feat(orchestrator): complete container migration and release hardening

apps/fedimint/manifest.yml

@@ -3,56 +3,62 @@ app:
   name: Fedimint
   version: 0.10.0
   description: Federated Bitcoin minting service with built-in Guardian UI. Privacy-preserving Bitcoin custody.
-  
+
   container:
-    image: fedimint/fedimintd:v0.10.0
-    image_signature: cosign://...
+    image: git.tx1138.com/lfg2025/fedimintd:v0.10.0
     pull_policy: if-not-present
-    
+    network: archy-net
+    derived_env:
+      - key: FM_P2P_URL
+        template: fedimint://{{HOST_MDNS}}:8173
+      - key: FM_API_URL
+        template: ws://{{HOST_MDNS}}:8174
+    secret_env:
+      - key: FM_BITCOIND_PASSWORD
+        secret_file: bitcoin-rpc-password
+    data_uid: "100000:100000"
+
   dependencies:
     - app_id: bitcoin-core
-      version: ">=24.0"
+      version: ">=26.0"
     - storage: 20Gi
-    
+
   resources:
     cpu_limit: 4
     memory_limit: 4Gi
     disk_limit: 20Gi
-    
+
   security:
     capabilities: []
     readonly_root: true
-    no_new_privileges: true
-    user: 1000
-    seccomp_profile: default
     network_policy: isolated
-    apparmor_profile: fedimint
-    
+
   ports:
     - host: 8173
       container: 8173
-      protocol: tcp  # P2P
+      protocol: tcp
     - host: 8174
       container: 8174
-      protocol: tcp  # API
+      protocol: tcp
     - host: 8175
       container: 8175
-      protocol: tcp  # Built-in Guardian UI
-    
+      protocol: tcp
+
   volumes:
     - type: bind
       source: /var/lib/archipelago/fedimint
-      target: /fedimint
+      target: /data
       options: [rw]
-      
+
   environment:
-    - FM_DATA_DIR=/fedimint
-    - FM_BITCOIND_URL=http://bitcoin-core:8332
-    - FM_BITCOIND_USERNAME=${BITCOIN_RPC_USER}
-    - FM_BITCOIND_PASSWORD=${BITCOIN_RPC_PASSWORD}
+    - FM_DATA_DIR=/data
+    - FM_BITCOIND_URL=http://bitcoin-knots:8332
+    - FM_BITCOIND_USERNAME=archipelago
     - FM_BITCOIN_NETWORK=bitcoin
+    - FM_BIND_P2P=0.0.0.0:8173
+    - FM_BIND_API=0.0.0.0:8174
     - FM_BIND_UI=0.0.0.0:8175
-    
+
   health_check:
     type: http
     endpoint: http://localhost:8175
@@ -60,7 +66,7 @@ app:
     interval: 30s
     timeout: 5s
     retries: 3
-    
+
   bitcoin_integration:
     rpc_access: admin
     sync_required: true