archipelagoandClaude Opus 5
8e814ca06a
Demo images / Build & push demo images (push) Failing after 2m22s
Replaces the registry host across 86 files: 309 references, covering all 40 app manifests, the orchestrator and container crates, the release and catalog scripts, both demo-images workflows, the ISO builder, demo-deploy, and the frontend marketplace data. Verified the domain actually serves the registry before rewriting anything, rather than assuming the web host implies the registry: - TLS verifies clean, HTTP/2 on the web root - an anonymous token grants a manifest fetch (HTTP 200) with no credentials - skopeo inspect --no-creds resolves an image and lists its tags That last check is the one that matters: an outside developer with no account can now pull, which was the functional blocker for publishing at all. Plain-HTTP references become HTTPS in the same pass, so OTA downloads stop crossing the network in the clear. Deliberately NOT rewritten: - The public FIPS anchor on port 8444. It is a functional network endpoint every node dials to bootstrap the mesh — closer to Bitcoin Core's hardcoded seeds than to leaked infrastructure. The domain does resolve to the same host, so it could become a hostname, but that adds a DNS dependency to the path used precisely when things are broken. Worth a deliberate decision, not a side effect of this change. - The companion APK on port 2100. The domain returns 404 for that path, so rewriting it would swap a working URL for a broken one. The Releases page does serve (200), which is where the plan already wants those binaries. - releases/app-catalog.json, releases/manifest.json and release-manifest.json. These carry `signature` and `signed_by`; editing their contents invalidates the signature and the fleet refuses artifacts that fail verification. They were rewritten in a first pass and reverted — they must be regenerated and re-signed through the signing ceremony instead, which needs the mnemonic. So the catalog still advertises the old host until that ceremony runs. Nodes resolve images through the signed catalog, not the on-disk manifests, so this commit alone does not change what a node pulls. Verified: archipelago-container 75/75; every manifest still parses with a top-level app block; no signed artifact modified. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
107 lines
3.8 KiB
YAML
107 lines
3.8 KiB
YAML
app:
|
|
id: indeedhub
|
|
name: IndeeHub
|
|
version: "1.0.0"
|
|
description: Bitcoin documentary streaming platform featuring God Bless Bitcoin and other educational content about Bitcoin, sovereignty, and decentralized technology. Sign in with your Nostr identity.
|
|
category: community
|
|
|
|
# The user-facing launcher (app_id "indeedhub"). Container is named "indeedhub"
|
|
# (matches the runtime's per-app references + the live container, so the
|
|
# orchestrator adopts it). Its nginx (listen 7777) proxies to the backends by
|
|
# their short aliases on indeedhub-net: api:4000, minio:9000, relay:8080.
|
|
container_name: indeedhub
|
|
|
|
container:
|
|
image: source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0
|
|
pull_policy: if-not-present
|
|
network: indeedhub-net
|
|
|
|
dependencies:
|
|
- app_id: indeedhub-api
|
|
- storage: 1Gi
|
|
|
|
resources:
|
|
memory_limit: 512Mi
|
|
disk_limit: 1Gi
|
|
|
|
security:
|
|
# nginx master runs as root and drops workers to the nginx user (uid/gid
|
|
# 101) — needs SET{UID,GID}; CHOWN + DAC_OVERRIDE let it own + write the
|
|
# proxy cache under the tmpfs /var/cache/nginx. The orchestrator does
|
|
# --cap-drop=ALL, so (unlike the legacy `podman run` default caps) these
|
|
# must be declared or nginx workers die with "setgid(101) failed".
|
|
capabilities: [CHOWN, DAC_OVERRIDE, SETGID, SETUID]
|
|
readonly_root: false
|
|
network_policy: isolated
|
|
|
|
ports:
|
|
- host: 7778
|
|
container: 7777
|
|
protocol: tcp # Web UI. Port 7777 on the host is reserved for the Nostr relay.
|
|
bind: 127.0.0.1
|
|
auth: gated
|
|
|
|
# Writable scratch the baked nginx needs; matches the legacy installer's
|
|
# --tmpfs /run + /var/cache/nginx.
|
|
volumes:
|
|
- type: tmpfs
|
|
target: /run
|
|
options: [rw, nosuid, nodev, size=16m]
|
|
- type: tmpfs
|
|
target: /var/cache/nginx
|
|
options: [rw, nosuid, nodev, size=32m]
|
|
|
|
environment: []
|
|
|
|
# Defensive + idempotent. The current indeedhub:1.0.0 image already bakes the
|
|
# iframe-friendly nginx (X-Frame-Options omitted, nostr-provider.js present +
|
|
# <script> injected), so these are mostly no-ops on that tag — but they keep
|
|
# the app iframe-loadable + the provider script fresh for any image build that
|
|
# predates the bake. copy_from_host pulls /opt/archipelago/web-ui/nostr-provider.js
|
|
# (kept current by frontend OTA releases). Replaces the legacy hardcoded
|
|
# patch_indeedhub_nostr_provider() Rust hook.
|
|
hooks:
|
|
post_install:
|
|
- exec: ["sed", "-i", "/X-Frame-Options/d", "/etc/nginx/conf.d/default.conf"]
|
|
- copy_from_host:
|
|
src: "web-ui/nostr-provider.js"
|
|
dest: "/usr/share/nginx/html/nostr-provider.js"
|
|
- exec: ["sh", "-c", "grep -q nostr-provider /etc/nginx/conf.d/default.conf || sed -i 's#</head>#<script src=\"/nostr-provider.js\"></script></head>#' /etc/nginx/conf.d/default.conf"]
|
|
- exec: ["nginx", "-s", "reload"]
|
|
|
|
# TCP liveness on the nginx port, NOT an http GET of /. nginx binds 7777 at
|
|
# startup (before workers), so this passes immediately and stays green under
|
|
# load. An http check of / runs the SPA + sub_filter and false-fails when the
|
|
# node is busy → the reconciler then treats the frontend as wedged and
|
|
# recreates it in a loop (observed churning the frontend on the loaded .198).
|
|
health_check:
|
|
type: tcp
|
|
endpoint: localhost:7777
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
|
|
interfaces:
|
|
main:
|
|
name: Web UI
|
|
description: Stream Bitcoin documentaries with Nostr identity
|
|
type: ui
|
|
port: 7778
|
|
protocol: http
|
|
path: /
|
|
|
|
metadata:
|
|
author: Indeehub Team
|
|
icon: /assets/img/app-icons/indeedhub.png
|
|
website: https://indeedhub.com
|
|
repo: https://github.com/indeedhub/indeedhub
|
|
license: MIT
|
|
tags:
|
|
- bitcoin
|
|
- documentary
|
|
- streaming
|
|
- media
|
|
- education
|
|
- nostr
|