lfg2025/archy
1
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases 3 Wiki Activity

fix: container install flow, filebrowser auth, AppCard enrichment

Browse Source 
- Fix .198-style fresh installs: systemd service ExecStartPre creates
  /run/user/1000, enable podman.socket, chmod 644 /etc/hosts
- Filebrowser: add /data volume for database (fixes read-only crash),
  secure auth with random password via backend RPC (no more admin/admin)
- AppCard: enrich installing state with marketplace metadata (icon,
  title, description, tier badge, author, version)
- Registry: btcpayserver 1.13.5 → 1.13.7, images mirrored
- ReadWritePaths: add home container paths for rootless podman

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Dorian
2026-03-27 13:32:54 +00:00
co-authored by Claude Opus 4.6
parent bc5121b33f
commit 320c9f5b19
14 changed files with 215 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
image-recipe/archipelago-scripts/install-to-disk.sh
+1
View File
@@ -142,6 +142,7 @@ cat > /mnt/archipelago/etc/hosts <<EOF
::1 localhost ip6-localhost ip6-loopback
EOF
chmod 644 /mnt/archipelago/etc/hosts
# Install bootloader and essential packages in chroot
echo "📦 Configuring package sources..."
image-recipe/build-auto-installer-iso.sh
+1
View File
@@ -1324,6 +1324,7 @@ cat > /mnt/target/etc/hosts <<EOF
127.0.1.1 archipelago
::1 localhost ip6-localhost ip6-loopback
EOF
chmod 644 /mnt/target/etc/hosts
# Configure Archipelago app registry (HTTP, insecure)
mkdir -p /mnt/target/home/archipelago/.config/containers
image-recipe/configs/archipelago.service
+2 -1
View File
@@ -9,6 +9,7 @@ User=archipelago
Environment="ARCHIPELAGO_BIND=127.0.0.1:5678"
# DEV_MODE disabled in production — enabled via override.conf on dev servers
Environment="XDG_RUNTIME_DIR=/run/user/1000"
ExecStartPre=/bin/bash -c 'mkdir -p /run/user/1000 && chown archipelago:archipelago /run/user/1000 && chmod 700 /run/user/1000'
ExecStartPre=/bin/bash -c 'mkdir -p /var/lib/archipelago && echo "ARCHIPELAGO_HOST_IP=$(hostname -I 2>/dev/null | awk "{print $$1}")" > /var/lib/archipelago/host-ip.env'
ExecStart=/usr/local/bin/archipelago
Restart=on-failure
@@ -22,7 +23,7 @@ ProtectSystem=strict
ProtectHome=no
# PrivateTmp disabled: rootless podman runtime lives in /tmp/podman-run-UID/
# and must be shared between the service and SSH-created containers
ReadWritePaths=/var/lib/archipelago /etc/containers /var/lib/containers /run/containers /run/user /tmp
ReadWritePaths=/var/lib/archipelago /etc/containers /var/lib/containers /run/containers /run/user /tmp /home/archipelago/.local/share/containers /home/archipelago/.config/containers /etc
# Privilege restriction — restored with rootless podman (no sudo needed)
NoNewPrivileges=yes
image-recipe/scripts/install-podman.sh
+9
View File
@@ -52,6 +52,15 @@ mkdir -p /home/archipelago/.config/systemd/user
# Enable lingering for archipelago user (allows user services to run without login)
loginctl enable-linger archipelago || true
# Ensure /run/user/1000 exists for podman socket
mkdir -p /run/user/1000
chown archipelago:archipelago /run/user/1000
chmod 700 /run/user/1000
# Enable podman API socket for archipelago user (backend connects via this)
su - archipelago -c "XDG_RUNTIME_DIR=/run/user/1000 systemctl --user enable podman.socket" || true
su - archipelago -c "XDG_RUNTIME_DIR=/run/user/1000 systemctl --user start podman.socket" || true
# Set proper permissions
chown -R archipelago:archipelago /home/archipelago/.config
chown -R archipelago:archipelago /home/archipelago/.local