feat: standalone WireGuard from first install, fix networking stack
Standalone WireGuard (wg0:51820): - New archipelago-wg.service creates wg0 independent of NostrVPN - Keypair generated on first-boot, persisted on LUKS partition - vpn.create-peer uses wg genkey/pubkey (no nvpn dependency) - wg-address service depends on archipelago-wg, not nostr-vpn Networking fixes: - Remove nos.lol from default relays (requires PoW, events rejected) - Add Tor hidden service for private relay (port 7777) — NAT'd peers can reach relay over Tor for NostrVPN signaling - Fix Tor hostname sync race: wait loop before copying hostname files - Add tor-hostnames + wireguard dirs to LUKS partition setup - Include relay in hostname sync loops (setup-tor.sh + first-boot) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Dorian
co-authored by
Claude Opus 4.6
Claude Opus 4.6
parent
a029a4c948
commit
b30f41f3d7
@@ -1,25 +1,16 @@
|
||||
# CLAUDE.md — Archipelago (Archy)
|
||||
|
||||
## Overview
|
||||
|
||||
Archipelago is a **Bitcoin Node OS** — bootable, self-sovereign personal server. Flash to USB, install on hardware, manage via web UI.
|
||||
|
||||
**Stack**: Rust backend + Vue 3 + TypeScript (strict) + Vite 7 + Tailwind + Pinia + Podman on Debian 12
|
||||
**Version**: 1.3.0 | **Target**: x86_64 and ARM64
|
||||
|
||||
---
|
||||
|
||||
## Beta Freeze (2026-03-18)
|
||||
|
||||
**Phase 1: Feature Testing (internal) — WE ARE HERE**
|
||||
|
||||
Feature set is LOCKED. Only: bug fixes, security hardening, ISO build fixes, UI polish, testing.
|
||||
No new features, no new apps, no new deps, no scope creep.
|
||||
|
||||
Phase 1: Feature Testing (internal). Feature set is locked.
|
||||
Only: bug fixes, security hardening, ISO build fixes, UI polish, testing.
|
||||
Track: `docs/BETA-PROGRESS.md` | Checklist: `docs/BETA-RELEASE-CHECKLIST.md`
|
||||
|
||||
---
|
||||
|
||||
## Quick Reference
|
||||
|
||||
```bash
|
||||
@@ -28,19 +19,6 @@ cd neode-ui && npm run build # Build (outputs to web/dist/neode-ui/)
|
||||
./scripts/deploy-to-target.sh --live # Deploy to live server (.228)
|
||||
```
|
||||
|
||||
## Infrastructure
|
||||
|
||||
| What | Where |
|
||||
|------|-------|
|
||||
| Dev server | `192.168.1.228` (SSH key: `~/.ssh/archipelago-deploy`) |
|
||||
| Secondary | `192.168.1.198` |
|
||||
| Git remote | `git.tx1138.com` (remote name: `tx1138`) |
|
||||
| App registry | `80.71.235.15:3000/archipelago/` (HTTP, insecure) |
|
||||
| CI runner | act_runner on .228, workflow: `.gitea/workflows/build-iso.yml` |
|
||||
| ISO builds | FileBrowser at `http://192.168.1.228:8083` → Builds/ |
|
||||
| SSH creds | Gitignored `scripts/deploy-config.sh` |
|
||||
| Web password | `password123` |
|
||||
|
||||
## Architecture
|
||||
|
||||
```
|
||||
@@ -48,75 +26,22 @@ Debian 12
|
||||
├── Podman (rootless, user archipelago)
|
||||
├── Nginx (80/443 → backend, app proxies)
|
||||
├── Rust Backend (core/) on 127.0.0.1:5678
|
||||
│ ├── core/archipelago/ — Binary, RPC, auth, sessions
|
||||
│ └── core/container/ — PodmanClient, manifests, health
|
||||
└── Vue.js UI (neode-ui/)
|
||||
├── src/api/rpc-client.ts — All backend communication
|
||||
├── src/stores/ — Pinia state
|
||||
├── src/views/ — Pages
|
||||
└── src/style.css — ALL styling (global classes only)
|
||||
```
|
||||
|
||||
**Data paths**: `/var/lib/archipelago/{app-id}/` (data), `/opt/archipelago/web-ui/` (frontend), `/usr/local/bin/archipelago` (binary)
|
||||
|
||||
## Critical Rules
|
||||
|
||||
1. **Never build Rust on macOS** — deploy script handles cross-compilation via rsync + remote build
|
||||
2. **Always deploy after changes** — `./scripts/deploy-to-target.sh --live`
|
||||
3. **Frontend builds to `web/dist/neode-ui/`** — not `neode-ui/dist/`
|
||||
4. **Container images**: `scripts/image-versions.sh` is the single source of truth. All scripts use `$*_IMAGE` variables, never hardcoded registry paths.
|
||||
5. **Type-check before committing** — `cd neode-ui && npx vue-tsc -b --noEmit`
|
||||
|
||||
## Frontend
|
||||
|
||||
- `<script setup lang="ts">` always — no Options API
|
||||
- Global CSS in `style.css` — **never inline Tailwind**
|
||||
- `.glass-button` for ALL buttons — `.gradient-button` is BANNED
|
||||
- `.glass-card` for containers, `.path-option-card` for interactive cards
|
||||
- `translateZ(0)` + `isolation: isolate` on glass elements (Chromium compositor fix)
|
||||
- Pinia for state, typed RPC client, handle loading/error/empty states
|
||||
|
||||
## Backend (Rust)
|
||||
|
||||
- No `unwrap()`/`expect()` — use `?` with `.context()`
|
||||
- `tracing` for logging, never `println!` or log secrets
|
||||
- Backend binds `127.0.0.1` only — nginx handles external access
|
||||
- Validate all input before path construction — reject `..`, `/`, null bytes
|
||||
- `tokio` runtime, timeouts on all external ops
|
||||
|
||||
## Security (Post-Pentest)
|
||||
|
||||
- RBAC: explicit method allowlists, never prefix matching
|
||||
- Session cookies: `SameSite=Lax; HttpOnly; Path=/`
|
||||
- Rate-limit auth endpoints, rotate tokens after privilege escalation
|
||||
- Validate redirect URLs with `isLocalRedirect()`, never `v-html` with user input
|
||||
- Container security: drop ALL caps, add only required, `no-new-privileges`, memory limits, health checks
|
||||
- See `.claude/rules/` for detailed crypto, API, container, and Bitcoin rules
|
||||
|
||||
## ISO Build & CI
|
||||
|
||||
CI builds on every push to `main` via git.tx1138.com Actions.
|
||||
|
||||
```bash
|
||||
# Manual build on .228:
|
||||
ssh archipelago@192.168.1.228
|
||||
cd ~/archy/image-recipe
|
||||
sudo UNBUNDLED=1 DEV_SERVER=localhost BUILD_FROM_SOURCE=0 ./build-auto-installer-iso.sh
|
||||
```
|
||||
|
||||
**Debugging fresh installs** — SSH in and check:
|
||||
```bash
|
||||
cat /var/log/archipelago-install.log # Full installer output
|
||||
cat /var/log/archipelago-first-boot-diagnostics.log # Service status, nginx, LUKS, etc.
|
||||
sudo archipelago-diagnostics # Re-run diagnostics anytime
|
||||
```
|
||||
|
||||
**Kiosk**: X11 on VT7, console on VT1. `Ctrl+Alt+F1` for terminal, `Ctrl+Alt+F7` for kiosk.
|
||||
Toggle: `sudo archipelago-kiosk enable|disable|toggle`
|
||||
1. Do not build Rust on macOS — deploy script handles cross-compilation via rsync + remote build.
|
||||
2. Always deploy after changes — `./scripts/deploy-to-target.sh --live`
|
||||
3. Frontend builds to `web/dist/neode-ui/` — not `neode-ui/dist/`
|
||||
4. Container images: `scripts/image-versions.sh` is the single source of truth. All scripts use `$*_IMAGE` variables, not hardcoded registry paths.
|
||||
5. Type-check before committing — `cd neode-ui && npx vue-tsc -b --noEmit`
|
||||
|
||||
## App Integration Checklist
|
||||
|
||||
When adding/fixing apps, check ALL of these:
|
||||
When adding/fixing apps, check all of these:
|
||||
- `core/archipelago/src/api/rpc/package/` — config, capabilities, deps
|
||||
- `neode-ui/src/views/marketplace/marketplaceData.ts` — marketplace entry
|
||||
- `image-recipe/configs/nginx-archipelago.conf` — proxy rules (HTTP + HTTPS)
|
||||
@@ -128,3 +53,7 @@ When adding/fixing apps, check ALL of these:
|
||||
|
||||
Commits: `type: description` (`feat:`, `fix:`, `docs:`, `refactor:`, `test:`, `chore:`, `perf:`)
|
||||
Push to: `git push tx1138 main`
|
||||
|
||||
## Compact Instructions
|
||||
|
||||
When compacting, preserve: list of modified files, test results, deploy target state, current branch, infrastructure IPs.
|
||||
|
||||
Reference in New Issue
Block a user