lfg2025/archy
1
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases 44 Wiki Activity

fix: restore FIPS as installable container app

Browse Source 
FIPS stays in the marketplace as an installable container app.
NostrVPN is the native system service; FIPS is a separate optional app.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Dorian 2026-04-07 14:51:13 +01:00
parent 324405006d
commit 0aefacf3b9
9 changed files with 86 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
core/archipelago/src/api/rpc/package/config.rs
View File

@ -124,9 +124,9 @@ pub(super) fn get_app_capabilities(app_id: &str) -> Vec<String> {
"--cap-add=DAC_OVERRIDE".to_string(),
"--cap-add=NET_BIND_SERVICE".to_string(),
],
// Nostr VPN: mesh networking needs TUN + NET_ADMIN
// Nostr VPN and FIPS: mesh networking daemons need TUN + NET_ADMIN
// Note: --device=/dev/net/tun is added separately in install.rs
"nostr-vpn" => vec![
"nostr-vpn" | "fips" => vec![
"--cap-add=NET_ADMIN".to_string(),
"--cap-add=NET_RAW".to_string(),
],
@ -251,6 +251,7 @@ pub(super) fn get_health_check_args(app_id: &str, _rpc_pass: &str) -> Vec<String
"3",
),
"nostr-vpn" => ("nvpn status || exit 1", "30s", "3"),
"fips" => ("fipsctl status || exit 1", "30s", "3"),
_ => return vec![],
};
@ -293,6 +294,7 @@ pub(super) fn get_memory_limit(app_id: &str) -> &'static str {
"nostr-rs-relay" | "nostr-relay" => "256m",
"routstr" => "512m",
"nostr-vpn" => "256m",
"fips" => "256m",
"nginx-proxy-manager" => "256m",
// Databases
"archy-btcpay-db" | "archy-mempool-db" | "mysql-mempool" => "512m",
@ -358,6 +360,7 @@ pub(super) fn all_container_names(package_id: &str) -> Vec<String> {
"penpot-backend".into(), "penpot-exporter".into(), "penpot-frontend".into(),
],
"nostr-vpn" => vec!["nostr-vpn".into(), "archy-nostr-vpn".into(), "archy-nostr-vpn-ui".into()],
"fips" => vec!["fips".into(), "archy-fips".into(), "archy-fips-ui".into()],
"routstr" => vec!["routstr".into(), "archy-routstr".into()],
// Default: exact name + archy- prefix
_ => vec![base, archy],
@ -834,6 +837,27 @@ pub(super) async fn get_app_config(
None,
)
}
"fips" => {
let nsec = read_nostr_secret_hex();
let mut env = vec![];
if !nsec.is_empty() {
env.push(format!("FIPS_NSEC={}", nsec));
env.push(format!("FIPS_NPUB={}", read_nostr_pubkey_hex()));
}
(
vec![
"2121:2121/udp".to_string(),
"8443:8443".to_string(),
],
vec![
"/var/lib/archipelago/fips/config:/etc/fips".to_string(),
"/var/lib/archipelago/fips/run:/run/fips".to_string(),
],
env,
None,
None,
)
}
"dwn" => (
vec!["3100:3000".to_string()],
vec!["/var/lib/archipelago/dwn:/dwn/data".to_string()],

19
core/archipelago/src/api/rpc/package/install.rs
View File

@ -226,7 +226,7 @@ impl RpcHandler {
}
// TUN device for mesh networking apps
if package_id == "nostr-vpn" {
if matches!(package_id, "nostr-vpn" | "fips") {
run_args.push("--device=/dev/net/tun");
}
@ -265,13 +265,21 @@ impl RpcHandler {
}
// Pre-install: write Nostr identity key files for headless Nostr-aware apps
if package_id == "nostr-vpn" {
if matches!(package_id, "nostr-vpn" | "fips") {
let nostr_secret = std::fs::read_to_string("/var/lib/archipelago/identity/nostr_secret")
.map(|s| s.trim().to_string())
.unwrap_or_default();
if !nostr_secret.is_empty() {
let key_dir = "/var/lib/archipelago/nostr-vpn";
let key_path = format!("{}/nostr_secret", key_dir);
let key_dir = match package_id {
"nostr-vpn" => "/var/lib/archipelago/nostr-vpn",
"fips" => "/var/lib/archipelago/fips/config",
_ => unreachable!(),
};
let key_path = match package_id {
"nostr-vpn" => format!("{}/nostr_secret", key_dir),
"fips" => format!("{}/fips.key", key_dir),
_ => unreachable!(),
};
tokio::fs::create_dir_all(key_dir).await.ok();
tokio::fs::write(&key_path, &nostr_secret).await.ok();
// Restrict permissions on key file
@ -856,6 +864,9 @@ autopilot.active=false\n",
"nostr-vpn" => {
vec![("archy-nostr-vpn-ui", "/opt/archipelago/docker/nostr-vpn-ui", "nostr-vpn-ui")]
}
"fips" => {
vec![("archy-fips-ui", "/opt/archipelago/docker/fips-ui", "fips-ui")]
}
_ => vec![],
};

12
image-recipe/configs/nginx-archipelago.conf
View File

@ -541,6 +541,18 @@ server {
proxy_hide_header Content-Security-Policy;
add_header X-Content-Type-Options "nosniff" always;
}
location /app/fips/ {
proxy_pass http://127.0.0.1:8202/;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_hide_header X-Frame-Options;
add_header X-Frame-Options "SAMEORIGIN" always;
proxy_hide_header Content-Security-Policy;
add_header X-Content-Type-Options "nosniff" always;
}
location /app/ollama/ {
proxy_pass http://127.0.0.1:11434/;
proxy_http_version 1.1;

11
image-recipe/configs/snippets/archipelago-https-app-proxies.conf
View File

@ -222,6 +222,17 @@ location /app/nostr-vpn/ {
add_header X-Frame-Options "SAMEORIGIN" always;
proxy_hide_header Content-Security-Policy;
}
location /app/fips/ {
proxy_pass http://127.0.0.1:8202/;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_hide_header X-Frame-Options;
add_header X-Frame-Options "SAMEORIGIN" always;
proxy_hide_header Content-Security-Policy;
}
location /app/ollama/ {
proxy_pass http://127.0.0.1:11434/;
proxy_http_version 1.1;

4
neode-ui/src/views/appSession/appSessionConfig.ts
View File

@ -39,6 +39,7 @@ export const APP_PORTS: Record<string, number> = {
'fedimint-gateway': 8176,
'nostr-rs-relay': 18081,
'nostr-vpn': 8201,
'fips': 8202,
'routstr': 8200,
'indeedhub': 7777,
'dwn': 3100,
@ -87,6 +88,7 @@ export const HTTPS_PROXY_PATHS: Record<string, string> = {
'indeedhub': '/app/indeedhub/',
'routstr': '/app/routstr/',
'nostr-vpn': '/app/nostr-vpn/',
'fips': '/app/fips/',
}
/** External HTTPS apps -- always loaded directly */
@ -104,7 +106,7 @@ export const EXTERNAL_URLS: Record<string, string> = {
export const APP_TITLES: Record<string, string> = {
'bitcoin-knots': 'Bitcoin', 'btcpay-server': 'BTCPay Server', 'indeedhub': 'Indeehub',
'botfights': 'BotFights', '484-kitchen': '484 Kitchen', 'arch-presentation': 'Presentation',
'nostr-vpn': 'Nostr VPN', 'routstr': 'Routstr',
'nostr-vpn': 'Nostr VPN', 'fips': 'FIPS', 'routstr': 'Routstr',
'homeassistant': 'Home Assistant', 'uptime-kuma': 'Uptime Kuma',
'nginx-proxy-manager': 'Nginx Proxy Manager', 'nostr-rs-relay': 'Nostr Relay',
'call-the-operator': 'Call The Operator', 'syntropy-institute': 'Syntropy Institute',

4
neode-ui/src/views/apps/appsConfig.ts
View File

@ -12,7 +12,7 @@ export const SERVICE_NAMES = new Set([
'mysql-mempool', 'mempool-api', 'archy-mempool-web',
'archy-bitcoin-ui', 'archy-lnd-ui', 'archy-electrs-ui',
'indeedhub-postgres', 'indeedhub-redis', 'indeedhub-minio',
'archy-nostr-vpn-ui',
'archy-nostr-vpn-ui', 'archy-fips-ui',
'indeedhub-api', 'indeedhub-ffmpeg',
'indeedhub-relay', 'indeedhub-build_api_1', 'indeedhub-build_ffmpeg-worker_1',
'indeedhub-build_postgres_1', 'indeedhub-build_redis_1', 'indeedhub-build_minio_1',
@ -40,7 +40,7 @@ export const APP_CATEGORY_MAP: Record<string, string> = {
'homeassistant': 'home', 'lorabell': 'home', 'endurain': 'home',
'searxng': 'community', 'ollama': 'community', 'grafana': 'data',
'nostr-rs-relay': 'nostr', 'nostrudel': 'nostr',
'nostr-vpn': 'networking', 'routstr': 'community',
'nostr-vpn': 'networking', 'fips': 'networking', 'routstr': 'community',
'tailscale': 'networking', 'nginx-proxy-manager': 'networking', 'portainer': 'networking',
'uptime-kuma': 'networking', 'dwn': 'data',
'botfights': 'l484', 'nwnn': 'l484', '484-kitchen': 'l484',

2
neode-ui/src/views/discover/curatedApps.ts
View File

@ -30,6 +30,7 @@ export function getCuratedAppList(): MarketplaceApp[] {
{ id: 'indeedhub', title: 'Indeehub', version: '0.1.0', description: 'Bitcoin documentary streaming with Nostr identity. Stream sovereignty content.', icon: '/assets/img/app-icons/indeedhub.png', author: 'Indeehub Team', dockerImage: 'localhost/indeedhub:latest', repoUrl: 'https://github.com/indeedhub/indeedhub' },
{ id: 'dwn', title: 'Decentralized Web Node', version: '0.4.0', description: 'Own your data with DID-based access control. Sync across devices, sovereign.', icon: '/assets/img/app-icons/dwn.svg', author: 'TBD', dockerImage: `${R}/dwn-server:main`, repoUrl: 'https://github.com/TBD54566975/dwn-server' },
{ id: 'nostr-vpn', title: 'Nostr VPN', version: '0.3.4', category: 'networking', description: 'Tailscale-style mesh VPN with Nostr control plane. Peer discovery and key exchange over relays, WireGuard tunnels.', icon: '/assets/img/app-icons/nostr-vpn.svg', author: 'Martti Malmi', dockerImage: `${R}/nostr-vpn:v0.3.4`, repoUrl: 'https://github.com/mmalmi/nostr-vpn' },
{ id: 'fips', title: 'FIPS', version: '0.1.0', category: 'networking', description: 'Free Internetworking Peering System. Self-organizing encrypted mesh network with Nostr identity.', icon: '/assets/img/app-icons/fips.svg', author: 'Jim Corgan', dockerImage: `${R}/fips:v0.1.0`, repoUrl: 'https://github.com/jmcorgan/fips' },
{ id: 'routstr', title: 'Routstr', version: '0.4.3', category: 'community', description: 'Decentralized AI inference proxy. Pay-per-request with Cashu ecash, provider discovery via Nostr.', icon: '/assets/img/app-icons/routstr.svg', author: 'Routstr', dockerImage: `${R}/routstr:v0.4.3`, repoUrl: 'https://github.com/routstr/routstr-core' },
{ id: 'nostrudel', title: 'noStrudel', version: '0.40.0', category: 'nostr', description: 'Feature-rich Nostr web client. Browse feeds, post notes, manage relays with NIP-07.', icon: '/assets/img/app-icons/nostrudel.svg', author: 'hzrd149', dockerImage: '', repoUrl: 'https://github.com/hzrd149/nostrudel', webUrl: 'https://nostrudel.ninja' },
{ id: 'botfights', title: 'BotFights', version: '1.0.0', description: 'AI bot arena — build, train, and battle autonomous agents in strategy tournaments.', icon: '/assets/img/app-icons/botfights.svg', author: 'BotFights', dockerImage: '', repoUrl: 'https://botfights.net', webUrl: 'https://botfights.net' },
@ -61,6 +62,7 @@ export const INSTALLED_ALIASES: Record<string, string[]> = {
tailscale: ['tailscale'],
ollama: ['ollama'],
'nostr-vpn': ['nostr-vpn'],
fips: ['fips'],
routstr: ['routstr'],
}

13
neode-ui/src/views/marketplace/marketplaceData.ts
View File

@ -55,6 +55,7 @@ export const INSTALLED_ALIASES: Record<string, string[]> = {
tailscale: ['tailscale'],
ollama: ['ollama'],
'nostr-vpn': ['nostr-vpn'],
fips: ['fips'],
routstr: ['routstr'],
}
@ -416,6 +417,18 @@ export function getCuratedAppList(): MarketplaceApp[] {
manifestUrl: undefined,
repoUrl: 'https://github.com/mmalmi/nostr-vpn'
},
{
id: 'fips',
title: 'FIPS',
version: '0.1.0',
category: 'networking',
description: 'Free Internetworking Peering System. Self-organizing encrypted mesh network with Nostr identity.',
icon: '/assets/img/app-icons/fips.svg',
author: 'Jim Corgan',
dockerImage: `${REGISTRY}/fips:v0.1.0`,
manifestUrl: undefined,
repoUrl: 'https://github.com/jmcorgan/fips'
},
{
id: 'routstr',
title: 'Routstr',

2
scripts/image-versions.sh
View File

@ -65,6 +65,8 @@ NOSTR_RS_RELAY_IMAGE="$ARCHY_REGISTRY/nostr-rs-relay:0.9.0"
STRFRY_IMAGE="$ARCHY_REGISTRY/strfry:1.0.4"
NOSTR_VPN_IMAGE="$ARCHY_REGISTRY/nostr-vpn:v0.3.4"
NOSTR_VPN_UI_IMAGE="$ARCHY_REGISTRY/nostr-vpn-ui:latest"
FIPS_IMAGE="$ARCHY_REGISTRY/fips:v0.1.0"
FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:latest"
# AI / Routing
ROUTSTR_IMAGE="$ARCHY_REGISTRY/routstr:v0.4.3"