feat(security): declare port auth policy across the app manifests

lfg2025/archy

20 HTTP UIs move to bind: 127.0.0.1 + auth: gated (the daemon owns their
external addresses and authenticates every connection); 5 loopback-only
backends declare auth: local so the gate keeps its hands off. Protocol
ports (LND, bitcoin p2p, electrum, CLN, gitea SSH, Wyoming, mDNS/SSDP)
were already declared auth: none with rationales in earlier commits.

Inert until the catalog is re-signed: nodes act only on declared fields
delivered via the signed catalog, and the catalog overlay overrides these
disk manifests everywhere they are installed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

This commit is contained in:

archipelago

2026-08-04 06:09:37 -04:00

co-authored by

Claude Fable 5

parent 4e455167e9

commit 16642ad8b8

25 changed files with 50 additions and 0 deletions

									
										apps/photoprism/manifest.yml
									
		+2
		
												View File
												
				@@ -24,6 +24,8 @@ app:

				    - host: 2342

				      container: 2342

				      protocol: tcp

				      bind: 127.0.0.1

				      auth: gated

				  volumes:

				    - type: bind