ssmithxandClaude Opus 5.5
cbf50fa64b
So the player works as a self-contained app install, not only behind a host nginx that provides /fips/. - nginx.conf: full main config with the /fips/ gateway — podsteadr catalogs/feeds on 8095 and blossom blobs on 8098 only, GET/HEAD only, no client cookies or credentials, everything else under /fips/ 404s - njs/fips.js: computes an npub.fips host's mesh address (fd || sha256(pubkey)[:15], bech32 checksum verified), so the gateway needs IPv6 egress to the mesh but no DNS; fips.test.js checks it against three real nodes' addresses - runtime image is nginx-unprivileged 1.30.6 (uid 101): no capabilities, read-only root with writable state in /tmp, /healthz for probes - the app explains that only npub.fips hosts can be relayed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.7 KiB
1.7 KiB
Deploying podsteadr-player on podsteadr
Two ways in, one container:
| URL | How .fips feeds load | Installable / offline |
|---|---|---|
https://player.atobitcoin.io |
via the host's /fips/ gateway (player-domain.conf) |
yes |
http://<node-npub>.fips:8097/ |
directly, over the device's own FIPS connection | no (plain http) |
The image also carries its own /fips/ gateway (nginx.conf, njs/fips.js), used
when the player is opened by LAN address or through a proxy that forwards /fips/
to it. It computes each npub….fips host's mesh address from the key instead of
using DNS, so it only needs IPv6 egress to the mesh: run the container with podman
pasta networking (an IPv4-only bridge network can't reach FIPS). Archipelago's
app manifest does this. Test the address code with:
podman run --rm -v ./njs:/t:ro --entrypoint njs <image> -p /t /t/fips.test.js
Container
Source lives at /var/lib/archipelago/podsteadr-player-src (the path
restore-podsteadr.sh restores from at boot):
cd /var/lib/archipelago/podsteadr-player-src
podman-compose build && podman-compose up -d # serves :8097
Mesh access
Allow the container's port through the fips0 default-deny baseline, in the
hand-maintained /etc/fips/fips.d/90-podsteadr.nft, then reload:
tcp dport 8097 accept
sudo nft -f /etc/fips/fips.nft
HTTPS domain + gateway
- Install only the port-80 server block from
player-domain.confas/etc/nginx/sites-available/player-domain, symlink it intosites-enabled,nginx -t && systemctl reload nginx. sudo certbot certonly --nginx -d player.atobitcoin.io- Install the full
player-domain.conf,nginx -t, reload.