Archipelago — open-source initial import

core/archipelago/src/config.rs

@@ -80,19 +80,11 @@ pub struct Config {
 }
 
 impl Config {
-    /// Detect primary host IP (first non-loopback IPv4)
+    /// Detect primary host IP (default-route interface, not `hostname -I` order)
     async fn detect_host_ip() -> Result<String> {
-        let output = tokio::process::Command::new("hostname")
+        Ok(crate::host_ip::primary_host_ipv4()
-            .args(["-I"])
-            .output()
             .await
-            .context("Failed to run hostname -I")?;
+            .unwrap_or_else(|| "127.0.0.1".to_string()))
-        let s = String::from_utf8_lossy(&output.stdout);
-        let ip = s
-            .split_whitespace()
-            .find(|s| !s.starts_with("127.") && s.contains('.'))
-            .unwrap_or("127.0.0.1");
-        Ok(ip.to_string())
     }
 
     pub async fn load() -> Result<Self> {

core/archipelago/src/container/docker_packages.rs

@@ -696,22 +696,11 @@ async fn netbird_configured_launch_url() -> Option<String> {
     PodmanClient::lan_address_for("netbird")
 }
 
-/// First address from `hostname -I` — the node's primary host IP. Mirrors the
+/// The node's primary host IP. Mirrors the orchestrator's `detect_host_ip`
-/// orchestrator's `detect_host_ip` so launch URLs match the cert/config the
+/// so launch URLs match the cert/config the orchestrator renders for
-/// orchestrator renders for `{{HOST_IP}}`.
+/// `{{HOST_IP}}`.
 async fn first_host_ip() -> Option<String> {
-    let out = tokio::process::Command::new("hostname")
+    crate::host_ip::primary_host_ipv4().await
-        .arg("-I")
-        .output()
-        .await
-        .ok()?;
-    if !out.status.success() {
-        return None;
-    }
-    String::from_utf8_lossy(&out.stdout)
-        .split_whitespace()
-        .next()
-        .map(ToOwned::to_owned)
 }
 
 async fn reachable_lan_address(app_id: &str, candidate: Option<String>) -> Option<String> {

core/archipelago/src/container/prod_orchestrator.rs

@@ -3087,16 +3087,7 @@ impl ProdContainerOrchestrator {
     }
 
     async fn detect_host_ip() -> Option<String> {
-        let output = tokio::process::Command::new("hostname")
+        crate::host_ip::primary_host_ipv4().await
-            .arg("-I")
-            .output()
-            .await
-            .ok()?;
-        if !output.status.success() {
-            return None;
-        }
-        let stdout = String::from_utf8_lossy(&output.stdout);
-        stdout.split_whitespace().next().map(|s| s.to_string())
     }
 
     async fn detect_host_mdns() -> String {

core/archipelago/src/host_ip.rs

@@ -0,0 +1,135 @@
+//! Primary host LAN IPv4 detection.
+//!
+//! `hostname -I` lists addresses in interface-creation order, so once a VPN
+//! or bridge interface exists (NetBird's WireGuard tunnel, br-tollgate, …)
+//! its address can sort ahead of the real NIC — a fresh-ISO node handed out
+//! `https://10.44.0.1:8087` as NetBird's launch URL instead of the LAN IP.
+//! The main routing table's default route names the physical uplink even when
+//! a VPN is active (NetBird/Tailscale steer traffic via policy-routing rules
+//! in separate tables, not by replacing the main-table default), so that is
+//! the authoritative source, with `hostname -I` kept only as the last resort
+//! for hosts with no default route at all.
+
+/// The node's primary LAN IPv4, as a string.
+///
+/// Resolution order:
+/// 1. `src`/`dev` of the main-table default route (`ip -4 route show default`)
+/// 2. source address of a connected UDP socket (never transmits)
+/// 3. first non-loopback IPv4 from `hostname -I` (legacy behaviour)
+pub(crate) async fn primary_host_ipv4() -> Option<String> {
+    if let Some(ip) = default_route_ip().await {
+        return Some(ip);
+    }
+    if let Some(ip) = udp_route_ip() {
+        return Some(ip);
+    }
+    hostname_i_ip().await
+}
+
+async fn default_route_ip() -> Option<String> {
+    let out = tokio::process::Command::new("ip")
+        .args(["-4", "route", "show", "default"])
+        .output()
+        .await
+        .ok()?;
+    if !out.status.success() {
+        return None;
+    }
+    let route = String::from_utf8_lossy(&out.stdout);
+    if let Some(ip) = parse_route_src(&route) {
+        return Some(ip);
+    }
+    // No `src` hint on the route — resolve the device's global address.
+    let dev = parse_route_dev(&route)?;
+    let out = tokio::process::Command::new("ip")
+        .args(["-4", "-o", "addr", "show", "dev", &dev, "scope", "global"])
+        .output()
+        .await
+        .ok()?;
+    if !out.status.success() {
+        return None;
+    }
+    parse_addr_inet(&String::from_utf8_lossy(&out.stdout))
+}
+
+fn parse_route_src(route: &str) -> Option<String> {
+    field_after(route.lines().next()?, "src")
+}
+
+fn parse_route_dev(route: &str) -> Option<String> {
+    field_after(route.lines().next()?, "dev")
+}
+
+fn field_after(line: &str, key: &str) -> Option<String> {
+    let mut words = line.split_whitespace();
+    while let Some(w) = words.next() {
+        if w == key {
+            return words.next().map(ToOwned::to_owned);
+        }
+    }
+    None
+}
+
+fn parse_addr_inet(out: &str) -> Option<String> {
+    let cidr = field_after(out.lines().next()?, "inet")?;
+    Some(cidr.split('/').next().unwrap_or(&cidr).to_string())
+}
+
+/// A connected UDP socket's local address is the source IP the kernel would
+/// use to reach the peer; nothing is sent. Can still land on a tunnel IP when
+/// a VPN policy-routes all traffic, hence only a fallback.
+fn udp_route_ip() -> Option<String> {
+    let sock = std::net::UdpSocket::bind("0.0.0.0:0").ok()?;
+    sock.connect("8.8.8.8:80").ok()?;
+    match sock.local_addr().ok()?.ip() {
+        std::net::IpAddr::V4(v4) if !v4.is_loopback() && !v4.is_unspecified() => {
+            Some(v4.to_string())
+        }
+        _ => None,
+    }
+}
+
+async fn hostname_i_ip() -> Option<String> {
+    let out = tokio::process::Command::new("hostname")
+        .arg("-I")
+        .output()
+        .await
+        .ok()?;
+    if !out.status.success() {
+        return None;
+    }
+    String::from_utf8_lossy(&out.stdout)
+        .split_whitespace()
+        .find(|s| !s.starts_with("127.") && s.contains('.'))
+        .map(ToOwned::to_owned)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn route_src_wins() {
+        let route = "default via 192.168.1.254 dev wlp3s0 proto dhcp src 192.168.1.116 metric 600";
+        assert_eq!(parse_route_src(route).as_deref(), Some("192.168.1.116"));
+    }
+
+    #[test]
+    fn route_dev_without_src() {
+        let route = "default via 192.168.1.1 dev enp0s31f6 proto static";
+        assert_eq!(parse_route_src(route), None);
+        assert_eq!(parse_route_dev(route).as_deref(), Some("enp0s31f6"));
+    }
+
+    #[test]
+    fn addr_inet_strips_prefix() {
+        let out = "3: wlp3s0    inet 192.168.1.65/24 brd 192.168.1.255 scope global dynamic noprefixroute wlp3s0\\       valid_lft 85328sec preferred_lft 85328sec";
+        assert_eq!(parse_addr_inet(out).as_deref(), Some("192.168.1.65"));
+    }
+
+    #[test]
+    fn empty_route_table() {
+        assert_eq!(parse_route_src(""), None);
+        assert_eq!(parse_route_dev(""), None);
+    }
+}

core/archipelago/src/main.rs

@@ -50,6 +50,7 @@ mod electrs_status;
 mod federation;
 mod fips;
 mod health_monitor;
+mod host_ip;
 mod identity;
 mod identity_manager;
 mod marketplace;

neode-ui/docker/nginx-demo.conf

@@ -91,7 +91,10 @@ http {
         }
 
         # Proxy FileBrowser API to mock backend (demo mode)
-        location /app/filebrowser/ {
+        # ^~ on every /app/ prefix: the .css/.js/.img cache regex below must
+        # never swallow app-shell assets (they live on the backend, not in the
+        # web root — without ^~ nginx prefers the regex and 404s them).
+        location ^~ /app/filebrowser/ {
             client_max_body_size 10G;
             proxy_pass http://neode-backend:5959;
             proxy_http_version 1.1;
@@ -103,7 +106,7 @@ http {
         # IndeeHub: reverse-proxy the real site same-origin, strip framing headers,
         # and rewrite its absolute asset paths (/assets, /, src, href) to the
         # /app/indeedhub/ prefix so the SPA loads inside the iframe.
-        location /app/indeedhub/ {
+        location ^~ /app/indeedhub/ {
             proxy_pass https://indee.tx1138.com/;
             proxy_http_version 1.1;
             proxy_set_header Host indee.tx1138.com;
@@ -129,7 +132,7 @@ http {
         # Proxy every other app UI (/app/<id>/) to the mock backend, which serves
         # the per-app mock UIs (bitcoin-ui, electrumx, lnd, fedimint) and the
         # generic "Not available in the demo" notice for the rest.
-        location /app/ {
+        location ^~ /app/ {
             proxy_pass http://neode-backend:5959;
             proxy_http_version 1.1;
             proxy_set_header Host $host;

neode-ui/mock-backend.js

@@ -2419,20 +2419,34 @@ app.post('/rpc/v1', (req, res) => {
       }
 
       case 'network.dns-status': {
+        const dns = mockState.dns || { provider: 'system', servers: ['1.1.1.1', '9.9.9.9'], doh_enabled: false }
         return res.json({
           result: {
-            provider: 'system',
+            provider: dns.provider,
-            servers: ['1.1.1.1', '9.9.9.9'],
+            servers: dns.servers,
-            doh_enabled: false,
+            doh_enabled: dns.doh_enabled,
             doh_url: null,
-            resolv_conf_servers: ['1.1.1.1', '9.9.9.9'],
+            resolv_conf_servers: dns.servers,
           },
         })
       }
 
       case 'network.configure-dns': {
-        console.log(`[Network] DNS configured: ${params?.provider}`)
+        const dnsProviders = {
-        return res.json({ result: { success: true } })
+          system: ['192.168.4.1'],
+          cloudflare: ['1.1.1.1', '1.0.0.1'],
+          google: ['8.8.8.8', '8.8.4.4'],
+          quad9: ['9.9.9.9', '149.112.112.112'],
+          mullvad: ['194.242.2.2'],
+        }
+        const provider = params?.provider || 'system'
+        const servers = provider === 'custom'
+          ? (Array.isArray(params?.servers) ? params.servers : [])
+          : (dnsProviders[provider] || dnsProviders.system)
+        const doh_enabled = ['cloudflare', 'google', 'quad9', 'mullvad'].includes(provider)
+        mockState.dns = { provider, servers, doh_enabled }
+        console.log(`[Network] DNS configured: ${provider} → ${servers.join(', ')}`)
+        return res.json({ result: { provider, servers, doh_enabled } })
       }
 
       case 'network.accept-request': {

neode-ui/src/views/Server.vue

@@ -630,7 +630,11 @@ async function applyDnsConfig(customServers: string) {
     const params: { provider: DnsProviderValue; servers?: string[] } = { provider }
     if (provider === 'custom') { params.servers = customServers.split(',').map(s => s.trim()).filter(s => s.length > 0) }
     const res = await rpcClient.configureDns(params)
-    networkData.value.dnsProvider = res.provider; networkData.value.dnsServers = res.servers; networkData.value.dnsDoH = res.doh_enabled
+    // Never trust the response shape: an undefined `servers` used to reach the
+    // dnsDisplayLabel computed and crash the whole page render on `.length`.
+    networkData.value.dnsProvider = res?.provider ?? provider
+    networkData.value.dnsServers = Array.isArray(res?.servers) ? res.servers : (params.servers ?? [])
+    networkData.value.dnsDoH = !!res?.doh_enabled
     showDnsModal.value = false
   } catch (e) { dnsError.value = e instanceof Error ? e.message : 'DNS configuration failed.' } finally { dnsApplying.value = false }
 }

neode-ui/src/views/server/ServerModals.vue

@@ -94,6 +94,7 @@
   </Teleport>
 
   <!-- WiFi Scan Modal -->
+  <Teleport to="body">
   <div v-if="showWifiModal" class="fixed inset-0 bg-black/60 backdrop-blur-md z-50 flex items-center justify-center p-4" @click.self="$emit('closeWifi')">
     <div class="glass-card p-6 w-full max-w-md">
       <div class="flex items-center justify-between mb-4">
@@ -161,8 +162,10 @@
       </div>
     </div>
   </div>
+  </Teleport>
 
   <!-- DNS Configuration Modal -->
+  <Teleport to="body">
   <div v-if="showDnsModal" class="fixed inset-0 bg-black/60 backdrop-blur-md z-50 flex items-center justify-center p-4" @click.self="$emit('closeDns')">
     <div class="glass-card p-6 w-full max-w-md">
       <div class="flex items-center justify-between mb-4">
@@ -223,6 +226,7 @@
       </div>
     </div>
   </div>
+  </Teleport>
 </template>
 
 <script setup lang="ts">