From 0aefacf3b9a0b4dfb7577d818fe10a18f9ba2fc1 Mon Sep 17 00:00:00 2001 From: Dorian Date: Tue, 7 Apr 2026 14:51:13 +0100 Subject: [PATCH] fix: restore FIPS as installable container app FIPS stays in the marketplace as an installable container app. NostrVPN is the native system service; FIPS is a separate optional app. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../archipelago/src/api/rpc/package/config.rs | 28 +++++++++++++++++-- .../src/api/rpc/package/install.rs | 19 ++++++++++--- image-recipe/configs/nginx-archipelago.conf | 12 ++++++++ .../archipelago-https-app-proxies.conf | 11 ++++++++ .../src/views/appSession/appSessionConfig.ts | 4 ++- neode-ui/src/views/apps/appsConfig.ts | 4 +-- neode-ui/src/views/discover/curatedApps.ts | 2 ++ .../src/views/marketplace/marketplaceData.ts | 13 +++++++++ scripts/image-versions.sh | 2 ++ 9 files changed, 86 insertions(+), 9 deletions(-) diff --git a/core/archipelago/src/api/rpc/package/config.rs b/core/archipelago/src/api/rpc/package/config.rs index b050ab57..b8525ae9 100644 --- a/core/archipelago/src/api/rpc/package/config.rs +++ b/core/archipelago/src/api/rpc/package/config.rs @@ -124,9 +124,9 @@ pub(super) fn get_app_capabilities(app_id: &str) -> Vec { "--cap-add=DAC_OVERRIDE".to_string(), "--cap-add=NET_BIND_SERVICE".to_string(), ], - // Nostr VPN: mesh networking needs TUN + NET_ADMIN + // Nostr VPN and FIPS: mesh networking daemons need TUN + NET_ADMIN // Note: --device=/dev/net/tun is added separately in install.rs - "nostr-vpn" => vec![ + "nostr-vpn" | "fips" => vec![ "--cap-add=NET_ADMIN".to_string(), "--cap-add=NET_RAW".to_string(), ], @@ -251,6 +251,7 @@ pub(super) fn get_health_check_args(app_id: &str, _rpc_pass: &str) -> Vec ("nvpn status || exit 1", "30s", "3"), + "fips" => ("fipsctl status || exit 1", "30s", "3"), _ => return vec![], }; @@ -293,6 +294,7 @@ pub(super) fn get_memory_limit(app_id: &str) -> &'static str { "nostr-rs-relay" | "nostr-relay" => "256m", "routstr" => "512m", "nostr-vpn" => "256m", + "fips" => "256m", "nginx-proxy-manager" => "256m", // Databases "archy-btcpay-db" | "archy-mempool-db" | "mysql-mempool" => "512m", @@ -358,6 +360,7 @@ pub(super) fn all_container_names(package_id: &str) -> Vec { "penpot-backend".into(), "penpot-exporter".into(), "penpot-frontend".into(), ], "nostr-vpn" => vec!["nostr-vpn".into(), "archy-nostr-vpn".into(), "archy-nostr-vpn-ui".into()], + "fips" => vec!["fips".into(), "archy-fips".into(), "archy-fips-ui".into()], "routstr" => vec!["routstr".into(), "archy-routstr".into()], // Default: exact name + archy- prefix _ => vec![base, archy], @@ -834,6 +837,27 @@ pub(super) async fn get_app_config( None, ) } + "fips" => { + let nsec = read_nostr_secret_hex(); + let mut env = vec![]; + if !nsec.is_empty() { + env.push(format!("FIPS_NSEC={}", nsec)); + env.push(format!("FIPS_NPUB={}", read_nostr_pubkey_hex())); + } + ( + vec![ + "2121:2121/udp".to_string(), + "8443:8443".to_string(), + ], + vec![ + "/var/lib/archipelago/fips/config:/etc/fips".to_string(), + "/var/lib/archipelago/fips/run:/run/fips".to_string(), + ], + env, + None, + None, + ) + } "dwn" => ( vec!["3100:3000".to_string()], vec!["/var/lib/archipelago/dwn:/dwn/data".to_string()], diff --git a/core/archipelago/src/api/rpc/package/install.rs b/core/archipelago/src/api/rpc/package/install.rs index 36971ef9..956439b8 100644 --- a/core/archipelago/src/api/rpc/package/install.rs +++ b/core/archipelago/src/api/rpc/package/install.rs @@ -226,7 +226,7 @@ impl RpcHandler { } // TUN device for mesh networking apps - if package_id == "nostr-vpn" { + if matches!(package_id, "nostr-vpn" | "fips") { run_args.push("--device=/dev/net/tun"); } @@ -265,13 +265,21 @@ impl RpcHandler { } // Pre-install: write Nostr identity key files for headless Nostr-aware apps - if package_id == "nostr-vpn" { + if matches!(package_id, "nostr-vpn" | "fips") { let nostr_secret = std::fs::read_to_string("/var/lib/archipelago/identity/nostr_secret") .map(|s| s.trim().to_string()) .unwrap_or_default(); if !nostr_secret.is_empty() { - let key_dir = "/var/lib/archipelago/nostr-vpn"; - let key_path = format!("{}/nostr_secret", key_dir); + let key_dir = match package_id { + "nostr-vpn" => "/var/lib/archipelago/nostr-vpn", + "fips" => "/var/lib/archipelago/fips/config", + _ => unreachable!(), + }; + let key_path = match package_id { + "nostr-vpn" => format!("{}/nostr_secret", key_dir), + "fips" => format!("{}/fips.key", key_dir), + _ => unreachable!(), + }; tokio::fs::create_dir_all(key_dir).await.ok(); tokio::fs::write(&key_path, &nostr_secret).await.ok(); // Restrict permissions on key file @@ -856,6 +864,9 @@ autopilot.active=false\n", "nostr-vpn" => { vec![("archy-nostr-vpn-ui", "/opt/archipelago/docker/nostr-vpn-ui", "nostr-vpn-ui")] } + "fips" => { + vec![("archy-fips-ui", "/opt/archipelago/docker/fips-ui", "fips-ui")] + } _ => vec![], }; diff --git a/image-recipe/configs/nginx-archipelago.conf b/image-recipe/configs/nginx-archipelago.conf index 39ec29cf..b5669a47 100644 --- a/image-recipe/configs/nginx-archipelago.conf +++ b/image-recipe/configs/nginx-archipelago.conf @@ -541,6 +541,18 @@ server { proxy_hide_header Content-Security-Policy; add_header X-Content-Type-Options "nosniff" always; } + location /app/fips/ { + proxy_pass http://127.0.0.1:8202/; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_hide_header X-Frame-Options; + add_header X-Frame-Options "SAMEORIGIN" always; + proxy_hide_header Content-Security-Policy; + add_header X-Content-Type-Options "nosniff" always; + } location /app/ollama/ { proxy_pass http://127.0.0.1:11434/; proxy_http_version 1.1; diff --git a/image-recipe/configs/snippets/archipelago-https-app-proxies.conf b/image-recipe/configs/snippets/archipelago-https-app-proxies.conf index f2eb0917..4215c64e 100644 --- a/image-recipe/configs/snippets/archipelago-https-app-proxies.conf +++ b/image-recipe/configs/snippets/archipelago-https-app-proxies.conf @@ -222,6 +222,17 @@ location /app/nostr-vpn/ { add_header X-Frame-Options "SAMEORIGIN" always; proxy_hide_header Content-Security-Policy; } +location /app/fips/ { + proxy_pass http://127.0.0.1:8202/; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_hide_header X-Frame-Options; + add_header X-Frame-Options "SAMEORIGIN" always; + proxy_hide_header Content-Security-Policy; +} location /app/ollama/ { proxy_pass http://127.0.0.1:11434/; proxy_http_version 1.1; diff --git a/neode-ui/src/views/appSession/appSessionConfig.ts b/neode-ui/src/views/appSession/appSessionConfig.ts index 3475692b..c3609db0 100644 --- a/neode-ui/src/views/appSession/appSessionConfig.ts +++ b/neode-ui/src/views/appSession/appSessionConfig.ts @@ -39,6 +39,7 @@ export const APP_PORTS: Record = { 'fedimint-gateway': 8176, 'nostr-rs-relay': 18081, 'nostr-vpn': 8201, + 'fips': 8202, 'routstr': 8200, 'indeedhub': 7777, 'dwn': 3100, @@ -87,6 +88,7 @@ export const HTTPS_PROXY_PATHS: Record = { 'indeedhub': '/app/indeedhub/', 'routstr': '/app/routstr/', 'nostr-vpn': '/app/nostr-vpn/', + 'fips': '/app/fips/', } /** External HTTPS apps -- always loaded directly */ @@ -104,7 +106,7 @@ export const EXTERNAL_URLS: Record = { export const APP_TITLES: Record = { 'bitcoin-knots': 'Bitcoin', 'btcpay-server': 'BTCPay Server', 'indeedhub': 'Indeehub', 'botfights': 'BotFights', '484-kitchen': '484 Kitchen', 'arch-presentation': 'Presentation', - 'nostr-vpn': 'Nostr VPN', 'routstr': 'Routstr', + 'nostr-vpn': 'Nostr VPN', 'fips': 'FIPS', 'routstr': 'Routstr', 'homeassistant': 'Home Assistant', 'uptime-kuma': 'Uptime Kuma', 'nginx-proxy-manager': 'Nginx Proxy Manager', 'nostr-rs-relay': 'Nostr Relay', 'call-the-operator': 'Call The Operator', 'syntropy-institute': 'Syntropy Institute', diff --git a/neode-ui/src/views/apps/appsConfig.ts b/neode-ui/src/views/apps/appsConfig.ts index 5c925760..27b835ee 100644 --- a/neode-ui/src/views/apps/appsConfig.ts +++ b/neode-ui/src/views/apps/appsConfig.ts @@ -12,7 +12,7 @@ export const SERVICE_NAMES = new Set([ 'mysql-mempool', 'mempool-api', 'archy-mempool-web', 'archy-bitcoin-ui', 'archy-lnd-ui', 'archy-electrs-ui', 'indeedhub-postgres', 'indeedhub-redis', 'indeedhub-minio', - 'archy-nostr-vpn-ui', + 'archy-nostr-vpn-ui', 'archy-fips-ui', 'indeedhub-api', 'indeedhub-ffmpeg', 'indeedhub-relay', 'indeedhub-build_api_1', 'indeedhub-build_ffmpeg-worker_1', 'indeedhub-build_postgres_1', 'indeedhub-build_redis_1', 'indeedhub-build_minio_1', @@ -40,7 +40,7 @@ export const APP_CATEGORY_MAP: Record = { 'homeassistant': 'home', 'lorabell': 'home', 'endurain': 'home', 'searxng': 'community', 'ollama': 'community', 'grafana': 'data', 'nostr-rs-relay': 'nostr', 'nostrudel': 'nostr', - 'nostr-vpn': 'networking', 'routstr': 'community', + 'nostr-vpn': 'networking', 'fips': 'networking', 'routstr': 'community', 'tailscale': 'networking', 'nginx-proxy-manager': 'networking', 'portainer': 'networking', 'uptime-kuma': 'networking', 'dwn': 'data', 'botfights': 'l484', 'nwnn': 'l484', '484-kitchen': 'l484', diff --git a/neode-ui/src/views/discover/curatedApps.ts b/neode-ui/src/views/discover/curatedApps.ts index ad1fa063..970b2d91 100644 --- a/neode-ui/src/views/discover/curatedApps.ts +++ b/neode-ui/src/views/discover/curatedApps.ts @@ -30,6 +30,7 @@ export function getCuratedAppList(): MarketplaceApp[] { { id: 'indeedhub', title: 'Indeehub', version: '0.1.0', description: 'Bitcoin documentary streaming with Nostr identity. Stream sovereignty content.', icon: '/assets/img/app-icons/indeedhub.png', author: 'Indeehub Team', dockerImage: 'localhost/indeedhub:latest', repoUrl: 'https://github.com/indeedhub/indeedhub' }, { id: 'dwn', title: 'Decentralized Web Node', version: '0.4.0', description: 'Own your data with DID-based access control. Sync across devices, sovereign.', icon: '/assets/img/app-icons/dwn.svg', author: 'TBD', dockerImage: `${R}/dwn-server:main`, repoUrl: 'https://github.com/TBD54566975/dwn-server' }, { id: 'nostr-vpn', title: 'Nostr VPN', version: '0.3.4', category: 'networking', description: 'Tailscale-style mesh VPN with Nostr control plane. Peer discovery and key exchange over relays, WireGuard tunnels.', icon: '/assets/img/app-icons/nostr-vpn.svg', author: 'Martti Malmi', dockerImage: `${R}/nostr-vpn:v0.3.4`, repoUrl: 'https://github.com/mmalmi/nostr-vpn' }, + { id: 'fips', title: 'FIPS', version: '0.1.0', category: 'networking', description: 'Free Internetworking Peering System. Self-organizing encrypted mesh network with Nostr identity.', icon: '/assets/img/app-icons/fips.svg', author: 'Jim Corgan', dockerImage: `${R}/fips:v0.1.0`, repoUrl: 'https://github.com/jmcorgan/fips' }, { id: 'routstr', title: 'Routstr', version: '0.4.3', category: 'community', description: 'Decentralized AI inference proxy. Pay-per-request with Cashu ecash, provider discovery via Nostr.', icon: '/assets/img/app-icons/routstr.svg', author: 'Routstr', dockerImage: `${R}/routstr:v0.4.3`, repoUrl: 'https://github.com/routstr/routstr-core' }, { id: 'nostrudel', title: 'noStrudel', version: '0.40.0', category: 'nostr', description: 'Feature-rich Nostr web client. Browse feeds, post notes, manage relays with NIP-07.', icon: '/assets/img/app-icons/nostrudel.svg', author: 'hzrd149', dockerImage: '', repoUrl: 'https://github.com/hzrd149/nostrudel', webUrl: 'https://nostrudel.ninja' }, { id: 'botfights', title: 'BotFights', version: '1.0.0', description: 'AI bot arena — build, train, and battle autonomous agents in strategy tournaments.', icon: '/assets/img/app-icons/botfights.svg', author: 'BotFights', dockerImage: '', repoUrl: 'https://botfights.net', webUrl: 'https://botfights.net' }, @@ -61,6 +62,7 @@ export const INSTALLED_ALIASES: Record = { tailscale: ['tailscale'], ollama: ['ollama'], 'nostr-vpn': ['nostr-vpn'], + fips: ['fips'], routstr: ['routstr'], } diff --git a/neode-ui/src/views/marketplace/marketplaceData.ts b/neode-ui/src/views/marketplace/marketplaceData.ts index 6c02e8ad..55585b63 100644 --- a/neode-ui/src/views/marketplace/marketplaceData.ts +++ b/neode-ui/src/views/marketplace/marketplaceData.ts @@ -55,6 +55,7 @@ export const INSTALLED_ALIASES: Record = { tailscale: ['tailscale'], ollama: ['ollama'], 'nostr-vpn': ['nostr-vpn'], + fips: ['fips'], routstr: ['routstr'], } @@ -416,6 +417,18 @@ export function getCuratedAppList(): MarketplaceApp[] { manifestUrl: undefined, repoUrl: 'https://github.com/mmalmi/nostr-vpn' }, + { + id: 'fips', + title: 'FIPS', + version: '0.1.0', + category: 'networking', + description: 'Free Internetworking Peering System. Self-organizing encrypted mesh network with Nostr identity.', + icon: '/assets/img/app-icons/fips.svg', + author: 'Jim Corgan', + dockerImage: `${REGISTRY}/fips:v0.1.0`, + manifestUrl: undefined, + repoUrl: 'https://github.com/jmcorgan/fips' + }, { id: 'routstr', title: 'Routstr', diff --git a/scripts/image-versions.sh b/scripts/image-versions.sh index 5d632959..d937a3ee 100644 --- a/scripts/image-versions.sh +++ b/scripts/image-versions.sh @@ -65,6 +65,8 @@ NOSTR_RS_RELAY_IMAGE="$ARCHY_REGISTRY/nostr-rs-relay:0.9.0" STRFRY_IMAGE="$ARCHY_REGISTRY/strfry:1.0.4" NOSTR_VPN_IMAGE="$ARCHY_REGISTRY/nostr-vpn:v0.3.4" NOSTR_VPN_UI_IMAGE="$ARCHY_REGISTRY/nostr-vpn-ui:latest" +FIPS_IMAGE="$ARCHY_REGISTRY/fips:v0.1.0" +FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:latest" # AI / Routing ROUTSTR_IMAGE="$ARCHY_REGISTRY/routstr:v0.4.3"