archy/.planning/todos/pending/2026-07-30-migrate-source-references-to-https-domain.md

created, title, area, severity, files

created	title	area	severity	files
2026-07-30T22:19:31.770Z	Migrate all VPS2 references to https://source.archipelago-foundation.org (stop exposing IP; TLS everywhere)	security	blocker	apps/*/manifest.yml app-catalog/catalog.json neode-ui/public/catalog.json core/archipelago/src (update.rs, container/registry.rs, image_versions.rs, image_policy.rs, quadlet.rs, prod_orchestrator.rs, app_catalog.rs, companion.rs, api/rpc/package/*) core/container/src/podman_client.rs core/archipelago/src/fips/anchors.rs scripts/self-update.sh scripts/first-boot-containers.sh scripts/create-release.sh scripts/create-release-manifest.sh scripts/image-versions.sh scripts/generate-app-catalog.sh scripts/bootstrap-switchover.sh release-manifest.json releases/manifest.json tests/lifecycle/remote-lifecycle.sh .gitea/workflows/demo-images.yml neode-ui/src/components/CompanionIntroOverlay.vue

Problem

Dorian (2026-07-30, CRITICAL): every VPS2 service is referenced by raw IP 146.59.87.168 — plain HTTP for most — exposing the IP in shipped artifacts and requiring insecure-registry config on every node. Everything must move to https://source.archipelago-foundation.org "perfectly so all the stuff we use it for works".

Verified inventory (2026-07-30): ~196 references.

• :3000 (Gitea — git/raw/releases AND the OCI container registry): 194 refs — every app manifest's image: field, both catalogs (app-catalog/catalog.json + neode-ui/public/catalog.json, 23 each), compiled Rust core (self-update, registry allow-list, image policy/versions, quadlet gen, package RPCs, podman client), OTA manifests (release-manifest.json, releases/manifest.json), lifecycle tests, release/first-boot/self-update scripts, CI workflows, docs, UI marketplace data.
• :2100 (companion APK package server): 1 ref (CompanionIntroOverlay.vue).
• :8444 (FIPS trust anchor, raw TLS — ARCHY_ANCHOR_ADDR in fips/anchors.rs): 1 ref.

Domain coverage verified live (2026-07-30):

• git clone/ls-remote over HTTPS: ✓ (works; gitea-ai remote already switched)
• Gitea raw + releases: ✓ (HTTP 200)
• Container registry /v2/ through the domain: ✓ (proper 401 auth-challenge; TLS pulls will work and the insecure-registry hack becomes removable)
• :2100 APK server: ✗ NOT behind the domain — needs an openresty route/subdomain on VPS2 (Dorian/VPS2-side)
• :8444 FIPS anchor: ✗ raw TLS service, can't share 443 — at minimum switch the constant to a DNS name (e.g. anchor host + :8444); check whether anchors pin certs before touching (security-sensitive)

Solution

Execute as a dedicated quick task IMMEDIATELY AFTER phase 2's 02-08 (don't disturb the dev-pair perf measurements; requires core Rust rebuild + node verification per CLAUDE.md discipline):

1. Mechanical rewrite of all :3000 refs → https://source.archipelago-foundation.org (registry image refs become source.archipelago-foundation.org/lfg2025/<img>:<tag> — no port, implies 443/TLS).
2. Image-ref transition safety: running containers/quadlets store the OLD image name; migration must not orphan or re-pull-break existing apps (migrations never destroy data). Plan the transition: catalog+manifests flip, orchestrator treats old/new registry names as equivalent during adoption, or staged re-tag.
3. Rebuild core, run the lifecycle gate on a dev node (NOT the fleet), verify: self-update fetch, catalog fetch, image pull via domain, app install end-to-end.
4. Keep the IP endpoints alive on VPS2 during transition — nodes updating FROM old releases still hit IP URLs (fallback window until fleet rolls past).
5. :2100 + :8444: Dorian is setting these up (2026-07-30) as:
   • companion.archipelago-foundation.org → replaces http://146.59.87.168:2100 (companion APK downloads; update CompanionIntroOverlay.vue + any packaging docs). HTTPS assumed — verify before flipping.
   • fips.archipelago-foundation.org → replaces the raw IP in ARCHY_ANCHOR_ADDR (fips/anchors.rs), becoming fips.archipelago-foundation.org:8444 (or whatever port Dorian lands on). SECURITY-SENSITIVE: check whether the FIPS anchor validation pins certificates/identity to the address before changing; verify anchor handshake against the new name from a dev node before fleet rollout.
   • As of 2026-07-30 22:50 UTC neither subdomain resolved yet — re-verify DNS + TLS at execution time; do not flip these two refs until both probes pass.
6. Remove insecure-registry config from node provisioning once pulls verify over TLS.