lfg2025/archy

Files

T

archipelagoandClaude Fable 5 d0d9c032de fix(apps): session_passthrough on companion UI ports; indeedhub-redis caps

- lnd-ui/bitcoin-ui/electrs-ui/fips-ui declare session_passthrough: true
  on their gated ports — their nginx forwards the browser's node session
  to the daemon's authenticated endpoints, which the gate's cookie strip
  was discarding (every data call 401'd behind the gate).
- indeedhub-redis gains CHOWN + DAC_OVERRIDE: the alpine entrypoint runs
  as capability-stripped container-root and could not traverse the 0700
  appendonlydir owned by the redis uid — crash-looped ~4k restarts on
  archi-dev-box under the quadlet migration.

These reach nodes via the signed catalog re-sign (manifest overlay).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-05 21:22:07 -04:00

aiui

fix(security): two gate bugs that would have made the rollout a no-op

2026-08-03 18:41:29 -04:00

archy-btcpay-db

fix(apps): repoint image refs from retired git.tx1138.com to vps2

2026-07-10 09:51:38 -04:00

archy-mempool-db

fix(apps): repoint image refs from retired git.tx1138.com to vps2

2026-07-10 09:51:38 -04:00

archy-mempool-web

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

archy-nbxplorer

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

barkd

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

bitcoin-core

fix(bitcoin): repair the startup script I broke in 1.7.124, and gate against it

2026-08-05 18:45:02 -04:00

bitcoin-knots

fix(bitcoin): repair the startup script I broke in 1.7.124, and gate against it

2026-08-05 18:45:02 -04:00

bitcoin-ui

fix(apps): session_passthrough on companion UI ports; indeedhub-redis caps

2026-08-05 21:22:07 -04:00

botfights

fix(security): close the five host-networked app UIs the audit could not see

2026-08-05 08:46:09 -04:00

btcpay-server

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

core-lightning

feat(security): declare which app ports may skip authentication

2026-08-03 13:51:15 -04:00

did-wallet

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

electrs-ui

fix(apps): session_passthrough on companion UI ports; indeedhub-redis caps

2026-08-05 21:22:07 -04:00

electrumx

feat(security): declare which app ports may skip authentication

2026-08-03 13:51:15 -04:00

fedimint

fix(fedimint): stop declaring 8175 — it belongs to the UI companion, not fedimintd

2026-08-05 19:12:36 -04:00

fedimint-clientd

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

fedimint-gateway

fix(security): close the five host-networked app UIs the audit could not see

2026-08-05 08:46:09 -04:00

filebrowser

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

fips-ui

fix(apps): session_passthrough on companion UI ports; indeedhub-redis caps

2026-08-05 21:22:07 -04:00

gitea

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

grafana

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

home-assistant

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

immich

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

immich-postgres

fix(immich): name containers underscore to match runtime lifecycle code

2026-06-21 09:20:38 -04:00

immich-redis

fix(immich): name containers underscore to match runtime lifecycle code

2026-06-21 09:20:38 -04:00

indeedhub

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

indeedhub-api

feat(indeedhub): manifest-driven 7-member stack, orchestrator-first (#20 phase 3)

2026-06-21 15:46:26 -04:00

indeedhub-ffmpeg

feat(indeedhub): manifest-driven 7-member stack, orchestrator-first (#20 phase 3)

2026-06-21 15:46:26 -04:00

indeedhub-minio

feat(indeedhub): manifest-driven 7-member stack, orchestrator-first (#20 phase 3)

2026-06-21 15:46:26 -04:00

indeedhub-postgres

feat(indeedhub): manifest-driven 7-member stack, orchestrator-first (#20 phase 3)

2026-06-21 15:46:26 -04:00

indeedhub-redis

fix(apps): session_passthrough on companion UI ports; indeedhub-redis caps

2026-08-05 21:22:07 -04:00

indeedhub-relay

feat(indeedhub): manifest-driven 7-member stack, orchestrator-first (#20 phase 3)

2026-06-21 15:46:26 -04:00

jellyfin

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

lightning-stack

fix(security): close the five host-networked app UIs the audit could not see

2026-08-05 08:46:09 -04:00

lnd

feat(security): declare which app ports may skip authentication

2026-08-03 13:51:15 -04:00

lnd-ui

fix(apps): session_passthrough on companion UI ports; indeedhub-redis caps

2026-08-05 21:22:07 -04:00

mempool

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

mempool-api

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

morphos-server

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

netbird

fix(security): close the five host-networked app UIs the audit could not see

2026-08-05 08:46:09 -04:00

netbird-dashboard

feat(netbird): manifest-driven migration via reusable orchestrator primitives

2026-06-23 13:39:53 -04:00

netbird-server

fix(security): close the five host-networked app UIs the audit could not see

2026-08-05 08:46:09 -04:00

nextcloud

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

nostr-rs-relay

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

photoprism

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

pine

fix(security): close the five host-networked app UIs the audit could not see

2026-08-05 08:46:09 -04:00

pine-openwakeword

feat(security): declare which app ports may skip authentication

2026-08-03 13:51:15 -04:00

pine-piper

feat(security): declare which app ports may skip authentication

2026-08-03 13:51:15 -04:00

pine-whisper

feat(security): declare which app ports may skip authentication

2026-08-03 13:51:15 -04:00

portainer

fix: portainer pin, bitcoin conf tolerance, gate login UI, named OTA origin

2026-08-05 12:44:57 -04:00

router

fix(security): close the five host-networked app UIs the audit could not see

2026-08-05 08:46:09 -04:00

searxng

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

strfry

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

uptime-kuma

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

vaultwarden

feat(security): declare port auth policy across the app manifests

2026-08-04 06:09:37 -04:00

build.sh

mid code commit

2026-01-24 23:18:24 +00:00

DEVELOPMENT.md

chore: prepare repository for public launch

2026-07-27 17:51:43 +01:00

PORTS.md

chore: snapshot release workspace

2026-06-12 03:00:15 -04:00

QUICKSTART.md

chore: snapshot release workspace

2026-06-12 03:00:15 -04:00

README.md

chore(apps): remove six fake bookmark apps

2026-07-14 06:56:03 -04:00

README.md

Archipelago App Manifests

Containerized applications for the Archipelago Bitcoin Node OS. All apps run in rootless Podman with security hardening (cap-drop ALL, readonly root, non-root user, memory limits).

App Categories

Bitcoin & Lightning

bitcoin-knots — Full Bitcoin node (v28.1)
lnd — Lightning Network Daemon (v0.17.4-beta)
btcpay-server — Payment processor (v1.13.5)
mempool — Block explorer and fee estimator (v2.5.0)
electrumx — Electrum server
fedimint — Federated Bitcoin minting (v0.10.0)

Nostr

nostr-rs-relay — High-performance Rust relay (v0.9.0)
nostrudel — Nostr web client (v0.40.0)

Web5 & Identity

did-wallet — Web5 DID Wallet

Self-Hosted Services

nextcloud (v28), jellyfin (v10.8.13), immich (release), photoprism (v240915)
vaultwarden (v1.30.0-alpine), penpot (v2.4)
homeassistant (v2024.1), filebrowser (v2.27.0), searxng (2024.11.17)
ollama (v0.5.4), grafana (v10.2.0), portainer (v2.19.4)

Networking

tailscale (stable), nginx-proxy-manager (v2.12.1)

Custom & External

indeedhub — Bitcoin documentary streaming (custom build)
router — Mesh routing and network management
botfights — External web app

Manifest Format

Each app has a manifest.yml defining container image, resources, dependencies, security policies, health checks, and network config. See docs/app-manifest-spec.md for the spec.

Quick Reference

PORTS.md — Complete port mapping
QUICKSTART.md — Build and run apps
DEVELOPMENT.md — Development workflow