archipelagoandClaude Fable 5
abf0f56afc
Scanning archi-dev-box from OUTSIDE found five ports serving their screens with no login — lnd-ui 18083, bitcoin-ui 8334, fips-ui 8336, electrs-ui 50002 and the Fedimint Guardian 8175 — none of which appeared in the gate's unprotected list. They are host-networked, so Podman publishes nothing to pin and their manifests declared 'ports: []'; the gate builds its map from declared ports, so it neither protected them nor reported them. An audit that reports success while five screens are open is worse than no audit. Their nginx now listens on 127.0.0.1 instead of 0.0.0.0, and each port is declared 'auth: gated' so the daemon owns the outside. 'bind:' on a host-networked app is a statement of where the container listens, not a publish instruction — quadlet already skips PublishPort in host mode. Guardian 8175 is declared on the fedimint app because its companion has no manifest, and the gate keys on port, not container. Credential paths were NOT exposed and are verified so: /lnd-connect-info, the /proxy/lnd/ passthrough, container logs and every RPC method through these screens all return 401 unauthenticated. What leaked was the page shell. Also fixes the delivery gap that would have made this unshippable: only bitcoin-ui, lnd-ui and electrs-ui were ever rsynced to /opt/archipelago/docker, so edits to fips-ui and fedimint-ui reached nodes through no path at all. All five now sync; the two whose rebuilds the daemon owns are synced without being handed to container-specs. Every remaining undeclared port is now declared with a stated reason — gated: botfights 9100, router 8084, pine 10380; exempt with rationale: fedimint consensus 8173/8174, gateway 8176/9737, netbird 8086/8087 (TLS + own auth, and enrolled devices cannot hold a session), pine TLS 10381, lightning-stack REST 8091 (macaroon, mirrors lnd). Zero undeclared ports remain across all 56 manifests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
118 lines
3.6 KiB
YAML
118 lines
3.6 KiB
YAML
app:
|
|
id: fedimint
|
|
name: Fedimint Guardian
|
|
version: 0.10.0
|
|
description: Federated Bitcoin minting service with built-in Guardian UI. Privacy-preserving Bitcoin custody.
|
|
|
|
container:
|
|
image: 146.59.87.168:3000/lfg2025/fedimintd:v0.10.0
|
|
pull_policy: if-not-present
|
|
network: archy-net
|
|
entrypoint: ["sh", "-lc"]
|
|
custom_args:
|
|
- |-
|
|
until state="$(curl -sS --connect-timeout 5 -m 45 -u "$FM_BITCOIND_USERNAME:$FM_BITCOIND_PASSWORD" -H "Content-Type: application/json" --data-binary '{"jsonrpc":"1.0","id":"fedimint-wait","method":"getblockchaininfo","params":[]}' "$FM_BITCOIND_URL/")" && echo "$state" | grep -q '"initialblockdownload":false'; do
|
|
echo "Waiting for Bitcoin RPC sync at $FM_BITCOIND_URL...";
|
|
sleep 30;
|
|
done;
|
|
exec fedimintd
|
|
derived_env:
|
|
- key: FM_P2P_URL
|
|
template: fedimint://{{HOST_MDNS}}:8173
|
|
- key: FM_API_URL
|
|
template: ws://{{HOST_MDNS}}:8174
|
|
# Resolves to whichever bitcoin container is running (Knots/Core/future
|
|
# distro) instead of a hardcoded name — the guardian works on any node
|
|
# regardless of which Bitcoin software it runs.
|
|
- key: FM_BITCOIND_URL
|
|
template: "http://{{BITCOIN_HOST}}:8332"
|
|
secret_env:
|
|
- key: FM_BITCOIND_PASSWORD
|
|
secret_file: bitcoin-rpc-password
|
|
data_uid: "1000:1000"
|
|
|
|
dependencies:
|
|
- app_id: bitcoin-core
|
|
version: ">=26.0"
|
|
- storage: 20Gi
|
|
|
|
resources:
|
|
cpu_limit: 4
|
|
memory_limit: 4Gi
|
|
disk_limit: 20Gi
|
|
|
|
security:
|
|
capabilities: []
|
|
readonly_root: true
|
|
network_policy: isolated
|
|
|
|
ports:
|
|
- host: 8173
|
|
container: 8173
|
|
protocol: tcp
|
|
auth: none
|
|
auth_rationale: >-
|
|
Fedimint guardian consensus. Other guardians speak the federation's own
|
|
authenticated protocol here; a login page would break consensus.
|
|
- host: 8174
|
|
container: 8174
|
|
protocol: tcp
|
|
auth: none
|
|
auth_rationale: >-
|
|
Fedimint guardian API for federation clients, which authenticate to the
|
|
federation itself and cannot hold a browser session.
|
|
# Public launch port 8175 is owned by archy-fedimint-ui, which serves a
|
|
# wait page while Bitcoin syncs and proxies here after fedimintd starts.
|
|
# Declared HERE because that companion has no manifest of its own, and the
|
|
# gate keys on the port rather than the container: without this entry it
|
|
# served the Guardian UI unauthenticated on every interface and never
|
|
# appeared in the audit. Its nginx is pinned to 127.0.0.1
|
|
# (docker/fedimint-ui/nginx.conf) so the gate can own the outside.
|
|
- host: 8175
|
|
container: 8175
|
|
protocol: tcp
|
|
bind: 127.0.0.1
|
|
auth: gated
|
|
- host: 8177
|
|
container: 8175
|
|
protocol: tcp
|
|
bind: 127.0.0.1
|
|
auth: local
|
|
|
|
volumes:
|
|
- type: bind
|
|
source: /var/lib/archipelago/fedimint
|
|
target: /data
|
|
options: [rw]
|
|
|
|
environment:
|
|
- FM_DATA_DIR=/data
|
|
# FM_BITCOIND_URL comes from derived_env ({{BITCOIN_HOST}}) above, not a
|
|
# hardcoded name — do not re-add it here.
|
|
- FM_BITCOIND_USERNAME=archipelago
|
|
- FM_BITCOIN_NETWORK=bitcoin
|
|
- FM_BIND_P2P=0.0.0.0:8173
|
|
- FM_BIND_API=0.0.0.0:8174
|
|
- FM_BIND_UI=0.0.0.0:8175
|
|
|
|
health_check:
|
|
type: http
|
|
endpoint: http://localhost:8175
|
|
path: /
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
interfaces:
|
|
main:
|
|
name: Guardian UI
|
|
description: Fedimint Guardian wait/proxy UI
|
|
type: ui
|
|
port: 8175
|
|
protocol: http
|
|
path: /
|
|
|
|
bitcoin_integration:
|
|
rpc_access: admin
|
|
sync_required: true
|