox

App development

App Developer Guide — build and package a containerized app
App Manifest Specification — the manifest schema, field by field
Manifest → Quadlet unit — how a manifest compiles to a systemd-owned container unit
Container lifecycle — the reconciler state machine: install/adopt/start/stop/self-heal
App secrets — declaring, generating and injecting per-install credentials
Registry-Distributed Manifests — how manifests reach nodes via the signed catalog
Decentralized Marketplace Protocol — publishing apps via an external registry
Bitcoin RPC Relay — letting an external wallet reach the node's Bitcoin RPC
Companion Pairing QR — the pairing handoff contract
TV input inside iframe apps — keyboard/gamepad routing into embedded apps

Design docs

These record why a thing is built the way it is. They are design records, not step-by-step guides, and some predate the current implementation.

Decisions (ADRs)

There is no ADR-010 — the number was never issued, so the gap is not a missing file.

Security

Security Policy — how to report a vulnerability
PSBT Signing Architecture
Bitcoin RPC Proxy Exposure
Entropy Enforcement (KEY-05)

Roadmap & history

Roadmap — where the project is going
archive/ — superseded design and status documents, kept for provenance